stealc | f9e1b21f7e880124e340004051b3c75aa5da300090279219f14350b6c7223ce9

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.5MB
Sample261001-smwcdstfpf
SHA256 f9e1b21f7e880124e340004051b3c75aa5da300090279219f14350b6c7223ce9
MD5 46a592147d828149d65079fc73af2e0b
SHA1 7d56779033efdcb692252a2626686cde3dbad0f9
SHA512 4b557b740dead7fe785d452db7ecb2e91e974b1e7126cb2b3226e9e67e17ee39d9198385b685b53038d763cfe208f8f52ec92627980b12d0a77d0a48988d795a
SSDEEP 49152:pikTMyYL/XelJpFrm+NEUAzyABqAh2zMlX5boOwcZMzR1dIgdV9fJ1BTvgbj4MYk:TI6uiOVMNLFZ1Vk
TLSH
T1A0266A0BE6B941F9D0BAD1398A979617FAB27819973197CB0290465B1F337F09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc ransomware spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/3104-52-0x0000000140000000-0x000000014047F000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
4752	alg.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
1004	fxssvc.exe
4220	elevation_service.exe
5012	elevation_service.exe
1464	maintenanceservice.exe
1652	OSE.EXE
432	msdtc.exe
4216	PerceptionSimulationService.exe
3736	perfhost.exe
4836	locator.exe
4508	SensorDataService.exe
1600	snmptrap.exe
4460	spectrum.exe
864	ssh-agent.exe
3352	TieringEngineService.exe
5080	AgentService.exe
1956	vds.exe
4392	vssvc.exe
856	wbengine.exe
3068	WmiApSrv.exe
2044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	elevation_service.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\70f43cc65ef7726b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000e6f6e5b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db7d8fe6b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000029e272e6b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e80b1de6b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000696d5de6b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009435e6e5b751dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9a658e6b751dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b45769e6b751dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4248	DiagnosticsHub.StandardCollector.Service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe
4220	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3104	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	1004	fxssvc.exe
Token: SeDebugPrivilege	4248	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	4220	elevation_service.exe
Token: SeRestorePrivilege	3352	TieringEngineService.exe
Token: SeManageVolumePrivilege	3352	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5080	AgentService.exe
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeBackupPrivilege	856	wbengine.exe
Token: SeRestorePrivilege	856	wbengine.exe
Token: SeSecurityPrivilege	856	wbengine.exe
Token: 33	2044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2044	SearchIndexer.exe
Token: SeDebugPrivilege	4220	elevation_service.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 1144	3104	2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 2044 wrote to memory of 1412	2044	SearchIndexer.exe	135
PID 2044 wrote to memory of 4032	2044	SearchIndexer.exe	136

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_46a592147d828149d65079fc73af2e0b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3104" "1264" "1096" "1268" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:1144

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3372

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1464

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1652

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4508

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1600

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4460

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3472

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:856

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3068

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1412
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c1e8a5e019894397919b352780caac1bfbfe80942a42f1a0e8e716d6189e8dae
MD5 eca99f76611d42b8c6c824a20a791358
SHA1 55f3f2bd3630b5355080270022278ce1b12dc45f
SHA512 ae9e672f08a91e9ecd23f93e59138dff1bb3484e6940c8de405a6a14f57b9dc8a9b45198cf6c14f3f81b57415b3582f3fef7bf1a3e548fa81eae0f074fd9542e
SSDEEP 49152:6b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnGRj4MYPVyGLm:s3q6HjBuVa
TLSH
T1BCD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 29d75fbf6fc40a24d0bca5f8acd3dbd00cc11b16686862bb6f880b21d92efd19
MD5 419bf1b74283a75ad1139f5544232e3e
SHA1 f07046b5b29cc8d3d7b39a8006b07537761fdc28
SHA512 f2ac73cec5a1a0a801b33fb40ba82529550b43a77469b0a2fa8dd1e58a8d0ca81d7807de216fbe7845bc68166caf120abc301d4fbb2a0714288b1b355676b140
SSDEEP 24576:2XYfDtczA32SnnrFb4PM4MYgLxEVyGL5:1tcARj4MYPVyGL5
TLSH
T1F265F12977E408F9DD6B8278C9A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 66c243731292685e353f05ba0b7f84f68ba6aec8d5ee8110a79dd408efe0245b
MD5 6b7c73d0423d79695fba89e9fd98c8d5
SHA1 0161fc225d48091140baae6008c4c0eaf46c0460
SHA512 ccf8516914ad56abc02a48697322d05286c648dd08d03369adde24c6562b8dc53a526a03d3b02bd4c64339d5a70962af23f95179f6023e479af61fb53ef2db85
SSDEEP 24576:P0Le5ji0hmxirMe2SnnrFb4PM4MYgLxEVyGLR:PPji0AcVRj4MYPVyGLR
TLSH
T198859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 076320bc5d11d8a5806ea0085df953ef6e0febd14eb6e24113c1e4ee6976b3a4
MD5 4f9c6a94f212837030cf0c447790b1e2
SHA1 d023db67e0e24ce87256d857adccd9dcff85bfe1
SHA512 a1e5f728da43835d93ec70bc3f0ed372aeb713af5390a40f0278858b9b5246e76d2395226c746ad9ba4971729ef9c396bb3b5266a13bc2f4e3a6a8a28c9bf35f
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuw2SnnrFb4PM4MYgLxEVyGLW:T/ezSC6vUzPvxHjyZRj4MYPVyGLW
TLSH
T174755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 38a2865a38f6b3c4f1e666e1d71fa8f60a4c09bfae6635f993cc6ed2bc99b12f
MD5 eb13af15629a1ad6d3af9bc0347a5213
SHA1 93a9ff37375c231a704738ab8139c3e4c3003ead
SHA512 809440387f53096d713fb44d019934a66ae7ae47efc751ab4ef388ac0d019e5fa0150f4daca76ac648c900924b34ea87f16011bee14f1c5a4a0002e461d38d72
SSDEEP 24576:YVbqPb88hv/l+6j2SnnrFb4PM4MYgLxEVyGLP:YVO88hXl+SRj4MYPVyGLP
TLSH
T1FD559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 622e396598a96975f4e7d47600421db5e72ee2938678e7006a425bdab1abe799
MD5 7a9a543153511ea628cd3b70e391ba12
SHA1 1024dcdf57003c591d6b24e66dc67898ff064464
SHA512 abbb3fb7b26ef562f96b0fb785cb841c16af8adc20b050e6d8bfb3796ab608ba1c7ab34fdc2c67991794d0a94e0a223ac54abec101a1a16bfccc51345426f6a4
SSDEEP 12288:BR6x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il5:BR62SnnrFb4PM4MYgLxEVyGLP
TLSH
T1A54523A66BDC10EACFAE15B0D1F96AC8E2157C61F875B20B6740785B3A3F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3a76bc32b24ccc5b2c13daeaf78b5e35da4d6b88c4abea2e89d4a30d6ed2d62e
MD5 4175474df77bfc97f16647842956a0ee
SHA1 eeafc4c53223cc92028dc5aba451b215b429f0b0
SHA512 a93af01224b4bc9838382794c0f0425f300ec040c7fb5b8fcf8fe8d47a37bd9cf2960daeeb81aa53425c09360abcdcea0fc9a91e00e951e352c8834d55c70998
SSDEEP 12288:SeBNUbTVO86Ubx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilf:SJIUb2SnnrFb4PM4MYgLxEVyGLd
TLSH
T14365D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a943459d486a51b475e394f6c6ddd7d79d072b4bc793a7e724253763fc97c1e1
MD5 d3fc0dbe33d956d107a3383ed93a303e
SHA1 88008d337ec60afd54ed1ca1a20237f4259845d2
SHA512 a42a05f803234af4e96b23012737d94437603b22ede582a9a4ae753dc9610e780fc251a7e2f949157660a4c8de3b77fb61f2a278f76b32059ee21e282539ba9e
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:qQvGAdlCEL8c/yRNw5CrVR
TLSH
T1B6267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 efa81eac934c2a59b4d56e47172f39e686ba99e0929837a040a169a2c7cb954b
MD5 3da83a7313c7585b27bbb5a4d02f9db1
SHA1 0fb81e709526cb089978863ca5a816316fc255af
SHA512 17666a35b70778c66eea19e6f89eb08f27f595feb8114d27ea068d09b6df7f70b3662bed40fe22f95440a005bebdff0a587523c7d11241cee949b48111c2aae9
SSDEEP 12288:0AwSfxL/2Dc34DLLmt0LDQewsAjFx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLe0:JdewsAjF2SnnrFb4PM4MYgLxEVyGLK
TLSH
T15875E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2a363ff4fcfb1c81eda9643be825b9850e44f9765e797844e23c26c9427e4419
MD5 42d2951809e0c42598846844b223ec86
SHA1 aa2c91a997fe7fc100f2f04decea914f1f1c8bd7
SHA512 9cd86b174aba0187b8ca1f578230fe6168d56307ba90ab1feb1baf915b504a647fa14ad04a885323e1cc492b4328c5f7f2bed6639ecc3486d18fb8f39022e795
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:DUEtQevvqc2W1cpV2EI32
TLSH
T133474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d4dbb80054b55a1da1d927dec562ace1056cef3c9b6fcaeb6147e0c32efc2379
MD5 392a16d92812bf1556045076ce4ab48f
SHA1 c806517bb47078e92003316da3992a0174e18d12
SHA512 8b1c9c4a13782e3ad8ef15ffe8f1f1d0c31fbfb15d57849d20caae647dc6c004a3b5a533ba7786ff97e7607ada71c41f0b9ace46fc53ce5f4f7241f901cb6fb8
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/zlRj4MYPVyGLL:KoqtVjnm3VH
TLSH
T1D4D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2ed13ae1236e8fc2f9c3cb14bc544aa6c627dbba050897d016f3ee8475075140
MD5 1f2fb3906c7a9cb326a1be108e71685f
SHA1 829bc230b2e81b7e4527fac41add040ac698ba9c
SHA512 2c37b07471cd291ef8897903315ba450f7647c7d69b15627b22555391ad9f646e0a7753493fcad724495954ae247dd44813d4b1d6b710fb146e6980fb2e2ebef
SSDEEP 24576:vAhGLJIFoiwtA5l7S53E2SnnrFb4PM4MYgLxEVyGLe:vAMyFoiq5URj4MYPVyGLe
TLSH
T16835AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 ae22d38cbe1875a9d714107181bdd3a4dc07f17d1e151cd8371cffed6ff3e861
MD5 f902519c69c7e91fe389d71d0d656f9d
SHA1 95099ad1cd3073c9336eaa1d2c7260ce00f27ec0
SHA512 2641fddfd671fcdbb24b2d129497f17808ff8f85ad401f6c200b329dbd28b5d0ae3e77ba976f8fbfd4aa6f3879dbc01c2a94489add3c47c95b3a62ffb1ea8b1f
SSDEEP 12288:Jmw5HEjsChNVBFgl0WDm+CQx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyc:EwuoOW52SnnrFb4PM4MYgLxEVyGLp
TLSH
T1E265F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1e591aeeb30db6f9eb18f0e6fbfcff50f23a0fab1352816af5c1ad241bcd38f1
MD5 cd08a51ac5928d677c22dde909ad3345
SHA1 aab1247e07028218f321c6d29e47e461415c07da
SHA512 7ae23509e1effc6868a117bb458788c39eba12c7059cd791f25aba34271ecd2928184fe7598cfa4c0f55284833b3729009688303e6e752cd2d59a0c238b2b150
SSDEEP 12288:wBZ1Iy1x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:uZu22SnnrFb4PM4MYgLxEVyGL8
TLSH
T1D75512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 acc354f1f1cee2e08fd4aa2a5240cf5031d9fec4c1e3fc93b60da8a6532c6dbc
MD5 1858e6975d43c30a9f865e73ed14f7b4
SHA1 c8a86ecf7aa13097e2da915703a1499d181b3982
SHA512 f1c8fc6268260a3dbfd6d0a909d9065ae3272f5bf30c34d7b17b1a05ad68f0c23daa33281eadd82ea675cd02e88ee31b692153164578f991df2a0f3002f41959
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:WQRQyi36YOcPQLvw2gAf+PN3iV5
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5a4460dc515027737f9a0234bfc0175f8da60356525208efb07655a5c90fccee
MD5 876f48c621377320ce546b1575e5d8e9
SHA1 68c579c0c85e9524d586a5404230f5834ca94f94
SHA512 6ed055c43645775eb3ad7852da03995427768daf1eac6c34df2a5373c7e77351c9ea50df02ff437fd5799b01bbcf6b5e074accd519396ac91444a5a20384e261
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ud:eQRQyi36YOcPQLvw2gAf+PN3iVo
TLSH
T1A1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 cb6d17c4fc3ab85ce520006cd8168fbad9a402a196c5fe7e63074b3255be2bbf
MD5 208e9ec244788120e5d68abf1767cd45
SHA1 1aede04900e895ac7add5363bbb921a06bc17efe
SHA512 de8a401a3aab94dbcc64c4a1552c054179b427df874bf20650d3773d0810e7c0b4287b1e66712cd7681222a1a30e8542785d70399f013ba60c50a6ca36866d3a
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0G2SnnrFb4PM4MYR:V68Qg55nhheWu7PNU3/VRj4MYPVyGL9
TLSH
T1F7B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3ebf8e2a472f4e3586d473ca4ddb9ef1852cee14405e0ab1b654309d6e817d78
MD5 e6fd5ae72e29a146e7440a00ebec7a1b
SHA1 b4bad6654c9f4334d7c3a6bf92a09945c3641f3c
SHA512 956c64ad67068cbe5c398af8566664666a28722c33558690a37177e806c71a7063776657759f10750ffbdf1f67c733e438a4d2a7ae18036ec99d24cfbe39b51f
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Fy5112gYy5azzVvL69nLKnhZ1VO
TLSH
T11D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2e167dcbc0cca80cfc36bc243532bd396ba713aafd245cc09b22c85c2288b0b5
MD5 deec32169079012013552e540a4dee64
SHA1 d1ba9c3eb2cb8b31ae2aa7a5973a7a442009ef1d
SHA512 5c85a33f31ffab6a27634e26e6d5f5a1dc99f4372818b7daa314dea58dc8ff55104a22ba74f31010b71bc7857dfb2f95810db9302e270603331e40155f2b13ad
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHRj4MYPVyGLq:hu6JmVxd2dKVu
TLSH
T16BD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 187966c9971a8eaefd0af643aba5afae9f754036b57ed65bfdefd4a5d0e50357
MD5 4773b71b40122d56b79b58e5f51887a8
SHA1 ad01294847cf8b43b24ace5038c005911cf0c228
SHA512 c11b94552c5f9574b47b0083be0be5a2ce622b283e274a84144fba3d57d58dc77d2b554b501b5bccc67b05bae9d3750103652caf2679d6a36dbfbce1371750a3
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4x7Rj4MYPVyGLD:gmifPbR3VX
TLSH
T193B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9b4c04bf5b14d4aefdceaa7ac980af190642dd2235748415dab72c938d035c25
MD5 37f54b6bdd79969c75a3f8873fc9eea8
SHA1 051212b313ad8181258f1406a47d31482fcb645e
SHA512 505d570dadd0b316f82eccd24363df9f061d7e52896faabe080a03eaf5d319c6f151a08435a568c91a01f2879a2139629c986cf8cbecf0f839d941e5e15520f3
SSDEEP 49152:PSuZQIY0Be2KRRVtOnks6NMHq2Rj4MYPVyGLC:15dKTi61pVe
TLSH
T173C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6ee37f4327a0165d4d57c028b45fd1ec503b7e07521edbceaf39ccf2e0c93ca2
MD5 41ba3d2703729ac51ae2af80719cdce4
SHA1 6d8ac0b2221d1e0714ca0ae9745c42c9700913cf
SHA512 c6cbcfa4baf7423785df9e65f41f033c9ade6b01b396c3864a31aa9142749479985f6ebfac8530870d1a26bd65357213653910cd277889790ed9cba242667ab0
SSDEEP 49152:7htSn8EApI0figngiDn0AP5w3Rj4MYPVyGLC:aX2iyphjVW
TLSH
T18895BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c9db34f88a989285fd500c5a3cef1a29eb76e5b6cc7ffc20b39f119bebe83aaa
MD5 b0cae465641b68f500cce88599ae902e
SHA1 965a2bfcedec1cc3b16637c22e89d0a4757778e1
SHA512 b23ee296b6c152e31cf856ff1fcb6606299a3f12bd7c2d40ba70206f052a8cf60d83eec27964aa2fb8e6171d91bde240e3167413771a152d1f540d9cc3463807
SSDEEP 12288:+Sx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:+S2SnnrFb4PM4MYgLxEVyGLH
TLSH
T1C64523A62EDD10EFCF5D16F0C1AA66C8E2097C62F976B20F774574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8312144264546028bd1c8057f662ed9860d99e94d0c66d5370fdf2cbfac5e1d7
MD5 b346b499712e2c25fac8429fe3311e58
SHA1 b4fe024e09201216395302ffbca9d245b27c4dc8
SHA512 08550ee860f5b181f0f4766a45a1038ecf7f0ad2c150e34625188cfaf47757d4f1555e08005686e4034f08f6ce7c1cb15980460dd14c49644560d724d91f6774
SSDEEP 12288:Ghx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:Gh2SnnrFb4PM4MYgLxEVyGLL
TLSH
T1614523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20B7B4474173B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7706caa8426e8c659bcb2260d13c3f8b7976fe59541b9e63e63d65219c27f652
MD5 9cb34dcc843e7579b8d02d9a7cb1d70f
SHA1 77c304aa863016a22d83fe453145a6adc4b782d0
SHA512 681c9023751c42b44666d0882e8bd8037754e86c020acce57bc72a6d5a617f8be7b5bcef3298e5a8250db66e80fb1c676ac9e15e55045fb8b58d6fb8011638ac
SSDEEP 12288:7zx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:7z2SnnrFb4PM4MYgLxEVyGLL
TLSH
T1EA4523A62EDD10EFCF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 364fd319d0d7cc38d9de9312242efd3c03f8388b737be30977d775b7620e4901
MD5 7e321b1fa0c0cab3fab4a480f37be908
SHA1 14e08a45b064fe289e6434c5ccba34f0b3567e5c
SHA512 b5208764dd157278bb48de3db5d0639a5b749247cef287a87d2171427cc2609cad4b604a843521a6e0e5862c5088f1c766f2b1e64660eace11d0a9bd22b3022b
SSDEEP 12288:UVkx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:v2SnnrFb4PM4MYgLxEVyGLQ
TLSH
T1704523663BDD10EACE6A96B0C1B556C8E2257C62FA72B35F6740381A3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 15d69c90564e837e7382e06948a14124ce91ee028e262d6f87ff5948c5a434c1
MD5 03aad207203b629aab06d6d82b067d93
SHA1 204cd500a6c2cded925d3ebd25f2c7ba7111886b
SHA512 13ce6cddf7b0df8f78bae9df11cd1e4d85dc3d72a8d3138ea13c54e26aefa7ec56315d31f676a46c3e949610c22091e0bcce34a49be10117724a91b921460ec0
SSDEEP 12288:Nsx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:Ns2SnnrFb4PM4MYgLxEVyGLn
TLSH
T1244523A62EDD10EECF5D06F0C1A666C8E2097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9ceeaace5c2b6f8d679c3eb0172da6d6bf0dcdfdb6639e59367e1127ab54a520
MD5 4e8560754d7c68789f85648c396a13fc
SHA1 d9be75840b7baa4e64a5c0b2190301c56e09c937
SHA512 9f745dfaf01b2d05f852304b58e6a9812423dbecd49f06ca5db6bd27cab430daba6bc14d61c21872dd05783694888cd49172269e32a7fc67a6c76b1ee00289b2
SSDEEP 12288:t9x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:t92SnnrFb4PM4MYgLxEVyGLn
TLSH
T1664523A62EDD10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0082c732c2fcac4d27e2f52b14dac87d353b043f1b045f988a736eaa476639b5
MD5 db19cb95267f4d7e3fc6f5a6d52dd8b9
SHA1 ee8206729d5a8150edc8932c08c7af9ed7d0c36e
SHA512 fab98f337a54122e6474aac1b7d056691c90fe49bb899b466390aec954e63466165d3b6de7e18f6e3a391837a2b5be13cff81f64951b19bdc1126d0c659d2b14
SSDEEP 12288:RJx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:RJ2SnnrFb4PM4MYgLxEVyGLJ
TLSH
T1B54523A62EDD10EECF6D06F0C1A566C8E2097C63F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3330d6a4969dd294e250f5d1977dffbfd52e78aa2d2d7d815bb75697c506713b
MD5 72dd5732b2424e7f90d29c8e1574edea
SHA1 ee46ec861fcaf923888d3ea396c6c8502fe40bef
SHA512 78884906b42894a16ce0a85fdbbeb5261855e75f6ade41c2c33bc2cc3d8b28c148552744f2d66e43163cfeb728406fb8f5c49413c0972bdc804e2dc118ca638d
SSDEEP 24576:kZMSzFVSOB2SnnrFb4PM4MYgLxEVyGLf:kZMSzftRj4MYPVyGLf
TLSH
T12B6502A5739018F8DD67827EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 90dd5f1361fea4312f1d3ae1157c1177f6b9c4b8b6fb8538cf08962734ef1710
MD5 758959f04d89e8ba062567e95b4785c6
SHA1 1bce5f2c9875a83789ea40d94108f877544c8d59
SHA512 961205670ae4f514bc094f14e15694ae3e83af1e8f38d9268313cbc262df009042921c3dcea1828d3d258da7f13e6f4d2fb0ba6ae62bded4f3a2e4c9b2e9f45f
SSDEEP 12288:umx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:um2SnnrFb4PM4MYgLxEVyGL9
TLSH
T19D4523A63EDC10EECF5D06F0C1A666C8E6097C63F976B20F7B4574163B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 a5714f101f2b3f94accd306a553247f4f2d3f7e9f8b73fd2d288292acdf23a10
MD5 86c38ff159bb1f79a282f2f8adc993e3
SHA1 c70abb8f5122828f4d759981e70974f4040f69db
SHA512 ce489275f65eb40b5a6e551c8730a16b5d39c693fd0b0d9cec1ce90be20ec2c7bbc504cd58e64a300be63ba103f954100b20992875ccea15e9b2f3b6c6341149
SSDEEP 12288:Yqx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:Yq2SnnrFb4PM4MYgLxEVyGL6
TLSH
T1454523A63EDC10EECF6D16F0C1A566C8E2097C63F976B20B7B4578173B3B60D5891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d5c2e57be48223e55a0cee88ba68ade140224873ba0446788869d7a832d37338
MD5 37498c3b0e0c55056d0ed1d1adb13edc
SHA1 a450dfb24984ec86f48ea985379327136738b4bf
SHA512 5e4da2ff7060692587b0ee6a067b31bbc685e75d32ced77fa16d5e3d5007b27ecb8037ec4a3a15c422098c343a25ca875d0c5f5e95e2118a1f55b2585ca828bb
SSDEEP 12288:oyPz5L81x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:pzy12SnnrFb4PM4MYgLxEVyGL8
TLSH
T1A355025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 5767fe18f0af1d0235c4174a195b8d68877f27c004f13be468e0b9bbd04bfbb5
MD5 7acdce43f0bb3cf54c9e128b7b3cb485
SHA1 6c3b494c523852a65e7edb9117cc09b79af7afb0
SHA512 47d8ec9068d8e9283a0b4d626b68a203eb842947f891b3f094e4b6c6d8037304268793a008e9cc3ad3171b065b8d26b4dce91503f6be14cbc0b12a7cbf236c87
SSDEEP 12288:2mx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:2m2SnnrFb4PM4MYgLxEVyGLe
TLSH
T1214523A63EDC10EECF5D06F0C1A666C8E2097C63F976B20F7B4574163B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3e73497c7727b6fb89101475d89ffd110f8c16ae614d48abd5bfebe86b96b52c
MD5 3339b546e16220235e4f6b7689daaec8
SHA1 948e911f5fd389ad6d173298fd48175fd2a534ab
SHA512 7bf74ffa78794e8a9a9aa747926250a38f87c1cd7078330e9c74537230dc6fc139409fe8aab5d5384ee5cf7d2faed84266d1c26c9ab549f0406b1d657ecbf40f
SSDEEP 12288:ymx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:ym2SnnrFb4PM4MYgLxEVyGLe
TLSH
T1564523A63EDC10EECF6D06F0C1A566C8E2097C63F976B20F7B4574163B3B60D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ce2bc4878934ad5b519365c5eb629489305a8a7912f30cbbe2d97d2abade7842
MD5 82a42eb15e0a2433dfd1cad657818fa0
SHA1 7729b16e9e583f76ebe3d17aeb5fff2a729d0eb3
SHA512 fd12933298d692e80c9f619304f8833af230cef0b774151b3b01c643369893faa24b0726102ee4412fad0c68a2510e1fc9a34ff07ae42ce7cb078ab9b98d31fe
SSDEEP 12288:xyPz5L81x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:gzy12SnnrFb4PM4MYgLxEVyGLM
TLSH
T1E255025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 a13c93af4a51a44076d0f69c916ad62844cfc2e6551b033515182f98236c5d7a
MD5 dd949b13aa632c1a7019f481b679ce77
SHA1 f501dd3f0df9f7d35bcb306325f838b37747b80d
SHA512 01774772e41085c49465c7de6859d260ddc9262f996aa2bd75b705ff669eec4c193444c11af52059aa4838828d51fc2255ad00e2fd36808ee6afcad11e9a8f86
SSDEEP 24576:xTHaLl3z0zDD2SnnrFb4PM4MYgLxEVyGLx:xT6LljwRj4MYPVyGLx
TLSH
T1746502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3cd5ebd980edd1965a36ee3d5eaf2f7b61e76096e244844dc0ff27f0d9ba112d
MD5 ff91cd71cad4d1ac0763f2ac0871ee90
SHA1 436f5053bdf9ccf0ab3a651ce99a67e224b604df
SHA512 9eabf77bcd66531c2263bb208519728e518834e9781fbeef4c0ceafef722add5aaa388bba553bf16a70a92e4253617d1c567a87ccb3321d8b35feeab8885ddb3
SSDEEP 24576:b37d9CHKy7GZv2SnnrFb4PM4MYgLxEVyGL3:77d9CHKyatRj4MYPVyGL3
TLSH
T18775DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 2d3392b127dc6d0d5f080669f2a5aaed08eff2959de7c4a79ed8e749d837166b
MD5 ce28ffee4e1ffeba35a45b14955887ec
SHA1 33fa68a69df8e7691db893dc22872a9dedb1cb19
SHA512 af99369ba83514df3385f0cd3e6bedad2269716fc33c12c1960daac3e584361f0625fdb62bc123e2715414fc33db107b55e0114a182f92a8f2d5c5f8f201aa92
SSDEEP 12288:FTx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:FT2SnnrFb4PM4MYgLxEVyGLk
TLSH
T1D34523A62EDD10EECF5D16F0C1A666C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9ec416ecd6b3b17bc6c9d89adab42fd6feb3c1501915e67393141202d851c7d6
MD5 4336b57c3bfcbf384fdb6ac4988bbc2a
SHA1 9938b9da7794f8e642cdb9c4058ded999b0b2a6f
SHA512 0726f521d7b68a22064a45a5a845cf9c97af61376323c30e43fd22a6d7484c2f3eecbc92f6fa5fddb97f56529b100ec73300a98c72b7d30c301a40c269bc4750
SSDEEP 12288:4Vx34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:4V2SnnrFb4PM4MYgLxEVyGLM
TLSH
T16C4523A62EDC10EFCF5D16F0C1AA56C8E2097C62F976B20B7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-01_151512_3104-1408.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-01_151512_3104-1408.log
Size 1KB
SHA256 ddc4ff4fb660f935ea16f31eddd96694f6f8154654abb4592de110b4fd4242ab
MD5 a685ca084142596bf49827aae03077ad
SHA1 e3f1021f284346d3d9c97640a494693c84bba095
SHA512 2a794602b8e4705044dd9f9e55198b75f0422faf2f2f3f7a75ad33f942dc6cfa1ca820b14ceb4a202132f65cb03527f33b904bdbdddfee1e24bf964b9865ea45
TLSH
T1F12190162BE40A04FFFBEE8199FA14539D3539522834DA0C10A5434E1871F45EEB072F
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 ea39db9e55eb7ac56d5ebdcc6ef5dac8624d5b6552eb8f32e969cab87d70e68b
MD5 0634a21932c914d6033a1b7f00a3a522
SHA1 7cfb5d592586868d76d8e08edbdf4bbce90173a1
SHA512 245d2ad511892d20bbe2935fa5ad0069e341bd772c84face1eda5b2eae7458d5aa23b705a66034070fde138f2b572a659ced703df15b6578245492d0ea3a1463
SSDEEP 12288:dNsf2x34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il/:y22SnnrFb4PM4MYgLxEVyGLx
TLSH
T19855F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8c01c5e60b16136fd5948477a9406f40fdf5cc53522023f7f990fb88ca128e33
MD5 cb5fbbb659b61320fda70a89d51c0964
SHA1 e08aa82bf7090dc734604e5ab0a9841117c89975
SHA512 644ab2aeca2dac54c5990fc6591da48a9b792ef7b65ee7f6f34c25e57a30d25d8bbf37e1590d68d40f97b0c14ff8f3e434e372e74196ff46ea41ed375cc56ba4
SSDEEP 12288:NO34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:NFSnnrFb4PM4MYgLxEVyGLH
TLSH
T1A24523676BDC14EFCFBD16B081A596D8B20A7831FE61F10FB740741A3A3A6499CA1713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a0966c0c4b6f3dc90c07847013c3a0ef41ecb30d3368936392a18ed2b5b92cb9
MD5 adc1d78bd141900c84e3ecda31ea3d09
SHA1 b48ca478c7a2c45520c5fe1f53a71b8ad99398b5
SHA512 72ce0c35a2f81264155697a90626d1d1c73c6f9cca35c2a5e526d4a50884321a4a5a55a3f6de373165f09c86fead352457e3a3407ed84bdda19377bdb050f77d
SSDEEP 49152:ga0h2GEkuAe73q3pp46zwwQ4j4MYPVyGL/:ga0hNYG4JwGVL
TLSH
T1DB85AF1E67EC82B5D0BAD278C9A6814BE6B2B4221B3156CF1151853D3F37DE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 7b06c73d91e5497fe16278aa0aed3bb77accd854ad9560965c3a10a4ac0642a5
MD5 45cd77e5a5dc3efeb97d0b4c361dab89
SHA1 c4ed67f02e4f926ceda7c4215ebb7f2e5857d688
SHA512 ef15fc8cd27e1c1c74245925156e50f6a798e8b833182fd633967aa23695d56255c2b9e6a0adc46fcf3dec098e1f1d22dea6c14c94aada8846453822b96d400e
SSDEEP 12288:PhbHjfXL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:PhbHjPESnnrFb4PM4MYgLxEVyGLF
TLSH
T14C55127E27EC20D9E675A1B8C1958649D331BC226721A3DF23C1917E2F3BAC85C35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b35816289fb42b4d7820fa787c9171d5cc6ee648095ccc3d90d40ef821886058
MD5 e6723d47e444b444e883096e55337e61
SHA1 d247748b79a23671579239f9c6f10a5696114e9a
SHA512 8ee1c93be1747d1d8feff2f64e8577ec7f9b34e97a94e2e67ec593033cbfe55120f5a943b457d7cd0b41243c31d40282934bb83a4e599ddf12f3966d40230a4a
SSDEEP 24576:v3YgnJcRTk4yti+R5dBR/8SnnrFb4PM4MYgLxEVyGLY:vIgnaTk46pBR/vj4MYPVyGLY
TLSH
T11745BF2EF2B910F9C8AAD236854147B5FB71782D1F2096CB0170C538AF1AED85E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 3dd1e5f1e7805f404b799800111b7dac19f407c18681b68a80b3c449884dabcc
MD5 c9251e47fa12a152f605e613ea50460c
SHA1 48edc0abc18cc533e8a14d2c108f3c6529728f9e
SHA512 c9d41f53eafd43783a9f2fe1682b1efa386455c554933c14554c69d92b05d6b59d7a31dabc35ec6f2db5091f76b14fafaf7f0cb17218e1fc44e3fb7a5d9c65c0
SSDEEP 12288:yS34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ila:yhSnnrFb4PM4MYgLxEVyGL4
TLSH
T1154523A62BDC10EECF6D56F0C1A656C8E2057921FB72B28B764474173B3B68D9CB1312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 f0118c2e6fc7319678ef9539982d8cb98e7133cacf923082c7e31555ad25cd1f
MD5 d584546457d1dc50cec3f00b2f9b377b
SHA1 0824d46e17b95ceb52188c1120515d720545a603
SHA512 daa51e62e879d360eae47f435b00b42b9889c8975355c00a7178ee378bb75f9a629ab1a4937437a6853a5f2b6be9bf7c0e0279e2940ec1646379b94c09674ac4
SSDEEP 12288:yOb9A4LWOsvAYFTX34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:jpL3UTYSnnrFb4PM4MYgLxEVyGLe
TLSH
T111750155F7E800F9DD7B8138C5A28A16E272B85D1764E3DF03A84A662F233E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 cd285b5296d233855fa935511f9b41fd68a204e5520ce87d71cecd5ed28f1901
MD5 3ce5a839b471db7c42d9dfdc060cebc9
SHA1 e3044458901fdb004bfc40b66b76bbe365416f81
SHA512 a23b74706a0a7652bffc740739086091c5f71e31a0c7d369da2c0a467545baecbd8abb3703244411d796ae0e3a1410d70cb120cb1c5c569960a1a6ed90b20f10
SSDEEP 12288:lpFtpOb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2iln:NOUSnnrFb4PM4MYgLxEVyGLR
TLSH
T17055026A37EC10E9D579A1788592834CD331B8625B2263DF07D0907E2F77BE86C36B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9540e1138d254b9c782a108765fbbf54bf3d6485f2f2b753364a9c785eeedae7
MD5 73d48b75ff91f518ac3d50bf9a873ad7
SHA1 43275652564c058eb251157f3c67bd60282f8307
SHA512 a41b66c9c39614a63f683cbb9e81d9039bb2f3f0b9fa37497713e23e067622c95056164fc3a4014df1ecf3385bd38c38e0ca043347583c51df181fc08401081c
SSDEEP 24576:j7NM9YqZqmWMUkPjZM48Mv6bEhsVSnnrFb4PM4MYgLxEVyGLn:j7cBWMpPjN8DbEhJj4MYPVyGLn
TLSH
T11F659E2E6BEC81E5D576D13DC9A28245F2B2B4611B318ACF1252833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1e15e9aad5879e7e71e6092631a27853045cb74e58aa876f3ae9657d1090da04
MD5 d5a648936eae7278ff478ae119a7b57e
SHA1 f10316709d8dafe51847e4ef9455833eaf79227a
SHA512 fbc33e5b7dad23929e63ed612fcd4f545697720b27c3dbd1f0aa66f60b0827b1867433f28c07ffcd9770c7d836f8af5f201f2e39a839e10d00fe2ab3d83bec53
SSDEEP 24576:dW6BApg2YuyuNDYTabvcdvNYf8km1TSnnrFb4PM4MYgLxEVyGLk:dF2YuHNETovAvNYf8kmOj4MYPVyGLk
TLSH
T179857E6927ED80E4E0BBD27D45B6D286FAB2B8511B3056CF0255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 41cc304141b0c734cb901d00957be7fd2dcb0fa5a709355722b98c31ab608e6c
MD5 5048a947511937f8535d4ef573044f60
SHA1 8d143d20f7342a685212b9d66004a32186c11004
SHA512 eb525f42179db0c3f4ff06b80550f5aee677289388fc6df2b0fa3477d6a9be07014beb28c94fac1e89e6c6a43dd3249d9ce2f8c0b4fbbd80c351aa7f5e6ac9ca
SSDEEP 24576:nAFs06+Omlf3NXEbToQSnnrFb4PM4MYgLxEVyGLb:AFs060lVXuYj4MYPVyGLb
TLSH
T13F65AF2F66EC00D5D07ED17D8997C91AF2B1746307256ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 8860f9ada7475cdc26ba07b7ec005bddcbd8d3eb56ea352d35ae735b96bf9a33
MD5 0108f1860259df020783851c034bee2d
SHA1 437bb7d5871e1903d05f30021e78230d12b6bafe
SHA512 879aef84b3565a1303ffcb30154115e1ea86c2b652dfddb96cd47cc79a5242cfb63fe22a73942fe4d3e36437e8ec61be20300f720368543564cb40733c1508a9
SSDEEP 12288:sCJnJ5D3VkrDzx+34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilK:xJnJ5D3WX/SnnrFb4PM4MYgLxEVyGLw
TLSH
T19C75D02DD2A810E9D4B7C2B4819A1795FF72383D2F226ACB28B4D5353F12ED09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4eeacd43ac2d5b6fb9b4624355df54c2e4737c85eee2efa176b6a0cdd39603c2
MD5 7acced3264b01b289839491bb207f4e2
SHA1 a3d601f8e76b8492be0e8493f6d008940fb001c9
SHA512 4b902eb35f993c520c386fe30d1645692960b034ff7e369c63df1f6da78425dcf213ced84ef29e6652e0417d4aec2a5d3967a36d7614833ec70e7cf4767d35f7
SSDEEP 24576:8EPghm6/7IIXdwcXrif7qQncjlP65i3VuWSnnrFb4PM4MYgLxEVyGLL:jg06DIKdwc+eQnSt65aVyj4MYPVyGLL
TLSH
T17A956C16B7EA5294E8B3CAB1C962A1159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 316e1884cf0d1cb5973418bf7cb98e46febaf3f8b12aa3d7c6705c738b5ef8f3
MD5 9bd237781ad981dd4f5a737733b7d695
SHA1 668c7ccb6cf5131da5e308e68cb2002502caf4c5
SHA512 2324f92525b0edfa996af9149056f790ed2ca8899645c2eca1810ede7575aa8d4a86c2e60218e23cc49f6c1b202b9278d47ce459876eff30f4278ec22319d3d1
SSDEEP 12288:5EP3Rni34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:KnxSnnrFb4PM4MYgLxEVyGLi
TLSH
T19955126E2BDC20E9C62A9178C1A18688D332F4717B6273EF1690D13E1F37AD95D39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 22944bea20e841767a87f4e50b11eb0cbeecc596df1203e5c9dc0188d4abeaf9
MD5 9bf7790b76dd0fcab9bf8761e07df0b6
SHA1 96aeb51620fb9b3e8c012c3af1ac6ac77853076e
SHA512 81e9e33c91a5237a56fba92fb9a879d7149ec00c18cbe6901fc4fdc2edc8da206bb58f8e95971582432c3cbb5cf6ca879a2b1917d791d29e214baecd03ed8531
SSDEEP 12288:zjky534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:zIy+SnnrFb4PM4MYgLxEVyGLg
TLSH
T16A55125527D860D9DAB90674C5A682D49A35BC21AF21A3DF6280F53F3F377C8AC31B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 742b2444156b960289d61f4f63c4f1ef56ce682dd3ea1c939e14cd177905b22f
MD5 036e5c5a485ae7e18f31fa83369744cb
SHA1 fbd5bfd515ad63fb619bbbc1d338b570e25a5313
SHA512 a0d6490f6573aa9cc994472408d2f87663150c33215c258bdb6a4c78c2ed351611d3abcb714fa054d729e80c86485faf9ca8442789c1e02522a21fecc8725223
SSDEEP 12288:KyL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilQ:TESnnrFb4PM4MYgLxEVyGLC
TLSH
T15045236A2BDC20EECF6916F0C1655BC8E2157831FB71719F76C0B4363B3B68958B1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 65099afce85af0ef0972b9cf65913490b918fe65dd96a61e82fe430b21e8d5fa
MD5 0c6b712de69c65ed84c0422bf918410e
SHA1 7f6a4a4dda5fabab65dcee006187ffdd835845c2
SHA512 d11b7294427ad99e0269e2f809d9eac1e906661950c7be0cd4ca44d73507e9a65de4b5db3306cf066acacbea6aeb2c61290ddfce2daa370412b7904c16624bb8
SSDEEP 24576:7Q9MxZKdcz9dw3NSnnrFb4PM4MYgLxEVyGL9:7VKZmj4MYPVyGL9
TLSH
T1C1557B2DABE905DAE177D27594A250C3A633B4311B31D6CF2448D03D4E7BEE8AA74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 3b52e7a4de0d9cf84cc8cfd62226d360c3ed5ce0ed918c6a098cee194ff4359a
MD5 e0dccf22e9a2133f6337d0909d947964
SHA1 7fd7f375dfad52245f4d6900521b660f31b9165f
SHA512 748182ce3b8d66936622fba2fd7f9913c150a14a566ae2399eed368f3d59ac6d14eb57f0ef34cb5e68df42c9e4628d39f06849d7127b63a19e9c416bb1be3c14
SSDEEP 12288:jyoKo2JRple9p934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilz:jyocDAp6SnnrFb4PM4MYgLxEVyGLt
TLSH
T10665E01F7BAD40E2D176813889858785E773B0306B6263CB6691C33E5F27AE9BD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 34d67cdf56bec40cd4ab1562e7f8a4903baaf3ca7909935b80f4c251317bace4
MD5 552fa4d31ac74732edf3266f19944852
SHA1 fe608f0bbf1fff8b94624523d64170ae27094ed4
SHA512 90544d99c389dfcc7113fcbcd7a265af68ff4991ef59d00f50e160d369188ccdddc26d87876f65b3b3113ab50dd3eee09f5b0ca557a27aa1584d9e05e1c65edf
SSDEEP 49152:qWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IK1j4MYPVyGLV:s0zuNIoVx
TLSH
T1CBA57B3DA2EC00A9D9AAC375C14513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 71dcc15f0b7810f676a635d9be37c6731b9b138791bcf2a5f8d1cea8978ea705
MD5 07659d743db10dd406a862fbeffe8bdd
SHA1 e21905765efb32806dd9d1e63034db156b7e28af
SHA512 3f6801c431d3826d5ca5baa7dac66e4d80eb60ed239dfc1b526fea93e2eeb86206f915604c6cb74b0fd8f50989556411e3800175d7880f3056851f40bae602a5
SSDEEP 24576:K1QT7EcpfxR+N5AWAz3ooiYtjMqbxSnnrFb4PM4MYgLxEVyGLp:3TDxR+N5YzTfjMhj4MYPVyGLp
TLSH
T1F555B02EA7F815E9D1BE85788A23C506FA727821133193CF42A0C17E1F6B5D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-254-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/432-409-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/856-368-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/864-312-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/864-310-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/864-465-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/864-304-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/1004-78-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1004-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1464-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1464-81-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1464-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1464-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1464-79-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1600-431-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1600-290-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/1652-245-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1652-91-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1652-89-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1652-83-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/1956-366-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2044-372-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2044-515-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2044-410-0x000000000CD90000-0x000000000CD98000-memory.dmp

Download

memory/2044-370-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2044-388-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2044-404-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3068-369-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/3104-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3104-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3104-8-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/3104-34-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/3104-52-0x0000000140000000-0x000000014047F000-memory.dmp

Download

memory/3352-371-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3736-277-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/3736-272-0x0000000000790000-0x00000000007F7000-memory.dmp

Download

memory/3736-280-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3736-413-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4032-422-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-437-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-454-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-451-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-452-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-453-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-450-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-449-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-448-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-432-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-433-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-434-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-435-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-436-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-438-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-439-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-440-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-441-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-442-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-443-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-444-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-446-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-447-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-445-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-423-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-416-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-415-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-417-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-420-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-419-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-418-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-421-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-424-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-427-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-428-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-430-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-429-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-426-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4032-425-0x0000017F32FB0000-0x0000017F32FC0000-memory.dmp

Download

memory/4216-412-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4216-258-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/4216-259-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4216-265-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4220-42-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4220-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4220-53-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4220-50-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4248-17-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4248-24-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4248-25-0x0000000000580000-0x00000000005E0000-memory.dmp

Download

memory/4248-23-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4248-240-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4392-367-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4392-514-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4460-292-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4460-299-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4460-293-0x0000000000550000-0x00000000005B0000-memory.dmp

Download

memory/4460-464-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4508-285-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4508-406-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4752-241-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4752-13-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4836-414-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/4836-282-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/5012-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5012-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5012-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5012-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5080-318-0x0000000140000000-0x00000001401C0000-memory.dmp

Download