3d877c89d4dad263441b6197d1815ca95ac58818038eada113f3f41348c1dd6d

Analysis

max time kernel
134s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.9MB
Sample260722-3rd9sadf69
SHA256 3d877c89d4dad263441b6197d1815ca95ac58818038eada113f3f41348c1dd6d
MD5 767595c107b874873a917856fb7644a3
SHA1 fd16619d192dfa4438c98d95faa5f77620029aa3
SHA512 fe7f7bab68cf99ed77577c10ede9b6ed511e7d0ae37c7f21fa5d92d7889396003c99895027237415ac38a3de5d55c2dcb2d0be39b4dcebba8e0b26c1b602e26f
SSDEEP 49152:Ci0BSWtOZvUrg8qptYgpADvbf2OQDSIGAauJc0GaTZbwfITQTq4WS1SZBnHTAsi:0tO8qRFTauXycNzAz
TLSH
T150167C06E6B940E4D0BBD13D8A969657FAB1385AC73197CB46A0875B1F237F09E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4072	alg.exe
5664	elevation_service.exe
5688	elevation_service.exe
260	maintenanceservice.exe
5956	OSE.EXE
1836	GameInputSvc.exe
4684	GameInputSvc.exe
3164	msdtc.exe
5424	PerceptionSimulationService.exe
3772	perfhost.exe
1136	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ef824532e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc-journal	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\FileSyncHelper\logs\standaloneUpdaterTelemetryCache.otc	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	GameInputSvc.exe
4684	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2624	2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4072	alg.exe
Token: SeDebugPrivilege	4072	alg.exe
Token: SeTakeOwnershipPrivilege	5664	elevation_service.exe
Token: SeTcbPrivilege	1836	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4684	1836	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_767595c107b874873a917856fb7644a3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4072

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5688

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5956

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3164

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3772

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:2344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3572

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3056

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4196

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:5856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6012

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5100

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2800

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:4020
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7e0becbebf7d6c76c3a474c146de9d5f884995f8ac2c0bf48f983af66c24b4e
MD5 221851c1e9fa914cbc65733eefc34f3c
SHA1 b692ae50a2ac1ecc8ba7073057d125bc9130e0ea
SHA512 44ef83858e4ebc5026315eafadcf5d6240cf1f59e39c8e10e645c8c3a7d8ec197c4b3987cf05341470cc7e0453457377ac85073a8d5a51ce9554c71b351c13ed
SSDEEP 49152:0b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnT9WS1SZBnHTAsi:u3q6gjBC9cNzAz
TLSH
T1B7D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 2ecc2da8aace79dfbc9f32392afc369b9a2689615745b7092a9cd536044596d3
MD5 41fd079c7832b9b10629421f8157f021
SHA1 b799aaad4cdd173c2789a8d52cf17709d7e9ab69
SHA512 ea5131a3b8c18a3b9a1540ea86d83bdd660218c79368e7977d8821a9954ebc918d5bd03eaf00f443096ea94f99614cc6fd90091352268e80106902548e20c643
SSDEEP 24576:TXYwJtczAtp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:dtcgWS1SZBnHTAsi
TLSH
T1AC05F128A7E009F9EC574239D9A18405FB73B8518764E78F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 afc1c76111cff2d06941ee630b7543620918e526d4065cc6bead128ed857cd77
MD5 e5a63906f59114bf9a57ee9512d30f0a
SHA1 7d231eff29310db5332ee3b46fb8901235f3c209
SHA512 338358d4a9b4e2f4940cf5174af09fa5c43476d4f874b8f393ab4aee5ffceb2165e1b21769d318a088ae8ed9a644964652694a807d931824fce89ccc96db4203
SSDEEP 24576:40meG5Y0HzxOrMsp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:4X5Y0TolWS1SZBnHTAsi
TLSH
T166459E15F6748735D073C0B9C5D2A68EEA7230825B308ACB4286D77C7E677E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59a80be86d89da538fb36908103a209393dff6f1ba9bf9f0bdf9d39ecab49ff8
MD5 f4a4c95bf3adc8ea27f1abdcf918be69
SHA1 23e1b2fab12df1a124f5c16e04dcdfe0b6f38748
SHA512 c6e3b16aa158d5b8b2816197b1011ebb3612cfd78c1f259f628a84f0c14170f20637c6a87ff9bd5c5436d38018dbd88b8f2f66739a31ec90be7118c6ba9d7690
SSDEEP 24576:bWe/ezSC6vUyD/aqgrvW/6q8wyurlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:z/ezSC6vUzPvuHjy2WS1SZBnHTAsi
TLSH
T197755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 01242ed46a93728fb141134a0e2e8d782cff110cc43ef90c0caf4a1306cb07da
MD5 d5f24a985a639104bacf506889a7477e
SHA1 b148b32c090ee82bfb6e3e2747ab32fe5bf33c2b
SHA512 52659ddd574f8620e0e96f727277f2eac8113df5bd8a06a474af36d9a7a483bd9f5c9f0c91f7ebc9421cb92139b6928c1c8335280888eb47a1fc7d78260a642d
SSDEEP 24576:aabsP5FB8v/l+dkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:aaiFB8Xl+GWS1SZBnHTAsi
TLSH
T136559E66F5748331D073C0BAC5D2AA9AEE7230425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 101d71cf5f23f885d8e4a338cddfaa7104032c7d11cd88e0605a14c5781eff83
MD5 19f901139ad46b498b678a529072ded9
SHA1 81a6dbff84b32ebab529826b00fa5c0453b1af44
SHA512 6ebc33b44c07a53a47592b80c11faeadf1215e39d0a402b5914d8c5527754ceb82b1871190fcb2b4bba191f5a2dfe38e5a7d996221ef99c8a816d258bbf96a02
SSDEEP 12288:+pDp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+pDp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T123D42349CF648E64F6C40A31357C4C0DBBF79761CC6E0B0D06A8BB4E66762DDDE62542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 9dbe2f0eb9a00c6fad93cff550813781feb379ae786ada3ead247fbb2b71a158
MD5 6c0d4ca626c36b1f4cc7247b917288ab
SHA1 2f8d5eaeb184ecb29e8ed2231083ebc4ce07b6cc
SHA512 d973bdc5b18f3894506fa14e79af232df63386f00f47b68f94248c106d195811cd34737723f3a01866839e6bbaf606226348d8271c48de10f9f7cf22a8ae335f
SSDEEP 24576:8JIUWYp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:8JIU5WS1SZBnHTAsi
TLSH
T15115CF3BEE28ECE2C27A4D795A518600E7B274704F6293CBD174830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 4d7bf026db7f809fad7c096c7b7e8c76e88c7e66d68c1d1862a15307f30707a7
MD5 9b37c0969618344953dd00c664387049
SHA1 89a2ca64463b0d43b5a86cce91d790795d4b3467
SHA512 0d2c6a8d277e3250c63312476cf6804f9480fc27dc54ef49c3668cd7f3d1de6bf34b654cb2e90fedf7904e78641bb9c7d5431232ecb2af8634b6be799ceb007e
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ59DN5JGNRV3THp:5QvGAdlCEL8c/5RNq5CccNzAz
TLSH
T10A367D656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 c25305aa9c6f3e979b7662f952b4c8d5fa884d552b50a1b2c186afdfad5ff7dd
MD5 d9fdeba8e33a15ac49c1896f01ffd526
SHA1 f3d3bf6c892037b78965168b520898bf028241e8
SHA512 dd3b58c66f2cca47a6ecc4a585334f24265efac7a38f6cfb27474730e652ff155c4eee966743ae81a845b24f94422ae5e74fe900f08fcdcb8bdbbb2374579f1f
SSDEEP 24576:tmewsAjwp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:IljwWS1SZBnHTAsi
TLSH
T18E15E031EE74D436C6BB0D722B35C70A647D7A204F611AC7E3E89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 18.6MB
SHA256 956f49b9086febec47fa5e5c4ceabbd7d4a5b909479a60793946d9955d715aee
MD5 75bf029941238b0eb73293a8e820b4b6
SHA1 65f67125f4172c266e2d930e5c10a67e779dcb7a
SHA512 312782e07b0465145fd517dd4adaf3f43f5bec1d2fdff459567a37750312d2983eded5e473b84d7eedfc2725adb7823aacd72ab9b0b025c0eeed6e2aeb7e321d
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyXLldPlI:bUEtQevvqc2W1cpV2XL3K
TLSH
T148175B567BF842E5E0B7EA3889B68272FBB2B8411E31A71F0155C61F1F376618D29331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 29197c0eb1701ef3c695ce6dafc7bc995c114603f1094e6629139af1fa9a10e1
MD5 69542e52c511dcc3c1f37c9197c15eaf
SHA1 eb6bd9474137ce76f36453187c068a2af168ac79
SHA512 4ab36fc9d8b3eb78eb29072044ac7793d4b840ba5f653cfbab00e384db6fb942851d7c24d878cd3ca16e6f6952acf33c58848bed50f018c98590d29f971b12e4
SSDEEP 49152:UxbRquA/m2yL5zMfFiV+XenmE3/zAWS1SZBnHTAsi:woq1VjnmbcNzAz
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0981934a8b3d4b2734306687f39aa06e4fdaa15ff4172c47125876c4b5bd8ab0
MD5 5b50f39a3755646ca741e2fa3d820f27
SHA1 728c4a4d48995d4cb3743b640239e81bc8b2b654
SHA512 fea5d8830ee85435411b8739ff7a40084c4d83b0ea0674761a6bf0bfcfce7dfa4cb2671e43fb6329ca0a42ed6af22fb44a7503e58663a4bb66333af66bbf3984
SSDEEP 24576:bAhGLvoFoiwtA5l7S53Ap8SXdo8ke5i5Xh6wnBLTHTAcZQ/:bAM0Foiq5wWS1SZBnHTAsi
TLSH
T18445AE81EBF945D4F5F3AA78A9B58471EA76BCA65E31C20F2160D10F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 7a61d16bdcfd8cf7eea34fb6dfc2b7969d5af58efc8eee3a6e722d568ccd4213
MD5 0c9df96b9de0a773c75e79ec9ca8c181
SHA1 9e3a6f40152eabc4d64bcb0976c09e574b7ac3ba
SHA512 0b9315c114d923438d0661e5805d30c477c25261c0e7e1f888a760f6bb4c78107ecd32ca453f55c66e4ce1ffd4c9901c2c99c847f47264ba6e07a749ea12dac4
SSDEEP 24576:UwusOWmp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOlWS1SZBnHTAs
TLSH
T1A205F14967A40CF9E9A642398557C436F7F3B8122A25CB1F0760C75F6F33365AE29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 9a67428b1376ba2bb5d99ed06bf09ad3398baa4da3d3ebc1101932c01596daa9
MD5 cf313ca337e41fa5292bd3b951996df5
SHA1 03dea776047fe01558e86cb646aee9232c9b6242
SHA512 9b0f2e2073816f075b48a7051cd063cf37c02a2f368d1312d52e544b615e12960dc7515bd3eb45f4d8d6fbc615c138bfa7df2d630d4375b1f2349b6dbd961b10
SSDEEP 12288:bZu1IoHp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tuuIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1C7E4124957E445F9E1C60239A9F44809FBB370629B3A43CF0664475E2F33ADE5E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3dc38119ea7c287f30047e26151f4660838f39a986d4334bb0f371da4494b46d
MD5 407b7038e70b4c869cf37ca865e71ed7
SHA1 9be050ea8516190b85ee269560b0019e0e587898
SHA512 93a6ae4f88cca13fe57c110a07e741f427bba247648a7c0a951bd1eda4766f047883801d10f3d590e9bba74d5f5a5309fe913f1eb245c6ffb62e0586435f601e
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uu:aQRQyi36YOcP8Lvw2gAf+PN3GcNzAz
TLSH
T1D0667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 970ef3f40936310b24bb1d253b4a9dce347cbeb5c9db2ee1297a6efad375135c
MD5 8ec594d1f6314f8f993863f9eca66373
SHA1 8696f5b77d7afc08f8d2f7a0c0ad19d82ae25ad7
SHA512 05c745cb005e647df6d1a90842e9c14cd67a7719c0e46ce96e9b2c752683f64e4e91faf7eba15f97c1ac8b7268fb9dc05028bd5e3c7681390890ecc763201d90
SSDEEP 49152:Lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ua:aQRQyi36YOcP8Lvw2gAf+PN3ycNzAz
TLSH
T1B7667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 360addeef339ec5e249f86fba07d441437c1cfe17a2aed7eaf564fc6d712d523
MD5 1dfd29921ba99ad5e01236466f08fbd2
SHA1 0ee08195b708ccadc8f2b7c87c8b2a87f95b91c3
SHA512 7353c3071a79d11f6bd647c6eaaffec39f2b56891322001596ed0e1322a236dd477773b87215442852ccdf9d66f49dfcac7c9f820f87f2c6bed3e57deae8a4ee
SSDEEP 24576:4wvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0bp8SXdo8ke5i5XC:e68Qg55nhMeWu7PNU3/eWS1SZBnHTAsi
TLSH
T1E7B55A33B2F200A9C44DD1769F4A872196D27C71CFE1E3DB8515720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f8b38a65bbe1d6290759047d1eff5350cdbf6a77189d5d30aeff095a577ba86a
MD5 646a67afd447694f9fa3b8500a994007
SHA1 17e3d9adfb88399f7ae051b1ce22d304de448d1d
SHA512 9af2e104900cb25000114aa4aae5bc38cc8974198db8ba550bb7d4ef59f06d2d678fade9dea9333282fd7b7ba8fabb1aa219f8900f1c18608552be86788ee2ed
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk990:ny5112gYy5azzVv569nLKnhZxcNzAz
TLSH
T139168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f9c934169094167048d7b346928dac572018a421f535f6cc34a3b6e8c9a3c7c0
MD5 63192efaa61303df51e72b4a0718cdbf
SHA1 0e423f83310efcd65a2c0911f809804d6728442d
SHA512 f68b6bd391c322bb39ceeb7e7c23bae67a85b4b933dfc41271cffe7b8376dd38fad9cea89ec4d71bd94195d907d575f0ba69ac2e1ebb63b36208611b7da540f1
SSDEEP 49152:1B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glyWS1SZBnHTAsi:7u6JmTxd2dycNzAz
TLSH
T104D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2bc4a886ee65a457b5d6ae36e9e5fbaba7722919f1c3b0d1cc3d8ae8773a7baa
MD5 cb675c38a49e06df1db9ecfa50828a86
SHA1 7c1e45cc28208b1e7bce97a1af5f3e88408e5d50
SHA512 2c41828c59f2309abb040436ae770e00ce73816a3428acd9327876953dc57c5183559b15c47814e4d07a183b1472e3ef2e0848d41a5023511d89cc3b5c20d9c8
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4xfWS1SZBnHTAsi:+mifPbR6cNzAz
TLSH
T1EAB5BE13F29901E8D05DC178875A9632EA62BC460B34B6DF0A90B7962F7BBE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ebf510841b5525c6bb298042037ad3ca6ab2401aff1b17f4280ce523c287b94e
MD5 fd92a0cb22a234159d173626fb520789
SHA1 5d49c0c3dcf4412dc60bea65b840edc0b5d4aa9b
SHA512 fe3c6af133d998db639f80b354f298072505df572fd258e6bb8d0adc6a511953d09646cb5161300d0d1a4e1ec7f15ee2229e37cb43f88ea360035884aedecb4a
SSDEEP 49152:FSuZQIY0Be2K6RVtOnks6NMHq8WS1SZBnHTAsi:L5dKoi618cNzAz
TLSH
T124C5BE03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8d5119a36f8bfe6801d4eda737563c51bbe9fe59619b3855468c8975545ca5d1
MD5 33a245a8c4d07414cbc50e36ea77f458
SHA1 f1456b83ce5ce0eaceaaede005708f4a0a607d4e
SHA512 b57564c5b59c0c9320dc38a7dd9244b530d6fe23ca8abea74d2b673fe8d47700bbe35ebcb860fd7ee14d7e3b5e99e0c2707d26efbd22529ca961f0c5deb80049
SSDEEP 49152:8PtSn8EApI0figTgiDn0AP5wrWS1SZBnHTAsi:fX2iyphacNzAz
TLSH
T12CA5BE13F2D900E8D05DD174C7568632EA62BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 00550d2313f026a233dd2731d7548aae6bab31a74c53571d814dcee12c4220b9
MD5 2c34faed049909fa7fbe77356d8bc459
SHA1 a2084e15f5970a4f3eb5752855301b49da204214
SHA512 5ff51c0375014eed5ded5a1f82f729c9b9d1930f45e7b7eb7b601dd9c88fcd00d990c02284ff45c58e5325a9f169002e39c9fafb9cb0da709b69c2e1ec4af611
SSDEEP 12288:IVp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:IVp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T162D4234DCEA58E64F5840A3176784C0DFBFB6362CC6F070D179CAA0E67632DD5EA2981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 23b07c2beddac1b0bc1a4f86405b774a46a5b0f5bd7939c70023b9fe41d7c036
MD5 ceda130fa35a9224e8cfd9ccacf22250
SHA1 49793a1c21cbd9808bc4b68d7b412bef5fa15edd
SHA512 9e1eb9d6c906f7bac2c08e3dc6d924e6201d8a10b519ed584b9cc1812f4cb548dc596eb8f641f4871869cfcce8c51543f5d2cc4b71a3ae3535801fea29d7acf0
SSDEEP 12288:W0p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:W0p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T194D4230CCEA58E64F5840A317638484DFBFB5363CC6E070D179CAA0E6B632ED5F66991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 5bc36318bb6fe0fa9e0fb97aa11fb319ef55918fdf544bd14ffeb8c85b155898
MD5 b08682191ff1f75f7b2413e8129a6004
SHA1 066476786731a4fec406b44ec7066ed7416616da
SHA512 d7c72d728d122da262031a273f8bbcab08a7dbd6fc764bae3b54b99c49b5079281229bcec8cc4883886dcaeb3fce4f59a0d5fdf0705008a7bf89df298e15d0a9
SSDEEP 12288:gwp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:gwp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1E5D4230CCE658E64F5840A317638484DFBFB5363CC6E070D1B9CAA0E6B632DD5FA6981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 a3db1c7dc39919e1e1188fa872bb362024888f664625fbf1fe3efdadef7d198c
MD5 f182f068d39f17db679f7b7d0f8683d2
SHA1 139a0ca24a12e6c5282a368b48663c895a4800bd
SHA512 62451b61e84bbee8d4d77e33b1ef981da7a1fcbe776b9ed7bedbcf33f499123bb0af774e1e1177dd703df84b1f1ee987d48937e79078b1d47976c13a0c57020a
SSDEEP 12288:clRp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Qp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D2D42309CFA54EE4E8844631A978480DFBF7B3A2C93A170F4B545A4E2F7339C5E61E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 94e12c5550516e70f45f4c8d2cf9ed6ccee971702516a5f258422104aa67779d
MD5 641b8212e4dc455fe0727278ba89302f
SHA1 78543150888e9d3cfea8fc4cf78200f9244591c8
SHA512 17c63ea6ecc9ae62695ea41d00a08c7695ef55ac9551f5a9d0193338bf6f8f58f75b138405de421cf3b6e03f2576266cc744d4e44c9cfe85ed030af315173178
SSDEEP 12288:P5p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:P5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1BCD4230CCE658E64F58406317A38484DFBFB6363CC6E070D179CAA0E6B632DD5FA6981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 c71f56643ab2cce8303a2874c624a4d1498cf1a999cd5ca993ca4c2e8c47c5ad
MD5 87dffe39de639e9a368f54238b345852
SHA1 18e09dbfa3e8587cd8a56eb1ccea095a741d04b0
SHA512 c24609fb153535a2aeb94988b6b6ec1274f98bdda517ea52eb7a7ede80e6f2728c5cd0f44b24f6bf82b19a007c28e6954a46f524e74dc3095d868d87db0343a4
SSDEEP 12288:sMp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:sMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D6D4230CCE658E64F58406317A38484DFBFB6363CC6E070D179CAA0E6B632ED5F96991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 e1fac7d284ded16cdca8941a0a78136727cd084e2fe7e967353337d1ca32a0bc
MD5 5075c5a92843fd524812e303755bddc7
SHA1 25d080fc4dceadd06118288271c1aa1d33ce4f83
SHA512 dea94d51c36fc9319f174e29c496f12235e1a77045a50190d9c290307d4a37cfef94c04b72045147fe05b803b92de501a993ad3410c06e279952e44652d7e2f1
SSDEEP 12288:Rup8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Rup8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1BED4230DCE618E64F584063176384C4DFBFB6362CC6E070E179CAA4E77632AD5F62992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 668d9d560588d4125602cc2d8ee81961f1bf86bb352bf1feac17ed2d9ef4b5b2
MD5 fbdc230094c3ddfbdc20d55a7fafbfef
SHA1 aa865bfd256be034daf1de818b1bad9a4596d38e
SHA512 36c17226da32451ab3469304e3c43cb4ea331d67b7caac2f8d11a2d6a1c0355df10da408aa69482d577f67864ffd0082cc15603978423f20c789ecc955531a7e
SSDEEP 24576:HZMwzCVSm5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HZMwzMxWS1SZBnHTAsi
TLSH
T17215F199B7900CF4EC97423EC925880AE6B27C564A74C71F03A8365B5F333A51D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 2557de11f8c858d34cb4c8cb9474b14b16e1858c38d3cbab288ce4aea9353fe3
MD5 14e301f5daeba1816800f8715211adba
SHA1 618b0c2ba2d6ca218cc7a3ef11fed5767d4ac8d1
SHA512 caba5742abe157d5fa1ef85b36b108a6f36db336c93785df6c032caf5a5f0ea98139546c25cae5c6e7a3a8c3b7c6d2077dca7a2d46fb4bb4668c5df848b17bbb
SSDEEP 12288:QUp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:QUp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1BCD4230DCE658E64F484063176384C4DFBFBA362DC6F070E179CAA0E6B6329D5F62991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 266ffa76f4ec9a6860016a39668e0a61c7445ee301c95c0dd2ce73a900e50f98
MD5 bb626ba6261ec0f2ac897719fbd7cc0d
SHA1 917f680856ed9802ecf16924b4bc62b008c10e96
SHA512 e8884f0937166441bb1a148ab6a271f09a072e62cf67ae91e758599cc3482526928e513068a4a9b9466ac9bed0cf9cfab40a6c1eff48638b8ff203cd2cb9cba7
SSDEEP 12288:mEp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:mEp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T101D4230DCE618E64E584063176384C4DFBFB9362CC6F070E179CAA4E3B6329D5F96991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 5a5b7d5e0f65e97ff07f49aed0edc52b8313878cf5c50cabdeae15ff3ada4942
MD5 d57e82d4111d004514b985c30d9eb6e0
SHA1 2829628812bfa924f52c6d4c66e6e8db8335c394
SHA512 2be5e1a3a0d802e6448bacbc3e47f39cbf191c987970f4e714cc68a2be999164b07d1b8bc51ec08a3e7a7d948ae02c2afaeeaa6920a2a5725c745a6ec38a1db1
SSDEEP 12288:J6PF5L8Np8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:AFyNp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1FAF4120BA7A115F8E1564234D9650D0AF7B6B4324B358B1F17A4477F2F233E89E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 b46fedce61b34167138560043a25b9d382a385ba6828cebee043a13193906b4d
MD5 051a19829534ae3a8b4f95d612107525
SHA1 5ec634044fd3ad34ce852c12d34b82365590faf4
SHA512 396d28e0054934d0fb7d7d979ce63bf6925b7805cb6478328e6ff4bf8e3a38de1a15409a4f03f72d1bb8a62486f0304d84b6070da4fd22397857e581d8552cce
SSDEEP 12288:7hWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:7t39+T5zF0S5qsgCxfbmS
TLSH
T10FD42361C3028265F62216FBB8536DEAFCBE8457B6D07747D345070838A04AAE325EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 dbd562726305f24816dd3d379eb92128de0f5fa8feb34a11a815299e2ad8a0d0
MD5 30f821ad6a95261619b712e1b1c57c7a
SHA1 e0d0b96fc3f90e2cabee6b3d4d042ca49bea459f
SHA512 7f2283a9fe19b8d9e93b01262a0f2068efb874be35252030fd6e884eb1cdf0a60b5f1caec0aad965ddad288880a0f6e8b9d40f5e56cc49b7adbb5f518fa20ebe
SSDEEP 12288:bgWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:bq39+T5zF0S5qsgCxfbmS
TLSH
T12CD42361C3038265F62216FBB8936DEAFCBE845776D07747D745060838A04AAE325EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 33fcea381de16394c6b34145e50186bb6ccbd3b16dc01bf8e2ed8758a3f3bf4e
MD5 ab9ed170232150f11d44183cf3b6ce8f
SHA1 3e5162bce71b1e2adbd6c5dbafddf65600ad6ad6
SHA512 7e78730efbd482ee58eb66a1ebfa523f7ba6e9771a1430fe945069d68f1672dd503bc2c8338a7453c80b8fa73464456cb7f416bede8b428264111facdb3a6bae
SSDEEP 12288:G7PF5L8wWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:CFy639+T5zF0S5qsgCxfbmS
TLSH
T181F41257636120F9E1335279C8921E96FBB6B83267609B5F436007363E631A1DE3AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 386ee95474ee429060cb55603ab88f2c8da6ab6ec813b1592fb05bbbcf64a406
MD5 ce87f90f0d90293ef5f0b4defb35469a
SHA1 6a03518caed40dd172c49a99282a172a3ac330a4
SHA512 83b6da1f34571237e0a3c855e180f3d989c2727cabadc6919d54053e651e366c5ec0332f54586d2703c7b8f5e7f71ce3de2bb46661455f52ccf8929d0411256a
SSDEEP 12288:fCd9L6XoaLMM3z0zd4PDvhjWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfx:KTjaLX3z0zgn39+T5zF0S5qsgCxfbmS
TLSH
T1F91502A4B35048F8ED63417ECC528956E6B27C5A17B0C71F03A4372A2F732615D2DFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 65828946e8dca9ee0bbcce8845665a236957486aee22207aa67ac9265882de0b
MD5 0fd77cf6d5fafe6673d3f98dc108d0ba
SHA1 f7b3472bcc37b427ce53214e327d4c4329bcddf3
SHA512 85b869eb9cd584348cfddf20f7c24aa745095b7e5f5d3daa3a4f090c1d0f5638ee7b817dff8df6b02e3005ed0c7bf06b876f0d060e0939020c070acf8b9175cf
SSDEEP 24576:53WdMCHKy7dlM039+T5zF0S5qsgCxfbmS:JWdMCHKyZC0k1yS5qsxiS
TLSH
T1A635CF90F3E410E4F1B39A758D725512DAB67C5A1B71DA8F03A4261A2F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 1ceb593288e7697865e3f438e783531dc25ba0bf24bc7b67f8d8294a0d7a569b
MD5 99a53d446d996aae5f27aeaacab663b6
SHA1 2fef4587839a3ad02aca8c7dda62ee8b2a1460d3
SHA512 5c75ca7eb538a044c1da60776f2c472407dd881c8a9c3c4780fd47b0aef2f9a3c2de22e15af31760ee22384b7820f93e740b6bd2bbd9338827703d268ae84b55
SSDEEP 12288:leWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:lY39+T5zF0S5qsgCxfbmS
TLSH
T147D42361C3028265F62216FBB8936DEAFCBE845776D07747D745060838A04BAE325EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 fa349fd7229c3f83b4eca9de2b3cf24fca67d2790a4e257f94b429f4b38859e2
MD5 9b15512ba0286c57712667531835bde4
SHA1 d4c6dca2902e2a3a5b4d9d48d3de49802af2e960
SHA512 d9a37046f425d65b01a6f251cd639b13b9f0b7592ac7946f5695a30a015090868b88dd56c66eb6d0ec30ba5e139bc08f8fff9cea65567a93d96370260487d2e9
SSDEEP 12288:JlWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:Jx39+T5zF0S5qsgCxfbmS
TLSH
T111D42361C3128265F62216FBB8935DEAFCBE8453B6D13747D355060438A04BAE325EFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 18d32ec9d1353cb1e2dd9334354dba5cdc1fa640f40eb164dc7f685e5388114b
MD5 2c6e252bf1fcbfd9194590de7002966d
SHA1 2ae59f04f954a18b1ad67b0626282ba47d9ecb8e
SHA512 111417ea2a867f0882262fe776c8edf5a8e4538323b589571806787c384037bae5b5298d261d95364c4b7e3cca1f169a99e4960f30e17a6a0b9f6a3787bbe6a8
SSDEEP 12288:u7WZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:u/39+T5zF0S5qsgCxfbmS
TLSH
T178D42361C3038265F62216FBB8526DEAFCBE8457B6D13747D345060838A04BAE325EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 297e7d683cbdc547bfe26c755df0a66c207e84f83c101bdaa76ea35b7b09cfbd
MD5 35f9d51f6de0bded27ab4577e25f34a7
SHA1 febf6c1ab35b8a09c799d1251117a9796efb05a3
SHA512 999480fe79eceb3df992404dbf75cb36ffc3b9ec71e6e742dcd31e798053fa21c2aa09f5eb26d87a25692c51298fc4f5bb46b3e6d78cfbc58e41e202ccaa6f0e
SSDEEP 12288:RAWZonDTO639IXFPVQS2RhadO6FWDzBA5qsQXrOaCfvSRRssZS:RK39+T5zF0S5qsgCxfbmS
TLSH
T1D4D42361C3028265F62216FBB8936DEAFCBE845776D17747D345060838A04BAE325EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 d1f637fb0838e662627f8cd0870d4c9154b6c01f8ffff4fac44676e4d49ab072
MD5 75874967d497350fb88838f6502abf3c
SHA1 e18e27b453862ab95bea0e6cf75147e4010f0089
SHA512 696218fb6aaf14ad4f48ff2a7cf02c904ea94d49bf33fc3269257b29dcdb58b0527c9ac59313d1cb13bd7e66e72d1ecc1b6da78b714825f7e72c531412e58d38
SSDEEP 12288:Fxsf60p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:2zp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T14CF40109C2A446E8D09E1235DB644905F7777D2187E2938F17D0FA3E1F762989EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 1d584ce55d7d81c3ad73646c3336bf51dd52b39f0f02460a1b1ae25b889d7042
MD5 57afc3f2a3e697dd081240cf9ebf9988
SHA1 c1e4d943432cbac626ddf2642de6ed6ff9d4e220
SHA512 183a07da22c61d4b90b5adc49118f3b9898f7ac3b70a3a8beca5fe09acd0a8d05c3714299d1ffc59e319a2aa8ec540f19790f2ebd44021c1603dd32d0d388995
SSDEEP 12288:j97Fp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:xFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T190D42319CFA58E24F8880630353C480CBBBFB372CF29474F5658664E7A726DD9E75A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7242d4b4bf096b711b63ba4220f47d9844ee5dc6dc87b6007ce7305429ea78d1
MD5 b0f1de2961dffd8f3a1a83ea1d6fc042
SHA1 f680bb62355c3afc9d65ae46630e45078233a12b
SHA512 2c9726d4d792a1cc78abe38d077e18aa0ad91e81726ec1d0b49649c3645627bad094341875438180872a9fb3551beffbea15dcc99d74615d9f0849ea5dd8229a
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bY2p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Ggb4mBIBhGFRWS1SZBnHTAsi
TLSH
T1DB65AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 db7a86afb9c7c99555335dac1cc1990dc18c953aa788c5cd0483b4063f7cfe45
MD5 e3b2604dca5cac53df32733f5f25f502
SHA1 848d14f8b61c27ab0913bf617b77f7e809d19a14
SHA512 ee182405132def57d17c4a0275067dad50d25ada1a186c352c21cb5e785990df10a5eb4c4e69cb5fd4ec95bb4adb54bdf81b22dae5b221f5ff3a007b816e15cb
SSDEEP 12288:GlGLtp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:eGBp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T17FE4231C8AF149A4D46847356534480EBAF373708B2917EF0AE4E63E5F626EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 ea6984fed1363cf81c3e098673b1d7fca3f956cea9678ac426db0686d0597ea1
MD5 559dcec7f3aa70aa1fd880fdf7faa2e4
SHA1 60db2277a52ad10223c1084df1d0886396dc7131
SHA512 1672eee5a8520b31c7ba91c642f996fea611ff07ab29e45433cf898e3213e39dfd7fbacf50ecb4ee5468345b7c69097875bbdfdad620b9bf7ee196dc33c3e116
SSDEEP 12288:mztp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:mRp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T131D4234CCE658E64E5C40A3135384C0CBBFB9362CF6E07CF1698A64E26636ED5F76942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0c25fd0c9b4694328d8c919ad9ed038c7422321eab3968d4ffb8157ec825091b
MD5 1e240affc605f813c8b6d8c2fb6cfd6b
SHA1 9cce7f82dc714e7f750d050923004d53339aca66
SHA512 809bbf8d214c1ddc130f462c4bf0cc818c2ce13430d8b3011edf9c6717d1a95fcae8f1e53e17755684b6375c21f0b464d29cf1dc63de96ecc4365df18bf123fd
SSDEEP 24576:uej8H8FpJqH1Yzria7/map8SXdo8ke5i5Xh6wnBLTHTAcZQ/:xIcFPqVHa7/1WS1SZBnHTAsi
TLSH
T114350165A7E101F0D47BD1388A464667F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a19acac7d3f88d0436cc2e4517b535dc18de402c5afb42362d863652654948a5
MD5 6ebbf1581523f7c0b36c433aa86b50a3
SHA1 76460cd1ce308d791228b6f541b0b2ffb51ddc74
SHA512 b65cc4ce56392690a85d7b330748bf179d8f4ca24654fa74cb6899d1247e8e5ca735a5af1f28d46d46c2435093906a4138bacf7ef80110f19c6c3ad4cc592093
SSDEEP 24576:yPUr+NQTp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yJQTWS1SZBnHTAsi
TLSH
T17705F11F66A80CE4E676A13D8955860DF772B462471293CF02E0817E5F63EECBD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0f62a22158a71a1fd89e5ae7f4f15abe6c30ef8a65896761a4a5c22fe771c3be
MD5 bc79ce75b26a83be0f7f90a9a5b3bc6d
SHA1 c3021cfd51e3d9e73cb5b0de12e59909bf5b6ca8
SHA512 d782c792d36c23ebe7ae3254369d4c04090aff49c2e524aff8b4a2f68747075e9fe56edde45c964f6b0695e8e57f37063915283a9b18ab44bfaab36894218bbc
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbWS1SZBnHTAsi:HG05lO43b2cNzAz
TLSH
T1BBD5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2621e385bdd1fa75f3e5b57402d42699883c2cd889a99b781727de9985106412
MD5 b45cc35b70f3bd5bc13be15b62bbe13d
SHA1 c04867ef39b6844e7107f867e12d5be8bfb4af3f
SHA512 b4d32fb3d4e92de982bdfb99b0d83e174b2bfe626dfa33368a5ab240882c82b133372de6ffe3f43bb05d8d38f88cc0932ef4e8f78c42abc29e3d596faa5e8487
SSDEEP 24576:eDa5POZ3dpbWVM50JicR2hG0lasx2+47eidnmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:qa5POZ3wJt2pasx2+m8WS1SZBnHTAsi
TLSH
T18765AF5EA6F801D5D5B9D17DC583461AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 65b2cf1cd7607d843109fe0b97d7e49652a49f5035e29dff1c5ebf9dd82993a9
MD5 40cffb5fbd6eed57080d709a27130e22
SHA1 b9317c7066706c18c999f84b1fcb2a0342533151
SHA512 3f148b297678b9c0d5c0a803ccb349dfba39cd59fecb710689df59d571e9fc80268028e95967eb0ea9ed089e55d2d7ac1bc5ba87469b3d93b5e1d317af9ce3dc
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:1Nc/zEOVHF6WS1SZBnHTAsi
TLSH
T165858B1623E901E4E1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 e60012e75593cd083d49fdeb0c739426e249ab8042d3e31a699c22dd2e2634d2
MD5 cd2ed0f522f9a395e550e973a518cf8e
SHA1 4037f3168c5aa4f563e3d482d3965b25e805d4f9
SHA512 be61be5171ce16add6f377de9d5f9ef1b4aa88717f4b74e6e7ea4121fa2eaadc0960d4017f8c2f4413e4548fe3a508919b23230066a63f578a7f576df279565c
SSDEEP 24576:TJnJPbzB4SBp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:TJnJv6SBWS1SZBnHTAsi
TLSH
T15015E03DC2A810E8E4B7C27481191A5AFF71347D2F2669CB19B4D5353F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c57a1410a3686f3344924f2633f51a47988b40f74a1d391e431b11206a713c16
MD5 8dd64545f43ac99a520347d715a0b2a1
SHA1 7c412f963628d651f099204b52453591a54624cf
SHA512 70f89221c0cda23df4166950e351ddd0e970d2a55f48e6eaaa23c9df10ee3570ba02dc2a6fceece4636b4cca10c2f77011e586bc1d404bc5d93f3d222d144565
SSDEEP 24576:cCLHGL0MoeVtFumTijCmlKQWDktp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:cCLHGeeV5ijCmlDWDktWS1SZBnHTAsi
TLSH
T1B0A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 26005d8ec1653ecec4475c03af5691bb24aa52f7dbf2711f5cd5fcba177646bc
MD5 d0c3813a7dac9b594beb9d1449b1818d
SHA1 677f69969c53782447d64cafe2c0751b507dccb0
SHA512 b0e8c895c75a0beaca3213e3d7528607ddf4f20a11ed7d358c34ded106e6ba1f179280994b416f985cdd6221fb4e1dcf6560aa507eb24e206ecfd288207b03af
SSDEEP 12288:81Hck6j5ZI7Lp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:06DIXp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T169F4F15C637A01F5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 059369b0a2e229a2fe0d22bcc121e7ccc76b3e667693754237ea88e12ae28b29
MD5 1f421b9e913e7e3943019becd8d4f98a
SHA1 2209397f91d14a589a74df5342c0a98d5107c563
SHA512 6242730bf25e893b500f67b9c36f95158b8bb4de2135e2a909a9daba888fd8c556d995a09cf99b594b2078c54a245b17b3a8bd7c39793641f9d7136b94baad9a
SSDEEP 12288:JG6ky8p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:gty8p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T192F4120887A449A4F9A80634AA754448BF76B9208F2657CF16D0E72F2F337DCAD71F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 7c0aa6e5f737d102634c195fb3b0ef15be42199e936087f9e7d4cf917c7b2e15
MD5 364aa65bae4b90ab1c56079fa2c43c23
SHA1 c16ac30a77fd3c9ab411c49fa6bce9d11ae90afd
SHA512 6eeff361d4252d763817c0a0170e5a9cf6beb2ef7d56bebef429947c857b16d0bbb584a0753c8e0a299c06fa72b5839b5690a977aa79c16034ef3b667827e1d2
SSDEEP 12288:w3mp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Mmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T129D4235CCA654E64E8840A3135384C0DB7BB73718F2A07CF1AE8AA6E5B632DD5F71D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 90f99cae82c6b29f1019a3f7e7a97098a0208c16b33d7f2f1ec6856a8ae3ce3f
MD5 5e1e8b5b9b491d5142fc4283454121c5
SHA1 13751ded66fa2cea8fe60894935de28cbb2ee5ac
SHA512 1880fed68971e87616af2ae88c9c93cf34af0f8156631c781d65b9daa15be8b9e7873695528da0d9a3f70c22f1f724d4f5882d1e893f72d25ba7964593039c81
SSDEEP 24576:8jgILoTfaidZep8SXdo8ke5i5Xh6wnBLTHTAcZQ/:+gHTrZeWS1SZBnHTAsi
TLSH
T16A558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 4526bc38fd2097d2cd0114242b182be7460c61891089dd36164a83f039f1a8bb
MD5 4c9922a293c7b3d9961cb7122695c43c
SHA1 bebaf5d2be24aa2f0ad6d84b452e48e1782490e9
SHA512 642decd8c18561956898659b5c1dfb38d088167a195ea51814f63c2ea0d34364908b26d14d3f4b09e956811cbe0718aaa6204fdda5554e6bb8926b47afb04ce1
SSDEEP 24576:yrcmRRp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:UcmRRWS1SZBnHTAsi
TLSH
T11805F10EB7AE00A5E1B7823C8945450AF6B3B031572267CF02A0C77E5E67AED7E35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a347612ffdae0eba6b61876a683b027ce379124fc5eb09c65516c3ca94522d95
MD5 07dda90bbe0f356665609f3d485ad692
SHA1 cc3525e4a76c58a221ccc1c7a4fbac3fa4ee773e
SHA512 6f4aee4ae9512993121ac24b4cabdb1ffb2ad7de8075998a2e300fe2def9e701b4084e5584874b507b6557ff9e036e02a3e4c09491e93650c3bcd57db70e7dba
SSDEEP 49152:gDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3mWS1SZBnHTAsi:t3Upow8sBjcNzAz
TLSH
T187A57C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-55-0x00007FF66E8A0000-0x00007FF66EA08000-memory.dmp

Download

memory/260-46-0x00007FF66E8A0000-0x00007FF66EA08000-memory.dmp

Download

memory/260-48-0x00000202411D0000-0x0000020241236000-memory.dmp

Download

memory/260-47-0x00000202411D0000-0x0000020241236000-memory.dmp

Download

memory/260-53-0x00000202411D0000-0x0000020241236000-memory.dmp

Download

memory/1136-285-0x000001B7CF730000-0x000001B7CF796000-memory.dmp

Download

memory/1136-367-0x00007FF6704A0000-0x00007FF670BE3000-memory.dmp

Download

memory/1136-286-0x000001B7CF730000-0x000001B7CF796000-memory.dmp

Download

memory/1136-297-0x00007FF6704A0000-0x00007FF670BE3000-memory.dmp

Download

memory/1836-236-0x00000126F53D0000-0x00000126F5436000-memory.dmp

Download

memory/1836-329-0x00007FF7946B0000-0x00007FF794778000-memory.dmp

Download

memory/1836-237-0x00000126F53D0000-0x00000126F5436000-memory.dmp

Download

memory/1836-235-0x00007FF7946B0000-0x00007FF794778000-memory.dmp

Download

memory/2108-330-0x00000183E21D0000-0x00000183E2236000-memory.dmp

Download

memory/2108-331-0x00007FF7F58C0000-0x00007FF7F5A54000-memory.dmp

Download

memory/2108-412-0x00007FF7F58C0000-0x00007FF7F5A54000-memory.dmp

Download

memory/2108-332-0x00000183E21D0000-0x00000183E2236000-memory.dmp

Download

memory/2344-293-0x000001D47BCB0000-0x000001D47BD16000-memory.dmp

Download

memory/2344-298-0x00007FF71B7B0000-0x00007FF71B85D000-memory.dmp

Download

memory/2344-376-0x00007FF71B7B0000-0x00007FF71B85D000-memory.dmp

Download

memory/2344-292-0x000001D47BCB0000-0x000001D47BD16000-memory.dmp

Download

memory/2624-26-0x00007FF620060000-0x00007FF620B25000-memory.dmp

Download

memory/2624-23-0x0000026C1E440000-0x0000026C1E4A6000-memory.dmp

Download

memory/2624-1-0x0000026C1E440000-0x0000026C1E4A6000-memory.dmp

Download

memory/2624-2-0x00007FF620060000-0x00007FF620B25000-memory.dmp

Download

memory/2624-0-0x0000026C1E440000-0x0000026C1E4A6000-memory.dmp

Download

memory/2800-382-0x00007FF7268F0000-0x00007FF726A1E000-memory.dmp

Download

memory/2800-383-0x0000022539140000-0x00000225391A6000-memory.dmp

Download

memory/2800-381-0x0000022539140000-0x00000225391A6000-memory.dmp

Download

memory/3056-320-0x00007FF69A730000-0x00007FF69A9D3000-memory.dmp

Download

memory/3056-392-0x00007FF69A730000-0x00007FF69A9D3000-memory.dmp

Download

memory/3056-322-0x0000011768130000-0x0000011768196000-memory.dmp

Download

memory/3056-323-0x0000011768130000-0x0000011768196000-memory.dmp

Download

memory/3164-252-0x00007FF7F5610000-0x00007FF7F5729000-memory.dmp

Download

memory/3164-254-0x00000158C61D0000-0x00000158C6236000-memory.dmp

Download

memory/3164-253-0x00000158C61D0000-0x00000158C6236000-memory.dmp

Download

memory/3164-350-0x00007FF7F5610000-0x00007FF7F5729000-memory.dmp

Download

memory/3572-314-0x000001B7C9270000-0x000001B7C92D6000-memory.dmp

Download

memory/3572-312-0x00007FF77E6E0000-0x00007FF77E793000-memory.dmp

Download

memory/3572-313-0x000001B7C9270000-0x000001B7C92D6000-memory.dmp

Download

memory/3572-388-0x00007FF77E6E0000-0x00007FF77E793000-memory.dmp

Download

memory/3772-366-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3772-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3772-279-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/3772-275-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/4020-394-0x0000028E82220000-0x0000028E82286000-memory.dmp

Download

memory/4020-393-0x00007FF6A51A0000-0x00007FF6A54DE000-memory.dmp

Download

memory/4020-391-0x0000028E82220000-0x0000028E82286000-memory.dmp

Download

memory/4072-13-0x000001DE6C1C0000-0x000001DE6C226000-memory.dmp

Download

memory/4072-64-0x00007FF683FD0000-0x00007FF6840F2000-memory.dmp

Download

memory/4072-11-0x000001DE6C1C0000-0x000001DE6C226000-memory.dmp

Download

memory/4072-10-0x00007FF683FD0000-0x00007FF6840F2000-memory.dmp

Download

memory/4072-12-0x000001DE6C1C0000-0x000001DE6C226000-memory.dmp

Download

memory/4196-347-0x00007FF64D630000-0x00007FF64D950000-memory.dmp

Download

memory/4196-345-0x000001FC25820000-0x000001FC25886000-memory.dmp

Download

memory/4196-341-0x000001FC25820000-0x000001FC25886000-memory.dmp

Download

memory/4196-340-0x000001FC25820000-0x000001FC25886000-memory.dmp

Download

memory/4196-339-0x00007FF64D630000-0x00007FF64D950000-memory.dmp

Download

memory/4684-247-0x000001866F860000-0x000001866F8C6000-memory.dmp

Download

memory/4684-338-0x00007FF7946B0000-0x00007FF794778000-memory.dmp

Download

memory/4684-246-0x000001866F860000-0x000001866F8C6000-memory.dmp

Download

memory/4684-244-0x00007FF7946B0000-0x00007FF794778000-memory.dmp

Download

memory/4796-302-0x00007FF7CE230000-0x00007FF7CE646000-memory.dmp

Download

memory/4796-380-0x00007FF7CE230000-0x00007FF7CE646000-memory.dmp

Download

memory/4796-303-0x000001DF0F400000-0x000001DF0F466000-memory.dmp

Download

memory/4796-424-0x000001DF0F400000-0x000001DF0F466000-memory.dmp

Download

memory/4796-304-0x000001DF0F400000-0x000001DF0F466000-memory.dmp

Download

memory/4796-427-0x00007FF7CE230000-0x00007FF7CE646000-memory.dmp

Download

memory/5100-450-0x00007FF6D0280000-0x00007FF6D0786000-memory.dmp

Download

memory/5100-371-0x00000288DA3A0000-0x00000288DA406000-memory.dmp

Download

memory/5100-370-0x00007FF6D0280000-0x00007FF6D0786000-memory.dmp

Download

memory/5100-372-0x00000288DA3A0000-0x00000288DA406000-memory.dmp

Download

memory/5424-359-0x00007FF62F6E0000-0x00007FF62F829000-memory.dmp

Download

memory/5424-264-0x00007FF62F6E0000-0x00007FF62F829000-memory.dmp

Download

memory/5424-266-0x000001414BAB0000-0x000001414BB16000-memory.dmp

Download

memory/5424-267-0x000001414BAB0000-0x000001414BB16000-memory.dmp

Download

memory/5664-30-0x000001544A670000-0x000001544A6D6000-memory.dmp

Download

memory/5664-29-0x000001544A400000-0x000001544A593000-memory.dmp

Download

memory/5664-32-0x000001544A670000-0x000001544A6D6000-memory.dmp

Download

memory/5664-31-0x000001544A670000-0x000001544A6D6000-memory.dmp

Download

memory/5688-38-0x000002096C980000-0x000002096CB13000-memory.dmp

Download

memory/5688-40-0x000002096CC40000-0x000002096CCA6000-memory.dmp

Download

memory/5688-39-0x000002096CC40000-0x000002096CCA6000-memory.dmp

Download

memory/5856-352-0x0000021DC8490000-0x0000021DC84F6000-memory.dmp

Download

memory/5856-442-0x00007FF6E0D50000-0x00007FF6E0FDA000-memory.dmp

Download

memory/5856-353-0x0000021DC8490000-0x0000021DC84F6000-memory.dmp

Download

memory/5856-351-0x00007FF6E0D50000-0x00007FF6E0FDA000-memory.dmp

Download

memory/5956-58-0x0000024072680000-0x0000024072813000-memory.dmp

Download

memory/5956-60-0x0000024072600000-0x0000024072666000-memory.dmp

Download

memory/5956-59-0x0000024072600000-0x0000024072666000-memory.dmp

Download

memory/6012-362-0x000002AA46C80000-0x000002AA46CE6000-memory.dmp

Download

memory/6012-361-0x00007FF603FE0000-0x00007FF6044B0000-memory.dmp

Download

memory/6012-449-0x00007FF603FE0000-0x00007FF6044B0000-memory.dmp

Download

memory/6012-360-0x000002AA46C80000-0x000002AA46CE6000-memory.dmp

Download