68ac00c3fe0e0828153f79ead79408f53fb054dab94057cd8e40ef0bc8bc1598

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 5.2MB
Sample261012-vz8jlayvbv
SHA256 68ac00c3fe0e0828153f79ead79408f53fb054dab94057cd8e40ef0bc8bc1598
MD5 8213c53b669b2a55f9e741d8d8e547d2
SHA1 ba4e3bf48ccb27aaab21d79dbf553ee237d38375
SHA512 9e4c5d1299964a59acf50c3a024303163ab1eb33f07d78650fb0a95d2b4527ac4058966a239bd4aab333762d50279520f177a180ccbe543318a31a20c6e0367b
SSDEEP 49152:ZaoGdsSX7DxKVf81VvjogeedMseAS6NJ3LvcwBpk1ltACqTMCViUe30jaNf1TWbE:fHW3NjK72iUU023W/JTy
TLSH
T1D8468B17E7B941F4D0BAD1398A979617FAB27819973197CB4290864A1F337F09E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 22 IoCs

pid	Process
1224	elevation_service.exe
1632	elevation_service.exe
984	maintenanceservice.exe
2444	msdtc.exe
3988	OSE.EXE
2028	PerceptionSimulationService.exe
1752	perfhost.exe
1932	locator.exe
1060	SensorDataService.exe
2052	snmptrap.exe
4632	spectrum.exe
1756	ssh-agent.exe
2652	TieringEngineService.exe
1356	AgentService.exe
1880	vds.exe
3316	vssvc.exe
2936	wbengine.exe
3968	WmiApSrv.exe
1308	SearchIndexer.exe
4788	alg.exe
2356	fxssvc.exe
1424	240841312.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\240841312.tmp	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\99d79cfea26b1277.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\aFoj.bin.part	240841312.tmp
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4856-8-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/memory/4856-67-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/files/0x0001000000017bd4-102.dat	upx
behavioral1/files/0x000100000001704d-101.dat	upx
behavioral1/files/0x000100000001700e-100.dat	upx
behavioral1/memory/4856-319-0x0000000140000000-0x0000000140E46000-memory.dmp	upx
behavioral1/memory/4788-467-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/files/0x000100000001700e-466.dat	upx
behavioral1/files/0x000100000001704d-478.dat	upx
behavioral1/memory/4788-519-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 2 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe
File opened (read-only)	\??\PhysicalDrive0	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240841312.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240841312.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b25f9fee6e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eac544ee6e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000478b49ee6e5add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b100aed6e5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1224	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe
1632	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4856	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeTakeOwnershipPrivilege	1224	elevation_service.exe
Token: SeRestorePrivilege	2652	TieringEngineService.exe
Token: SeManageVolumePrivilege	2652	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1356	AgentService.exe
Token: SeBackupPrivilege	3316	vssvc.exe
Token: SeRestorePrivilege	3316	vssvc.exe
Token: SeAuditPrivilege	3316	vssvc.exe
Token: SeBackupPrivilege	2936	wbengine.exe
Token: SeRestorePrivilege	2936	wbengine.exe
Token: SeSecurityPrivilege	2936	wbengine.exe
Token: 33	1308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1308	SearchIndexer.exe
Token: SeDebugPrivilege	1224	elevation_service.exe
Token: SeAuditPrivilege	2356	fxssvc.exe
Token: SeDebugPrivilege	1632	elevation_service.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe
Token: SeDebugPrivilege	4788	alg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4712	4856	2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 1308 wrote to memory of 1696	1308	SearchIndexer.exe	115
PID 1308 wrote to memory of 1092	1308	SearchIndexer.exe	116
PID 1308 wrote to memory of 3912	1308	SearchIndexer.exe	134
PID 1308 wrote to memory of 1364	1308	SearchIndexer.exe	135
PID 1224 wrote to memory of 1424	1224	elevation_service.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8213c53b669b2a55f9e741d8d8e547d2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4856" "1500" "1356" "1504" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\system32\config\systemprofile\AppData\Roaming\240841312.tmp
  "C:\Windows\system32\config\systemprofile\AppData\Roaming\240841312.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Reads the TCP/IP host and domain name from the registry
  PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:984

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2444

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1752

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1060

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:2052

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1292

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1696
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1092
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3912
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:1364

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:1716

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4597ffc3c77ba44653e9a72bc2b2f0996cff4984b8493369ce7af6265f582a64
MD5 7ace2254a0a4bd57db057a9d6a5f83da
SHA1 bca36f51ec3edb5e5f7731bd31cc3b1c59ddcacf
SHA512 66b8bf2ecaf6b070456069eba03c02d9f31efd295440a56a39616444a62b0dfb45dbb676564510c0b8d8780e0a04f57078fa2c2bcab0f5b1d250b6e0f7493b50
SSDEEP 49152:Zb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnre30jaNf1TWbdz:v3q6sjBKU023W
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b724cadfa93695a44aba274252dc1e670f48d1360ff264a30f5241b39da415ea
MD5 17c0343a4bce0d5aae6078e1198daa18
SHA1 997648463a11dfe4ffb8403a81a2bdcb0bfba9e7
SHA512 1b5152bc5d6220e425e44c6a7c8a86dd2e6e8661d08b1b5adac006cc7456bbbb866cabb38338c0bd6f88c73aa0bf4d1d767beee60ec8d712e03218006d306d6d
SSDEEP 24576:jXYfDtczA/gXe4i7ojhsP5Lgrk1TWb4AN5:mtcNe30jaNf1TWbdz
TLSH
T13105F12867D409F9ED67827CC8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 812ce176420f9e3086150baa9f59e90de5d33f65cef1f219d593c2746e81cab4
MD5 f578bfb9b0270324479c7cb0163b13de
SHA1 55f6f5fccbcbe79f67aff57ebd57ce9cdd5a1f4f
SHA512 2e6134b5e7aca9adb8f4cabcb3ffda3a2b2412d00f38d157924f2d5dd3de82c36a42da23a620691e19a53dd2e02f2149e8afd98ea3b789e13e4b53b62e23f674
SSDEEP 49152:bPji0AjZe30jaNf1TWbdz6arSj8RoTCCW:jjo9U023WwJTy
TLSH
T1CD95D026F6748731D073C1B9C5D2A68AED72308657308ACB4285D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 fd896fb1d7f92cb75b46801e174d550cb1c4a6de671774da46b67b088a2fcc34
MD5 cc6c66e4de79759cc8ee027934da9cef
SHA1 f909862dc3dc0e279890a71ce045675f9c30735a
SHA512 6593597f738e54b17d732689f461f12c11fe5bf98af0c2c166d86fb182ea8b180bad9fda11f50414fec8b8bf78a232ead5e22c83302bcb6b094f3f7eeb375afe
SSDEEP 49152:0/ezSC6vUzPveHjyde30jaNf1TWbdzyarSj8RoTCCW:gezSC6v2XeHeU023WcJTy
TLSH
T1D2B5AF25F5788323D0B3D0BAC5D6AA99FE723086573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.0MB
SHA256 aef463f5f12d5819b5254f9c7d70ddd1af2fca696dc33c3dd77ebd183decf655
MD5 8750ccb7722ff50e2b25493e382ee60b
SHA1 7939da3a68cb566192d3d23d6822257412e3f076
SHA512 e3bc2a69fb7c884aae9530be2393f2b39ee04a709e29e4189c89fc776e7f56bbfb9253489e6c227b3082470980fb06b2902e47a7ccf76b0b8ebc70eaed48b486
SSDEEP 49152:cVO88hXl+ke30jaNf1TWbdzmarSj8RoTCCW:7/h1+kU023WQJTy
TLSH
T153A5D066F6748331D073C0BAC4D39A9AEE7234415B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 c3cc00a81d1a4b07718882879f7e75ead78444c73e79099f4e79bad8f5747af3
MD5 64cdfc9bb7e5d2c4063f10e8033e9db6
SHA1 a42b3e20ee7ef649e04db10b97b5de3f26acea3f
SHA512 85084c44d047ad1e95d2ce68b60ffe3d31c28cc6baee7e3e4138af18e51fd64ccc1b972e15a4b61ab07544fb5930e1f99d718a7a6f11ff3ea38919faafe80d49
SSDEEP 12288:qLv60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qL7gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D0C423929F5409C6E38BC2F4A0F7CBD1E5E11EC171444E6B47E0FE9319BC8A9EAD4069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 7ddffd5368a4d157906f96050b5015311fd3680530ca48006510e079d43b1586
MD5 c40893e48fc6301c065e89bc7e1d4dba
SHA1 3fe73009e90ac4805090db3e3378f19e8856f887
SHA512 6eb82aa401c93f012606c561affe61c6be14f196ae152a7205cc7a4beaa16592aa14996da2be8ee8655c5275bc886bd8c57ba14ba2b7bba88c7fb22835aef1ac
SSDEEP 12288:ZeBNUbTVO86UC60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZJIUkgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1FD05CF3BEE28FCD2C27E8DB85691C740E7B278704B5293CBD164820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b9a297a30c50216a0e5c9e28b1a40840699ac132f7b2129556d12004e5570137
MD5 900062c57ccd52088691391d4eff2889
SHA1 72bd48415c698a8c8ea972ae23742544af9703fa
SHA512 6c954d804253547aab9237f40aab6cdd20524affb4e5a3982040f0149cffb785ef5c60c1a236046e5d732163a3ef54518cd7e8a3448d931586662318f4395620
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:KQvGAdlCEL8c/DRNw5CMU023W
TLSH
T1B9267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 28d0d38b504bf5408f6af090da75c408228e1a19502598fc1aee073f11ebb897
MD5 65afddb8e30cb37c04f761ecdaa13f8e
SHA1 213e948c2b612e7468d5a5e4929b698f6f1581df
SHA512 40ddd956271c974a2ec9d3fb5e9295e448ae7a23e39a9451d4d05be0ecae6437c22f9bc6c2549d331bedf077e41e6b6c024d52b3780aba2d7fd09c8cc8c5fbd6
SSDEEP 24576:d0ewsAjmgXe4i7ojhsP5Lgrk1TWb4AN5:Gljpe30jaNf1TWbdz
TLSH
T1CF15E031FE74E032C3BB0DB21B76C712586C7A604B511AC3E3E89E9E59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ddc4d7de3110a4894df4f929d7f4ba5019645a7df62c7de45095bdb2c82169c6
MD5 a859765f16be97b93a04199b252c982f
SHA1 dc47742a02d73a39023c966e0347bdd996a01a19
SHA512 d02c33ea679821023434fe759737607152a174a90325f1b74142c16942ea55917103498f1d561713994dc88e9aefebceef3504294d92333a16f65abba2dd8a3f
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHRp4W:RUEtQevvqc2W1cpV2tI32T4W
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 3.4MB
SHA256 c26e31311ba773ff76ca100d6a988f83f20593cc104d10f69bf1b06338c323a8
MD5 fded4626013f8b4843692c50398052f1
SHA1 7bcda2cd7e6bbce55ac6a03c0dd17d8fbef50525
SHA512 a6628794e1a238b00057059956aedfa740b9fb2537a28f4059dc95ce4fa519a465c1751062040da7a69a37ad4c7dc61a37ffdb9584db0f3506e29cb80df62d9f
SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zJe30jaNf1TWbdzJarSj8RoTCCW:koqCVjnmAU023W7JTy
TLSH
T108F5BF1976B8C2E4D1F6C37886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4c48561f4989736f502b2141a6e7668f7e94825d3ac14ce3ddf62131a8e0da05
MD5 7f5222cec8f8be2f23d606cdbd55a93d
SHA1 c079faba5613e3b3fa300ff12b1d6cc8126a6576
SHA512 57c42b4a10d3e9b88bac19e598497dc5594e7dbc9dca723cc566270dea383a8b158ff5f3903ecd8783a82441c3b0d393b0e43ad1f26f0437c7fdfcaf450589dd
SSDEEP 24576:lAhGL3IFoiwtA5l7S531gXe4i7ojhsP5Lgrk1TWb4AN5:lAMUFoiq5Qe30jaNf1TWbdz
TLSH
T1C635AE81EBF945D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f58f7c4f481dbd56cbdc0c3b03fe393cf4cc2058e524a878ddfa29140eb27d5e
MD5 95096779fef03275d90d21a30d8bf765
SHA1 089b84920ede022cbea225c01613620517b1451e
SHA512 f37561710db18ad19cd172e752ab75b881a9d4fbd25463966aee2f57175e992b4b0d947914acb865f168c55bcbdf39016dd75d78f1660c5a5317a33d32a1d55c
SSDEEP 12288:cmw5HEjsChNVBFgl0WDm+Ct0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:Zwu4OWdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F205F14677A40CE9E5A78278C597C632F7F2BC412A21CB1F07A0C6575F77261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 8f4ee3dcc6b0e3578c9e7d54ac505827f488b46ca3269db36af9264310be6fbe
MD5 c13e47716aaae42045d3efbd607bd737
SHA1 4d9dc1dd96c767e28bc712444535912377d70fe7
SHA512 ab580ebf8d914fd3729c85e2130db3a7a111e9cc1a7fcf0b83f41a0fff09a62f7e6f77eb6227bba3de3b54110340625bee8dc28d53afbed6bf50ea657238e2b2
SSDEEP 12288:jeZ1Iyg60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:yZungXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DDE4129637D420FAE2978278D4F68B41E7B23C92233147CF02A096A61F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9a387bcaa75c5e84229fa1edd6e0be82c82eafb7792036377221fd5365880929
MD5 ff6fc46b4c84ac982601baa3dacb3013
SHA1 d3cbb3441d6d54280b0d865fa1e88e75094036af
SHA512 254d79b93403f20234d74165b2d953d52aab0a856cd053613499682c9fa7c04c9955f2e20748b0fec6c11ee382357c527584fdce077e62658bba6804b9f3a2ab
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UR:iQRQyi36YOcPbLvw2gAf+PN3/U023W
TLSH
T10D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4e7365522a065b7bf14a6b37072380ef63717251d17fd618c089751dc1e93615
MD5 4d024de0fc30bce6f70d1ed47caa7863
SHA1 7cc949cec6c44fd64f5651c3190cafb6bb8fba74
SHA512 7af0b9c26c0091b6fd4a54f8781c6072bfa435f0e93a25f00221e4e0d45f6b423258ab1afc89dc4ef035aa2315fa9369fb8a21e800a8acc1687757360e830ca4
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UR:sQRQyi36YOcPbLvw2gAf+PN3/U023W
TLSH
T1D8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9567f73b092bdb2c4e7323e6db9ca1268a0e8c7d64b50da3f033a650da5d23f8
MD5 1ee8734796b5f3f4c5d64c8638aa8fb9
SHA1 626075fe50cf6b4f511eb5c862f1076b24baf1d7
SHA512 004726b5c42ad3dcc989780edcbb0aa227f8a8076dfb42182bfc3d9bfce669ea4c7a3d4034d173a483c3e9a919d11667272c649631634b26467e5465df234084
SSDEEP 49152:y68Qg55nhceWu7PNU3/Ze30jaNf1TWbdz:wthLRc/ZU023W
TLSH
T18AB54933B2F20099C04DE1769F4A873196E27C758FE0E7DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6c601676d4f0a1fd08c1f2cd4c70239d3ffb939523bf656925883a9102cdf81f
MD5 a2fb502ed15d06eb3d93561dc73f60e6
SHA1 cf7363507fa3a715b3c8dfc8ccaae61a13534cb8
SHA512 b6329221d3785a6f6be6bd96317b975a798beb0de6c604072c1a5badbf22b6998038bbf9216a2a0f8ee3d00591778038cb4402af5d74c466818ddfa5565f4adc
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99j:Gy5112gYy5azzVvt69nLKnhZiU023W
TLSH
T1F0168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 4c102260d7ca4713435715010d84435fd8537927b4c7ba0e43b88ebf7c00500f
MD5 9d718c973b7d6cbffa1564f8bd14d8e4
SHA1 7c08caccda81a5fbe85456a5c6d78a612f970c39
SHA512 00fa0d190ad1fea3785b9e233bb1ecea14d3f3744fd47307ce75624a429a24fb93893a98d0a17d505b8aecde646366c20e255cd8fcfcfbb9340ad686c47f65ff
SSDEEP 49152:VB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glGe30jaNf1TWbdz:bu6Jmdxd2dGU023W
TLSH
T106D59D13F1DA01E8D05ED178974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 afd12b7699633c5205c36462e9d64e53728b44979f5bd71dc6d8464b80a14038
MD5 35c90a839f8b148a542fbcbee602b657
SHA1 b27b698c31a4306fdd678d6c7b1bcc1e9deebcfa
SHA512 12f8c05b545bec9ad69373b4adb845b72705f99f7b2cc35377fc976f20f859ed6f5342234ed20bc7d20bf35cb0e15033b1a9ff320d99164f145ffde8cebef4a0
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xre30jaNf1TWbdz:ImifPWRAU023W
TLSH
T10DB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ad302841f88e0d3c10559e5eaed03426f8a7cf6c5d6e4bee704623749d1c04ed
MD5 2bc1c87af9508f4bd0fd52efcc21ba90
SHA1 3340017dac1dd9522386024c8a17ae163a44f16d
SHA512 7b4c9e393128472c39d7d6783c2efdb9297bb43636d9918e878a1e60726b8d1ac1026623c8cb2b9d0b6bbca29bd2efef42aad94bc2fb0590c1d3e1e9a06f07ea
SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqOe30jaNf1TWbdz:w5dKii61OU023W
TLSH
T122C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0af728731b7434da2d97636c824f06d83f22dcdc0e9f7fd7d65e20c3fe5dc467
MD5 819b668b2862b010ef72de2c196a69ac
SHA1 3f60ab1130dab33a3c12311ad7c9769d5a5eba60
SHA512 9d8d391af95c808134e82ef6685a417a18fd25de7147a7c89f196328fb66010386174a701d6f011bca9b179db543952092ce21355ce0ecf5ab2f63e0e3d7ac3b
SSDEEP 49152:nhtSn8EApI0fig3giDn0AP5wHe30jaNf1TWbdz:2X2imph0U023W
TLSH
T1A395BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 461b41985d7e30adad2f2f02374178439173b0b3791798bc5c82adab872c3910
MD5 4b4362720cdcbf5d4dfecf5e9a7a763f
SHA1 93f6759becfc5d963a508fcea3d9b54f1e2fc4a5
SHA512 3f9a1586e0af8b3899cf3e7d6f0c6e8425a36372df37f6bc693bc02318697e852162983d52592026e80d0284d62dc52978b702967fa0f406238177583abb6292
SSDEEP 12288:NX60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15FC423959E5509C6E34BC3F0D0F7CBD1E9E12EC272414E6B17E0B9531EFCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1ba3b3c059785196ab10ab1f74085fee962bfd94eba9a5b6dbe6fea398308410
MD5 52391c5018243e59031e939d2e73e879
SHA1 24c2956fa994d250b7c9948e13038c8017484dbb
SHA512 1d8cc46ae8ae77ca2084b8c9d1f06eb7ba9d621d631b7e07c7e0902d29d2337b83d1dc1af01512c3ff6eaaa38e8dce76cfd3070783cb4e4b8e697122c1f04155
SSDEEP 12288:x860DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:xSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T150C423A5AE5509C6E34BC3F0D0E7CBD1E9A11FC272414E6B17E0F95319FCCA96E88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5066ad74e246f3477a9a5f6fc138021fe00d8a1cdb6a60378a434df5120ad24e
MD5 b4cd35ca6361e5385cc7c970fd2786c6
SHA1 61bdbfe142e04be9c31d0cea31e83cf2e2c2b281
SHA512 b94c08f94a20ce21e587fe984c3505c30bae86e0684b734b69a641cf5aac4e5bdc3ac6fd009d8bbde032949b218832a582394090bc60b9cddf58c8490a10f101
SSDEEP 12288:1K60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1sgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1ADC423919E5509C6E34BC3F0D0E7C7D1E9E11EC272414E6B57E0F9531DFCCA96A884A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d4f7d2c5e1c885b30cbefad7210ce1ef38ba06611da3cfa0c4a1f9b98c5a2244
MD5 2fc067ba1c6e25c601c759329a3a6b89
SHA1 5ec35b91658dcd33ee9f135589acea0dc1c36ef8
SHA512 eba16acd38221701d949ea78b5cb0b08041dba92319118e1a563df9c0cda3f300f2275024ce9f3ae93ccdc2ccb0631d7445ca2f94989a5b52682ce11a545e2e9
SSDEEP 12288:rV960DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12CD423926F5505C6E24BC3B4D0F38791E6F13DC173114BAF47D069530EB4AE8AEA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 df640e30e7d3874cb51ea2273f1b5a724c5e7f9df742f69f539940e5b32c43ec
MD5 d7614ff244b0e3fceb8d2367ee8ee1ac
SHA1 63d7dc1d4c3131fee07968e15b7cdb407b838f99
SHA512 e128d292542c8f0c3dcf829de7cede716bd1fa0a3424ca82182877671bab1a541649d94a25e3bacf071ad2bdaad4e5a3f39e83d81b228716c1dccfb88927fb5a
SSDEEP 12288:DV60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DNgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A0C42391AE5509C6E34BC3F0D0E7CBD1E9E11EC272414E6B17E0F9531DFCCA96A984A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 56d0b97006b1681f59ebb353fd5b1befe7928454e564a7550c4bca67fdf67e21
MD5 9e7c881e72c03cd2e87819da89a1f6f7
SHA1 eec6623e9024d2c463b1f933e4f2d2cffd3deaf8
SHA512 8d1af3b3ea17fb9f260bfeb9c943c51382394e9e505f8438d8fb4035ea0e44a3a639f63569402a4edc4e755927dd588514fe09b466fcc4f8a33c59e883d4dd88
SSDEEP 12288:CY60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CugXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1DFC42391AE5509C6E34BC3F0D0F7CBD1E9A12FC672414E6B17E0F95319FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 59d8b88bf4d0915ed8925bd56a4311526ee4a027923bc856c6fa3fda95246ebd
MD5 7a74c7d1aa54a4a6b469be1ea7d66ff9
SHA1 07ace907f6d277e94f3f1661726c2fd47adcb4b3
SHA512 8ea0bf2842306b8cda1fb9118f4e51092ecf89f26ed770bc33cf62a90556f9866c19af2d87421ed91562c18e12533e9e799bffd1a4142ea0e2c39732e0e10725
SSDEEP 12288:mU60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mKgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T16FC423A19E5509C6E34BC3F0D0E7CBD0E5E12FC672414E6B57E0F95329FCCA96A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 0037df8714a1708a097e9b48d741a4153efaccc0c8a1ceea86587c8023cadf14
MD5 f90c6d6c6f3f7e4578fab92b04ce291e
SHA1 2239de745c862432683e7c6331be24c0396d0903
SHA512 9644f608e1b350aec9089c39ae8c8f43aaf66069f5bb974a594808806f17221ecb065774584e4c04511990284ff566ca681060857051357bb28d47d2ded2c23d
SSDEEP 24576:7ZMRzFVSOygXe4i7ojhsP5Lgrk1TWb4AN5:7ZMRzfxe30jaNf1TWbdz
TLSH
T113050195B3500CF8ED67827EC8A68A02D6B27C561760CA1F03F436671F737A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1e3980d02290f10a7ffd3fbc0266142a4ef896682a3dcf70a41a8a198805895c
MD5 f35ac78e94b1ebe36a090ad675a96fef
SHA1 3d8533535deb4368ca4dcd3378e911b058eaaff3
SHA512 eebacc52a285691e0eeb831203269413f4fc0ee47779b2707d5ff92ce9c1639961efd9cefffa66d76b02430f091af6b77a0a27a37390348404aa8968f360a87f
SSDEEP 12288:4760DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:4XgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1CCC42391AE5509C6E34BC3F4D0E7CBD1E9E11EC272414E6B17E0F95319FCCA96E88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OneDriveUpdaterService-2026-10-12.1726.4856.1.aodl

Path C:\Program Files\Microsoft OneDrive\UpdaterService\logs\OneDriveUpdaterService-2026-10-12.1726.4856.1.aodl
Size 10KB
SHA256 849c98f89e1646ff9e2b727ddd277c68efe73e9a2dccb2ad84a28be43092a57a
MD5 353aaf2a620531bcd00569b20ea9a9e6
SHA1 b212d885844dc0b83c3a543998c30549b9fd9a24
SHA512 27b8234265222200f60ad07f94e2b97b6a58934a4bb0dbee2229284bc8f83506c2f7ce93f061146210b1d47bd0cd686a17fd5a3176416b7a1785ce907a06427a
SSDEEP 192:OjOHiMlGBx5ouH9AN2O4Nph7P/SPv3GIn:gHxE
TLSH
T13C32C5DADC83C1A0DF4210396675CF9F6EF0C4AEE0E6BC2562E56C86145F62927BE701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-10-12_172652_4856-4368.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-10-12_172652_4856-4368.log
Size 1KB
SHA256 12f9348de28f673c85c5d429dbf9c40f2d411459ec87d8825b9aa8fe0b9a2fa7
MD5 a49d11448a70cb4b8965537790b510f6
SHA1 e208fb75dff998e1bd6c04061bd30c52fc3b47c5
SHA512 879ea9efc28f23849481fd09c75d951d626a8898a95c0ec74964020151ada43fa55ab2e802ad9fcd72873af3e880ab434f444e8d6b30fcbc440126787eb60fa7
TLSH
T1B021A21E7BD84A05FEFADAC299FA10539E3579923831CA0C00E1524E8831F41FDB472B
MD5 SHA1 SHA512 TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 962113f0ad0fcd5e1bbabbec3bfdd322872025a469e9d09d4d975a6649844f88
MD5 fcea68531bc2d8d98c3fb99549708419
SHA1 325af1dccd32520392d2c57deb5f80b2fac25817
SHA512 74e8b8d8b59967526be0d3930cdac0c13387955aff7167dbd1d9883bb31dc0121ea4b8b0e67718311ad7d1abbe4c6a6dd350e0d26af246b6d8a1ac3d4265a621
SSDEEP 49152:CP4m4IpOO6708KMe30jaNf1TWbdzFarSj8RoTCCW:KppOO1iU023WjJTy
TLSH
T15CB5DF2DABDC0095D0BB927485A58A49FAB1742A2F3286CF1160933D3F77EE54E35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 3123279c786a26ec2d7efd865f21eb1be894ca0fb637c5ecc5f8da5dd645ebf2
MD5 0ae1b703b248c841f5c8674c1d581230
SHA1 1cac2e36349e622c68674c73b1b2b595c1a66f66
SHA512 6b41c180dcfdc5094557a8d9ff7c288800c53c7234b358ccda1fe283b84682b0a755bafc18db8267721557d0dfb713513b2532a5bf3f9b35a395be3478db7168
SSDEEP 12288:AbsfL60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nngXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T137E4F15AD29802D8D16E92B5C3968A41F3733C6193E1C7CB13D0F93E1F79A909EE9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 2fc994d737f10041035aa86a4960851d30816e2a386ca9c33f8a441b13c8d892
MD5 8b89a83665d2097165988d55ad09e77b
SHA1 54169383bfc4c21dac371b15e729e41711085cf1
SHA512 60a9a5b6ba98958f4c288f58b4d4ec0743314e81b7f3a8992a1d52d044e47a0ff9edda7c734507d66dabb839c07794cb366a266f610f6037829033f50d39b3a8
SSDEEP 12288:tr60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:tHgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E4D42362DB5809C7F29BC3B090F7C760E5663FC17B008D9B52D0BA9319B8CE5AEA4519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 33ce9e261ea0b41d3d254ebdd1d0aa0f41d389254c6e227f4653ccb941b0b90f
MD5 9f037367a31f48006a1cb748aaa51bd1
SHA1 a1a529b6c3d128e7d44e84acf169b8915fa86f32
SHA512 e58147ac779dad15b78eb0e5ecdc44303d82faeefbbd1dfbcb18b3446cf8ec3457612cf13448fb46b36833214b73c014fc58811a7da030459751e2cae6a522a9
SSDEEP 49152:la0h2GEkuAe73q3pp46zwwQIe30jaNf1TWbdz:la0hNYG4JwRU023W
TLSH
T13185AE1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 aeec6a58f47356269daac36d4f76fc0ce7ddeabf3f701a8b8e118cee87b0e2c5
MD5 061d116ef318588e94fa01520eaeb45a
SHA1 d04913be4e709c3ce11b2c91264068769405790f
SHA512 6e17c71e2dfbe4042598f060b4642674d361fceb03d29c3f7f45096b9e91ace09a05244be24d54ba5e1e4b2466722b009f2ee82b5998e055057c1ac5196da0b4
SSDEEP 12288:CP60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CbgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T193C423959A5509C6E34BC3F490E7CB91E5A12FC133014EEB16E0F9931AFCCEA6EB4458
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 cd1e23ad73445e8e68708cf5562a03a2133d046330eeff8039e1364029036ff8
MD5 e0d91fbe951a1cb0579b0edf38b5b2de
SHA1 7c9d00c60e303ae8583f5cddfe15897ef3287a09
SHA512 96109032db88d7a8fb4765fdd622968aae795dd0f9ac6d7280e91bc74d63de47a45b3d62919a46b1fbbedc0e2458cbc19e78fcecd4b643698f9deb5204ff45a0
SSDEEP 12288:WObfA4LWOsvAYFTO60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnU:/bL3UTAgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1BC25F155F79400F9E96BC17CC4A28A12E2B2789D1364D7DF03A88B661F637E64E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 011294905170ac267f83b41bff33a05384be18e6ba8a7116690e25c021d867ad
MD5 46fdd0a3d452bbbdfc55909dc3d045bc
SHA1 eba8b1d2adcce01e456e58a8dcc9979f33710bdb
SHA512 dd225eb5fce3cab7f47cb4077c356f60e7198af95c0861428b69f6f0ed3ad1c3d1913a7bf997cf6f240cc2349df39e4fbedfbc35ee7d1fa27eef3f80aa161a80
SSDEEP 12288:ApFtIOi60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:7OEgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A1E4026A37EC10D5E16AD27C85D38349D3B178A2171247EF02D081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 5da4bff9212f97a752a8b26422c3b04c9995f46573c53d13aad28e5c268fa0c4
MD5 e33d69e23dd647ad0540851e48f1b723
SHA1 9411777c65f057f5625d4da7eb10e8297be982e8
SHA512 bf29832b0d3e8747635c6f3f199ce0f3f8cd3eee5e7e85bbf6cfbd5416f19327d5e69e612238f28a9b152a78f94b3b6b69275e5410258b3538b1cc06a11a6912
SSDEEP 24576:i7NM9YqZqmWMUkPjZM48Mv6bEhsXgXe4i7ojhsP5Lgrk1TWb4AN5:i7cBWMpPjN8DbEhVe30jaNf1TWbdz
TLSH
T1A0659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1162833E6F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 aa2b53dd2ff5a3e24e920d594cdfe10d5226df5e537202f541c638075c45d041
MD5 f47d1b048d347f54bf51ffe2f151fdde
SHA1 95d18b70b139c1f9148e8d0f5fe4126cddb29349
SHA512 0ec73fa517a2f880f010d27dee9ed066271ca85ec17205ee51f854536ce5d47330523b0a7ca1da7a274eb0f5dbef8f57fe2623f92d01b5fdfe6845eeb9a538ba
SSDEEP 49152:wF2YuHNETovAvNYf8km+e30jaNf1TWbdz:F6BCf8krU023W
TLSH
T111857E6927ED80A4E0BBD27D45F6D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.5MB
SHA256 68eba9c5f94e8f40b008d130205cfeb6e3a8035b286887d64eb0ce81cb2ec409
MD5 2214eb04e6cddd0f8535adf0f1b5e49d
SHA1 8f13dc36126ecf6881acfdcd19ca9d4739b1e8ed
SHA512 192239a4773bb5bdcd39c958f1b0456ee64d9c4647cdb67ae3eba929cf4cf2e499c98a62522239ee5a15a4bbfbb862970460e7afe98a9fa37fc44f4915f909d8
SSDEEP 49152:wF2YuHNETovevNYf8km+e30jaNf1TWbdzGarSj8RoTCCW:F6jCf8krU023WUJTy
TLSH
T143C5BF2A67EC80A4E0BBD2BD45F6D286F9B2B8551B3056CF0255862E1F33AF44D3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 c748cbbcae6de2138d33829c0f46efbeb1868090efbb0746b79d9743137d8e17
MD5 08575fc228b3952601a7295cc59a7522
SHA1 d53786d7edf5c7bec91450ce45c431a4d94e038f
SHA512 f2d0b0ee5be0b24de57e221fc9d11d0d03b458c183159e393861d7e0892fb2059ad66bc458b23825614e991347dbe16817745c1405de1a3166785420145b6592
SSDEEP 24576:aAFs06+OmlfkNXEbToogXe4i7ojhsP5Lgrk1TWb4AN5:jFs060lwXuoe30jaNf1TWbdz
TLSH
T15965BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 5a61022d0fd9ec00f54177627c2999629a7b833a647416add6e5e7127e8f7250
MD5 3b2197da238a7b0bee6c8c05c4e0ff81
SHA1 7c13af638fb06f7f60af5d354cec76ca25d075ef
SHA512 2e138a8a02326c9bf6855e1a4dfacf37d5d804a1a574ddac72ff9425a23d2a4f7f8688a1f3372f4fb1874e1ba77ec2d5ddfce9cd1f3c313604d5544d198e5155
SSDEEP 24576:xJnJ5D3WXtgXe4i7ojhsP5Lgrk1TWb4AN5:xJnJ5DGXoe30jaNf1TWbdz
TLSH
T11315D02DD2A810E8D0B7C3B4819A5B95FE72386D2F226EC714B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 692f76d3e74ed80601686416ceb13a8f22cd7f2150b5d8c1069de783bbe7acdd
MD5 43ac1f12f9614fad94fd1da9f6d5237b
SHA1 de913d6c47cd5f421e15114b9d044d75a37bb5a5
SHA512 b720c1c71892336a79439edcd27e33352b1d765d9d83e828dab2093831893788cfa5f2c932c0cd7cc6029ab477230c856dce76abaf7a83da95bc68129ff4c4d8
SSDEEP 49152:Dg06DIKdwc+eQnSt65aV6e30jaNf1TWbdz:cEU023W
TLSH
T164955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 f99fdd07e45d63ee12fff90e1401cfb50f8d7ca2bd9022880637101e767251e2
MD5 e493d3bd7f2873f399403f2aab5449f6
SHA1 ec2662a11838fb1f1fc32117cf1fec5a05594136
SHA512 73f2bbfa3c5f310891d3f17e883f53f4604676ec1ea55d3d23983e9d816884e3d3c3e8b30ef9f4508072ea9252e23f06b97d16b277e114138c9ffe3fa1d11002
SSDEEP 24576:hiHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:hiHarSj8RoTCCW
TLSH
T16B05126EABCC61E4D12AA23C59A18549E7B3F178570317DF46E0827D0E77BE52E3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 704ca53f2cdaa103f623305b73b91f9c4e73c9500ca5c855bc8a3ee91d345cb1
MD5 4f5c8e0532037ad5c33d4dd55cd2cacc
SHA1 7c161c7f33495accde8339a04158548d29d5d3a4
SHA512 a8e582177afe1d0b87ac4b3c6e720fc65545a51bb5defc8b3f2cb1f486ea178169ccbdec265fc894461bf69672df8c9cad2e732a106bca4713660c96872a982b
SSDEEP 24576:EpHaKngL2jdshRTdG1YxITqvfPkbIcbjL0gXe4i7ojhsP5Lgrk1TWb4AN5:EpHarSj8RoTCCLe30jaNf1TWbdz
TLSH
T1126523AEAB8C51D4D11B927C51E2CA44E7B3B5A4670307DF46E0D27E4E7BAE52E3C900
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0cf5fd37bf1646288d59b8d0a754aafe3fd6d296f0c5ec068089e32690f907d9
MD5 87376459112adbdeaa264219851c5714
SHA1 3255b8b03406aa309e80de80f857347aef7e1b12
SHA512 d4ccc90928625a4e2212b8e0913bb84b79bd0b5f606d952acd79e7321de476e9425ad49c4197834237def76947255599574e339cabf72f1a5a5d3754539e556d
SSDEEP 12288:UjkyU0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:UIy1gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D8F41244679854C5E2AB82B8D1F38390DA717C602B104BEF51D0FA3F6F7AAE4AD34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 5e11aa483a427df20ce3ee2bad89a5cabfbc600440b92a5f153f46ccfd767c2a
MD5 fa2c1d2ab44c4479264e919d53e56fc2
SHA1 1cd479d4e0099ea6791896504820578e35ab9ef4
SHA512 51df959ef6be818a08cc61c9449906cb4819c3bddf763e9687ce0150d4776084e8f922b42b0bc15a61fd5ede709ee490e1e28ad04da9ca9a34acaf165c799ba9
SSDEEP 12288:fyS60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:q0gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13CD423695A5519CAE24BC3F490F78B91E5B13ED137000EFF12E0F9734EB88D66AB4858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bf2cb80803911dd5e6275b39c0cc2da426b5b1f9320488bab3de0fc8110cfb2e
MD5 7450d0e85f4409fc06c869725a09e620
SHA1 e0c5df51dee608638bb8597348e9f068681d872f
SHA512 16ad2c2ccd1331483e983e8ece52f5d1fe11936673f8739f587901b4bd8f3e67e703055031f8ac24b4dedbd27cdddd721fec4b2eda5b52a4d4df8693b8ef07da
SSDEEP 24576:aQ9MxZKdcz9dw3/gXe4i7ojhsP5Lgrk1TWb4AN5:aVKZWe30jaNf1TWbdz
TLSH
T195557C2DABE9098AE177D275D5A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 799092deeb50c14d23ba7f6f3aad3a773f6b27e95257ecaa2de6fa05bff8365e
MD5 6a56010e44f68b765cf0287353eb902a
SHA1 91e1a10bc5aab23e051bc604e174b9f0af92704d
SHA512 56e7466c1db7bf7a750b6fd3ab167bc536fba4f119ea24be241dbaceec4cdb9db24e6c6978d09d8a0d9902c52094ac0bd907fa3850983d74cb8486009e4d1fda
SSDEEP 24576:nyocDApmgXe4i7ojhsP5Lgrk1TWb4AN5:yocDAppe30jaNf1TWbdz
TLSH
T18FF4E01FBB6900E2E166823C88868741E7B3B4702B5257DB52D1C33E4E779E9BD38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 254cef47a75b659262556cc2207bc23e2744624814d4b91992387708f5eccbb7
MD5 e646607b137b143b274765b4a45a870d
SHA1 6cb1b878af35a997e3f8367a4d341178548f71de
SHA512 b246f0c989843a81ee76fbd17ad1ef011ff94eb73eb2ff27ede0d036a5373f3ab72bbcef843121b81f51e5eaced8b84980671cdde60fd88c33403b86527956e9
SSDEEP 49152:WWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKpe30jaNf1TWbdz:g0zuNIHU023W
TLSH
T155A57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.5MB
SHA256 9f6c15bad73acaefb23f4fb07c0b80046806af3f5a2a6424b2bc4e9c9cfeccc3
MD5 22f394935cf7fdbf24b84d7ac461728a
SHA1 7fb1c318b4791fa0e3382fd578fe0900742b8f0a
SHA512 96682c78b7ba922ca7977a9710980ee6154e2896dc2e9e65887f6b6675684eeab5ddc446f0440a16e401ad4928fa0f93bc54d2b4533f4545ff9fd29b58868c5e
SSDEEP 49152:la0h2GEkuAe73q3ppj6zwwQIe30jaNf1TWbdzYarSj8RoTCCW:la0hNYGjJwRU023WKJTy
TLSH
T135C5C01E67DC82B5D0BAD278C9A6854AE6F2B4260B3156CF1190853D3F37EE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 8aa3c0a941b2b454e1032587d37034309d117c5781720f4c0b4178eadf601709
MD5 e586923805fa786d2149633384a31207
SHA1 c57be8edf6f74041a4edb64b0e144a5bf815151b
SHA512 cf2bc9c466b90f998c2db2536b0c5402dec60efefe4816e61b765341629b3b5810ac5a1ac2ede555cd8da02d0d9d87f4f20a53a81fd149aa839d591086342a97
SSDEEP 24576:d1QT7EcpfxR+N5AWAz3ooiYhjMqbmdaKngL2jdshRTdG1YxITqvfPkbIcbjLm:oTDxR+N5YzTTjMfdarSj8RoTCCW
TLSH
T1E275C12EA7F815E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 1d7ed9d2f36930d969bbec1cf418d7f80f95fecc93ac38bb8c03e8ed641f5ea8
MD5 9af9c6324eee68dcd6adf56d552d55ff
SHA1 a6ef42fe60832635fe33e72263efdc55c5db5e18
SHA512 5bf42a2b57040672329dbb8cbb96d0a591657b5bf4ceb622c088731ea187011d615384c0fd0b3d3b392dfb09928b941cc7b2ff3ca5b48ad1d5e42e99c7721675
SSDEEP 49152:MTDxR+N5YzTajMfdarSj8RoTCCLe30jaNf1TWbdz:Au5+dJTXU023W
TLSH
T118A5E12EA7E805E9D17EC6789A23C506FA727851133193CF42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 a1915a1b586701c1027369708e4fc5d1a0f2380adb2f85287e7743d9cd86947f
MD5 974880c4587b30649d860b8122f91671
SHA1 46d3fcbb6ab285af86a59958502397873682326b
SHA512 2d1e1d0494c156b24ee2fcb63fa5be71d5353cd6400111a741b6e7631be9843c90ccc927ce3504d631fad7a6a0fc619d668a3019af96dea9547bb8f4b5977f77
SSDEEP 24576:QhbHjPSaKngL2jdshRTdG1YxITqvfPkbIcbjLm:QhbHjqarSj8RoTCCW
TLSH
T12205127E57DC12D4E176A37C6AA6894AEA727929170683DF46D0827D0F3BBE01D38F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 ac5d0d91d2fa3a335e0dcd13bff621df18829df483c9c155bf971f2f990ae274
MD5 9037d312fa0044c033fb21534bf8b0a6
SHA1 e2ca5933e44998f36dd20547214a5d7ca2d3d0ee
SHA512 e7db48cff8c8042280710df56c6dd26ef41beed2e6d5cf30df47c22e5ed2effcde759c11e07799d11d8a6d8f7979bcc9704affbe5f48ffb90b73dbef7dd4142c
SSDEEP 49152:P0K+bmSLAe30jaNf1TWbdzyarSj8RoTCCW:4wU023WkJTy
TLSH
T19775027EA79D04E4E17BD27C9693C906F9B23865031256DB06D0C1B92FABEE4393DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99d79cfea26b1277.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\99d79cfea26b1277.bin
Size 12KB
SHA256 6ac0dda418b1ce39b77f73bf1ed3df461718672085c8fa0752cc537b7e0d1cd8
MD5 aa82e7d4e6ff88c517e2d3d0dae7da6a
SHA1 a0887a195415121854db13fbe2483d8acfe52ee3
SHA512 7fff7af365f50fdb82f1ee9389d59e376ed59acd5e7cc5377dd504f6d83488b550fab095966273d5a51763082719fc5ac4a69758e190acf752ec66b81302df92
SSDEEP 192:SR2QGY307qbDrX2OYFS4xtXhiEfgR6ACLO7VZ92SyQGmaSDcuMyZvIHaRe9A7ag9:SRp/bDVYxiEf/ALV/+6WaRe9A7a9n+
TLSH
T1EF42B023EB40ED0875BC3C6750FEE882C35857A97BD6B451247B9A532AAFD177124490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.2MB
SHA256 9b550809592e74e749a2c162437ae120537cfb80c484db8aab5d8e9a6ca423a7
MD5 0d2254846d80f943185906313b03c351
SHA1 44c1dfe993e63440e5914d7017e6a137056ee81c
SHA512 8543785278cb91e785ddd20661aa0b17a2179a0a7b53fd331c23f10b95da6c8bd03cad4b42a9edca5d5a653eea2c4d77573b7dfc517ce04ab4a87780d7d86565
SSDEEP 24576:S3YgnJcRTk4yti+R5dBR/MgXe4i7ojhsP5Lgrk1TWb4AN5:SIgnaTk46pBR/De30jaNf1TWbdz
TLSH
T13345BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 635KB
SHA256 fe82dc9e87a2679b0351f48c7145947a64d9ba1de6c21773a837012d906cce1d
MD5 796c3024f56172a737d38f1541c1db9e
SHA1 0ad2d3fc01c3e153a4db6e208b50b26dbdf7a3c7
SHA512 b6e623b18103050252779760a3fa201a76c2134769642a1d9e04a4cdb2ba1acb23ed249dcb7ff1854a8ffb3a50c04e6e938f78a7bc37ef2d82cf00e297dc48c0
SSDEEP 12288:f4Km0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:T/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10DD4125D67E824C5F167C2B4D1F68351D6707CA223100AFF26E0EA770F7A9D89A78B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/984-65-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/984-59-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/984-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/984-73-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/984-71-0x0000000001A70000-0x0000000001AD0000-memory.dmp

Download

memory/1060-137-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1060-384-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1060-193-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1092-417-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-397-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-423-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-436-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-435-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-432-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-433-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-434-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-430-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-424-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-425-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-426-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-427-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-431-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-428-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-429-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-416-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-422-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-415-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-414-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-418-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-419-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-420-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-421-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-413-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-400-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-398-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-399-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-412-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-411-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-410-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-409-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-408-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-406-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-407-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-405-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-404-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-403-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-402-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1092-401-0x00000244E8CB0000-0x00000244E8CC0000-memory.dmp

Download

memory/1224-34-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1224-43-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/1224-42-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1224-136-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1308-203-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1308-394-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1308-388-0x000000000CEF0000-0x000000000CEF8000-memory.dmp

Download

memory/1308-194-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1308-235-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1308-219-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1356-172-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1356-174-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1632-55-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1632-47-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1632-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1632-152-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1752-185-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1752-123-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1752-129-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/1752-124-0x0000000000710000-0x0000000000777000-memory.dmp

Download

memory/1756-355-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1756-165-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/1756-163-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1756-157-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1880-177-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1880-390-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1932-188-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1932-133-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2028-111-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2028-120-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2028-180-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2028-117-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2052-141-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2052-310-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/2356-483-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2356-517-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2444-171-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2444-75-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/2652-380-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2652-168-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2936-392-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/2936-186-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3316-391-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3316-181-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/3968-189-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3968-393-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3988-97-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3988-86-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/3988-176-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3988-92-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/4632-353-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4632-150-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4632-153-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4632-144-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/4788-519-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4788-467-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/4856-67-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4856-0-0x0000000002140000-0x00000000021C3000-memory.dmp

Download

memory/4856-319-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4856-98-0x0000000002CB0000-0x0000000002D10000-memory.dmp

Download

memory/4856-21-0x0000000002CB0000-0x0000000002D10000-memory.dmp

Download

memory/4856-13-0x0000000002CB0000-0x0000000002D10000-memory.dmp

Download

memory/4856-8-0x0000000140000000-0x0000000140E46000-memory.dmp

Download

memory/4856-6-0x0000000002140000-0x00000000021C3000-memory.dmp

Download

memory/4856-96-0x0000000002140000-0x00000000021C3000-memory.dmp

Download