6bdb3e0de6d665b4a7fc3a503bcc5f962e57383d5872ccc4df4e95ffd629f360

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260731-dv5hpssgrc
SHA256 6bdb3e0de6d665b4a7fc3a503bcc5f962e57383d5872ccc4df4e95ffd629f360
MD5 2c9c35df8cb478dae0d6b5a2d1e20704
SHA1 9c879ad7b2c02e51b6c691ef850bfb42d79a5352
SHA512 30cf26486be3431b11dafd15115905c8d55b7ad1ac92fdfac5cb8a198b8bcdeeea095606dcd5054b213482795bd480f4bd5482089811055817639ae7e6fb186a
SSDEEP 49152:FHs5/EaWEzVHEh2bK2pTETMcwadt0zYyC:FHmI2RrktUYyC
TLSH
T1C485CF07B69600FCD06DC1B8CB169132EAB1B8850F71BADF1290A7292E77AE45F3D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2612	alg.exe
4364	elevation_service.exe
596	elevation_service.exe
4344	maintenanceservice.exe
2140	OSE.EXE
5828	GameInputSvc.exe
3888	GameInputSvc.exe
3476	msdtc.exe
940	PerceptionSimulationService.exe
5340	perfhost.exe
4120	ReFsDedupSvc.exe
2912	locator.exe
4244	SensorDataService.exe
3640	snmptrap.exe
2468	ssh-agent.exe
2932	TieringEngineService.exe
3004	AgentService.exe
6088	vds.exe
5496	vssvc.exe
2264	wbengine.exe
1488	WmiApSrv.exe
4376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\54ebe67dd744edbe.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 59 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e2befeee9b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3888	GameInputSvc.exe
3888	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2752	2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2612	alg.exe
Token: SeDebugPrivilege	2612	alg.exe
Token: SeTakeOwnershipPrivilege	4364	elevation_service.exe
Token: SeTcbPrivilege	5828	GameInputSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4120	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	TieringEngineService.exe
Token: SeManageVolumePrivilege	2932	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3004	AgentService.exe
Token: SeBackupPrivilege	5496	vssvc.exe
Token: SeRestorePrivilege	5496	vssvc.exe
Token: SeAuditPrivilege	5496	vssvc.exe
Token: SeBackupPrivilege	2264	wbengine.exe
Token: SeRestorePrivilege	2264	wbengine.exe
Token: SeSecurityPrivilege	2264	wbengine.exe
Token: 33	4376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4376	SearchIndexer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5828 wrote to memory of 3888	5828	GameInputSvc.exe	96
PID 4376 wrote to memory of 2624	4376	SearchIndexer.exe	113
PID 4376 wrote to memory of 2916	4376	SearchIndexer.exe	114
PID 4376 wrote to memory of 3200	4376	SearchIndexer.exe	115
PID 4376 wrote to memory of 4152	4376	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2c9c35df8cb478dae0d6b5a2d1e20704_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2140

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3476

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:940

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5340

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4244

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2468

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2952 2956 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3200
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2916 2904 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d61acfe8ad95e0461e4b5810650f88213846dc95bc4625670f50e62c5962dffd
MD5 bef179f58b7d5ab5fdd2c5e9f4baa399
SHA1 6643a2cfc9dc61be839a37bb35783d9b844dd2e3
SHA512 61b401f8414a2bfff0e744294b967dcb613dcffc0bf29c6aff621dbf18e3b6d695572425f19072244bde4c527174f21dd266a97341581d0fce6272b050fdac2d
SSDEEP 49152:+b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnladt0zYyC:A3q6gjBCktUYyC
TLSH
T140D59D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1cbcf1f17246922a635bddacd89c8158f9a42e79e799d83a09aa4832a4d15c49
MD5 c6d53855301786d6f14018e7cd2f3f76
SHA1 05c916988347c8118f02cb5da035a214f32d505e
SHA512 d42427f3b630dc12e45f503e18cda75d16cce7cbac7f2165b81728c1e38550e4e0f3ac6c8c62f6e0250220cc8dc760542b759ad3d94a3b355ede39cf56e873f7
SSDEEP 24576:jXYxDtczAex1vudUXRpdkrmXMLZHuSwyfyC:wtcHadt0zYyC
TLSH
T1DB05016963E508FCED6B813DC8A28111EB73F84043A0F79B03A899754F636D85E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 63c58db87499d1714953b07d2be039e98f2c8fffb9dbf53b2e1f98c476d67fb1
MD5 a1e460783d8999a90141e2c366359849
SHA1 7823b3622bc528e86a45cf4cc50bc7eeb4c13ef6
SHA512 f4b0c2f6070fcfc9945eb9717d460c83972c8122faeb2bc37cab4db7873410c9146f9661534c8b2604fc7a49969a64085c55d798977dd95102f9a7295dca490c
SSDEEP 24576:x03e2nx0jrxOrMcx1vudUXRpdkrmXMLZHuSwyfyC:xMnx0Hohadt0zYyC
TLSH
T11045AE56F6748335D073C0B9C5D2A69AEE7230811730CACB4286D77C6F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a65ca187dee55dc51f1654e158ebbb2abb34fb6d7abcdfcaf34911443d025674
MD5 5b4f1c0e67f415a1132c1d563bb2e10e
SHA1 85c7b32cfaa27850886fe54213a9b7e338163b54
SHA512 6ff15481f08e3f8d1151b4cdbcf69864f4288dad633b7222ff8175923430880aa94d0989dc33f351392ac5d08daaecbc8d59662e68f6c7fb1d60355d43bb3cba
SSDEEP 24576:rLp/ezSC6vUyD/aqgrvW/6q8wyu4x1vudUXRpdkrmXMLZHuSwyfyC:p/ezSC6vUzPvuHjybadt0zYyC
TLSH
T1D6756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 38d18f75daf48c5e40cb8b74bb015a5df843bd8dd5e47bc65e0008e6334ed36d
MD5 102d2c31242ac20cb6781fdc328bcd93
SHA1 979a37225ed5e58a24c7a3d924caf01a85e9217a
SHA512 93966ddc4f14e74505097adaf480bb9d25f6426b5bec74a655569314dfce968891a3ab2f2a27435fcfb1a0f16c5ad91f5adb6c7aba7e32573495f244392dc435
SSDEEP 24576:0AbEPsA89v/l+dAx1vudUXRpdkrmXMLZHuSwyfyC:0AvA89Xl++adt0zYyC
TLSH
T16455AE66F5748335D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 b7718786a1e0e248dcd356d61818c61fb61e1e777004866671e878c525e42583
MD5 69dae3e3c704e2992a86032e49b2d1fe
SHA1 414899f25ac30e1431f546f9d4ea3b7842c4cf51
SHA512 f4f878832f06db8fe61336cb382fab324a2f6ba2d9026b4196979290f069aa08c646640abdf337de577ed793b690f58be1e5c41b5a094a7dd691ae029f0dc75a
SSDEEP 12288:+P4NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:+P4x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1C9D423CB4227487CE6BE2137744C32F5DBBBF80461CAE71A610C2AB4C5ED865C14A79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 d5260189dfec115dde99427dc09ea54ab0ecee6d9085b5b2d1dda5f18296edcb
MD5 484e3a5e16a1ad84e6e4e9cb01ebcd76
SHA1 3196077ed8ba54f10a8d4bc337557e0c168728b1
SHA512 2b68538dfadf13b050517eaa600b24865a17ec79aa4d50808bff381add9cca29d04fe64738ff6b1e91217d8636f4c0c33f41425a6d8b5e936b208e4d25852f76
SSDEEP 12288:8eBNUbTVO86U0NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyR0:8JIU0x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T12A15DF7BAE28FCE1C27E5D795A918340D772B4304B52E3CBE165820ECE535E05E7AC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 efeccacfa1ffdf7dff3132916bea120319395fd793ca1e50196241e7c467cc17
MD5 ac5842284400e4d78d8469b15cf9d1d8
SHA1 c79548d8892e401cd271e44269c348b3ca876b89
SHA512 fcbf348e0055cf1b64c166f6f4bdc2dcff881ba6114b4c70adc03601c11ba526015ab820566e351ca0403726b3a5557e6a9f92885d81e86387e01921a5d5ed62
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J4NRV3THE:5QvGAdlCEL8c/WRNs5CektUYyC
TLSH
T11C367D656BF880F5E0B7E138897A85B2F7B678420D31EB4F0291C66F2F736904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 97406f3157830fc7681124fd551eea73357b79716b9df41ff0cc4148866e1c8a
MD5 70164a438facb72654c511336b5715cc
SHA1 13cd6772ea02c55003831d3cfc966ad56be346ab
SHA512 f6f184f709fc64fecc904b5919186f4a93f3a0348c2a19cffb8703a3b7daf19750d06f93803ce37542068716ce17e003f1835f4ca2826df67af50c6ed0e3a3bb
SSDEEP 24576:EmewsAjux1vudUXRpdkrmXMLZHuSwyfyC:vljuadt0zYyC
TLSH
T13215F071FA75D036C3BF0DB21B25D316587DB9204B912AC3E3A84E9D89A41D22376F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0f359aa5a277e21bce06bd1dc06dd743562ed8395fd3da49b3fc56304fab626c
MD5 e9e0dc5dffee3eb446030cef24e002b2
SHA1 8a7ea7805e893538be72c0c87df6a5cac3932280
SHA512 d9e610cd3a84e802405366f37cb8d67601a720b249bc8e3416693c7e9b11080b2f1289c1b908d990dfbb73ecd7754edd105c2e2cc6496459a483c52c67fd32bb
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrkdPlbuJHnzyC:DUEtQevvqc2W1cpV2Xrw25
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 60f394c79ac3894383452d5b6cd91ca5860c4ed6bc59a3036f12390ab69647a2
MD5 59084616076ac2c371a616a66eda1c6a
SHA1 5bde7c55664879ec37dbf0ef7d90f194c3b44d5b
SHA512 bc22d22467f32659a6d74e2b056cf2e7503c3bf5f310b164d8fcf2748e1030def32ab103949b0674c3240f07857acfeaed90aaf1a1e702e4d96d74712e3d7dd2
SSDEEP 49152:A+bRquA/m2yL5zMfFiV+XenmE3/zGadt0zYyC:xoq1VjnmpktUYyC
TLSH
T1B1D58D0976B8C1E4D1F6C37886A2C647F37178154B35A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 272c3b3bc1f29d1cbcd04ce798c7e53c5d63d25951f7129e74114bb3310a7f3f
MD5 81f11ba64be5653b1e6e90a9b553c6ef
SHA1 04bd32b41982182abac6ed8eadc23b3d0a80b81d
SHA512 fd8d6338165d12f851b73e0e20790396d59eedd98e9714436fb31233e8ff5088a6a63709da5711d6c61d0b5f44ea62c5db7dba483bd5a9993496d20c9320005d
SSDEEP 24576:bAhGLvWFoiwtA5l7S538x1vudUXRpdkrmXMLZHuSwyfyC:bAMCFoiq5sadt0zYyC
TLSH
T1AE459D81E7F945D4F5B3AA78A9B69170EA76BCA95E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ba9fc4ec87d42c58b7cc73e3aaa965812ba992253ebee2af9d5d33a8be1735d5
MD5 df2d2e92d517b43b7e9ab6f91ba66624
SHA1 eba85533fa1f4e58ca1b8bbc9f7873ccebbd0318
SHA512 c1fa94c93947f104abdc253d875c76516fa75f1d577bbee314ee8734da49e0e8d52a4a36c8d6a5981e39c0ec340b42614a9d3b3c22a0133117f9a9ca6b9fc6d1
SSDEEP 12288:5mw5HEjsChNRBFgl0WDm+CBNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZ2:UwusOWex1vudUXRpdkrmXMLZHuSwyfy
TLSH
T1A405F18A33A50CFCE9BB5239854B9136F7F3F8002665D71F1360C66A5F67261AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 6391b5ad0f57c5d876d3d9a4ccadd29b3c08515cd673af0e824d9d7a0db6f2a4
MD5 346658bf8b23b51abae25a98aa541102
SHA1 191f3d8a900a1604dbdf0192862e0a4b65285014
SHA512 bfd10127626c4f730d3017f9c82f4b53a84ab9b3857629ff20ab58fc9e6bcb1899037d539447a997a282ea1e2f8ef24f3fefb421dfe366449da1532f345a83fc
SSDEEP 12288:EjP1IzTNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:wPu3x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1DBE412CA23A510FCE1BB123E98981295D7B3F44063B6D3CF211806B54FE79D59E3A726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 02c53fb95cf0c92bd70743156231fba2cde2ff7700c1d1984a5c3995ff17098b
MD5 f0ac7213415c5b2271f26ef3b4ed65be
SHA1 2c1ff1675f57646212855bbf6cffce8adec232bf
SHA512 10b019c65029171f4037a7e35b61f725713aae005ada91ef42d8d674f75e7cfd14dce1968d3c50e1fcd8e25986878be63a62b5fd601a6de3c2d24c453729e137
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ul:cQRQyi36YOcP8Lvw2gAf+PN3SktUYyC
TLSH
T11F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 13145d59fc33396e5bc1428973031e7730dbddf4922c786b78562fac06878a74
MD5 8be1921b6a14e89635a9c60b6ce9e56e
SHA1 a0fa721579ecb7e35608f20c6ce6336e8d19817e
SHA512 2f1284e2e6b143d5d172d8494c0a1f5f1ce9fd911b2fe793143b19f3192128a1125d2ec1801977616466cb404adb3fd3ef0786231e5433d986053540575bc467
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uz:cQRQyi36YOcP8Lvw2gAf+PN30ktUYyC
TLSH
T1F1667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a76a200e7451ca855116e9c1459289afb87003c326340dd698ad0a3a761c219
MD5 79b1d5478ffa3cbc4551fba146a14511
SHA1 b1a48b3e67a085f2cff0819406245760433b2cbc
SHA512 c046a83391fff271bcb908b174a15629adc68b6e19d0e9e427da3daa263be8a52adf4c5004fa3b04ff70431834d313c4620ceb021d15754eb541474f20f26b8f
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0Yx1vudUXRpdkrmu:k68Qg55nhMeWu7PNU3/Radt0zYyC
TLSH
T1ACB55A33B2F600A9C44DE1769F4A973196D27C718FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e447b6a230390ad2c917ea9cc41f2284899da81d250d1df3506fce6784477237
MD5 f5f8cc473c3da8f76ebd9eb1c13c1df5
SHA1 25eb565b12dc279befd00d7ebecf8105d4992e01
SHA512 82fbf27f3f200de88a4e7b300471be84866ca3a4ce706c3cb7d315588b4ea2a1c00e43fd79c8d8d696a8d49e3b4500c9a8cac309c26d11d6d1c40adc6fb4fc6c
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99a:Fy5112gYy5azzVv569nLKnhZoktUYyC
TLSH
T10A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 284f049a0f92d55773eb0a8d4938fa5974ddebde2cc835f386e5840fdf379d11
MD5 3667ca0e7de05f7a302609b02bca636a
SHA1 49b973964719af063ad6a921539268eb907d08b2
SHA512 d49e1af16c76bb63c190dda7854ef3f5a80d69fc36bb6fcfe053f795c39afe5f7153c3b8d93029c222dae6df6bcf6d6ebc204a6ed8bda286916c1175dc72b06a
SSDEEP 49152:0B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glradt0zYyC:uu6JmTxd2drktUYyC
TLSH
T175D59D13F1DA01E8D06ED079974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 803a37c27bf9e4b8c867fb5fd295e1c876f583307a80b6315a3be63e1dfa804f
MD5 e57564805b8e647b66a11672dd5e65bf
SHA1 c38f6c5d8e3da6ddc9b9a90862d6a86c8cf4591c
SHA512 3954590d4e0fbfc2b7657620cf005983aee10c8d0ad8fd373ccb9b68f4a080f1ed9c6630b31d99ef0a84293a9ee7fab9b7d8fb81f3595eac7e8e8cbaa20794c4
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xnadt0zYyC:ZmifPbRKktUYyC
TLSH
T1C3B5BE13F2D900E8D06ED178875A9232EA62BC450B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 eb5bde0a90dd983e3b3aa48e7f3f401cfa7b797ffeb677174ac4fd6439d732ca
MD5 3eed72fc713b8a497516f2eab4a09291
SHA1 6c963d7be80a77cfacca8698daa92ed6a15a4180
SHA512 1538f75265fe6627dc25e01bd83cf79ec6bd9bef97c476ff7273573e32d9998a9ecb2763ae46042eb9a9c821ff34d2ce9a8b0e65cf068779a88c18f75043ea59
SSDEEP 49152:MSuZQIY0Be2K6RVtOnks6NMHqSadt0zYyC:u5dKoi61SktUYyC
TLSH
T1CFC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f720999931a360d9e9fc101215e5721520a8827fd1ee11325cbe0dea8701f0a4
MD5 f380e32318c463a2d1939a8a54e0b3ab
SHA1 2a9d090ffd27922f98743c4ddf851f8b4aec1eb2
SHA512 67b0dadfabcce144de47e0bb491da04b4d5fa352d2b24d348fdf617b26d201ecb236e601bba37fc4083c35ad2899fb84fdae01b3ec13762e5fb8421989320963
SSDEEP 49152:ghtSn8EApI0figTgiDn0AP5weadt0zYyC:xX2iyphXktUYyC
TLSH
T199A5BE13F2D900E8D06ED179C7468632EA62BC050B39A6EF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 28ce4770af6830c37238bbaeebe61e9ee82923229824412557dc26a490b2746d
MD5 e85943e4be8e7c39613fce6b6f84df7b
SHA1 23b095956a546c98cafc4d0a96c99b4d689b867f
SHA512 a8ddcf80628f7f5cd143b6f198f5be3dafeaaaa2c157af4b9bfe45c3b7a8f253ba3900b624da421e9f241186d71e21781b5e4b5a4cd5625f02cec84f8013d11a
SSDEEP 12288:6fNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:6fx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T171D423CF426B487CE17E2177644C22F5DBBBF444B1CAE32A350D2970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 62d32290bbf4a280055f42e1f2b2329aaf056d378ac6ea1f03f79932cd67833f
MD5 77f94c482299122c37923b1314ebb978
SHA1 01470a39e47de2ed69cefacdeb45010b064ee61c
SHA512 12bd0a4b8a8edccc8c3522ddbfe0648f6ac5cef013a507d3e0bff47754cf9aea7094d49185ce7bb60596b05a04f07838e2c59e76cf3d41b28f24bfa5042f7f40
SSDEEP 12288:82NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:82x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1F2D423CF426B487CE17E2177644C22F5DBBBF504B1CAE32A350D2970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 47427a7898a8cb5b1a8286c22ef4ff27337bec7a637b848d41bab8cf785ef1f3
MD5 a298a783063041b9e24eaefff9d45817
SHA1 93204a0f0db6395e0af5f7fec7cd9fb4103ba7c7
SHA512 f24dcc732c75774023bba946ee57b0eb4c9f8d3513050100a470cff5c3116ad7139472b68d0e6863ae0a5b5910028bf2b29a8c58cae6b7e980307e760ebf7bf7
SSDEEP 12288:+rNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:+rx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1A5D423CF516B487CD17E217B644C22F5DBBBF404B1CAE32A750D2970C6DA874824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 12d00dc05219351d67b4da22d6a066f18c3672bfd219617036861b85b47c09e7
MD5 bdcd6e0a165daf17aa8cc3be621b4a6c
SHA1 890eaa57bc5818e4493e27f3397c12237a07d0f6
SHA512 497a0769dc569c19ebda40319e5e5e0d56a399579410ea42217bb35d689d86f23c1cf356329cb75c3d11d8c90456d757306f9934b7d6db27d4c86809b3d7901e
SSDEEP 12288:Ulp1NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:U1x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T139D423CB136B04FCD4BE613BD40C22B5EBF7F844B196E32F650819A48EE64649149F9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 b693abe1d7620b510204076fc864f2da8c89915df6990c0aa55a5078f53452f6
MD5 eab52fd9e063f4412bf250f211a373a6
SHA1 15b2532f447c2a818b0761e08afcf32721d500fa
SHA512 2bdec6a74da7fd65c85e20bce78422419bfb1870e410a6404a5a3c53161429e728c702b03662bc77af9711da5640cb9d083ecc9a6752281ddfb8358faa9f943f
SSDEEP 12288:dSINDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:dSIx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T10FD423CF426B487CE17E2177644C22F5DBBBF444B1CAE32A750D2970C6CA874824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 e476f670118571d7abce928a4a2eee43b3bcde8b3337284d356e2f6edc283dab
MD5 cf48b4eb5f4507078ba83ba370f85c1b
SHA1 5fbcd03d31d1c3723fa7eaa6ff2b304f3a725b38
SHA512 227d981092e41537d4358e2dce349948bc0ee9191bee6c1b2b0c6c552a3560b8bf348c7b1ad9f615ef527a94b0c242c26ae9a9f8af82028c17030de5839c9b20
SSDEEP 12288:mYNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:mYx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T157D423CF426B497CE17E2177644C22F9DBBBF544B1CAE32A310D1970C6DA874824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 c497b2efb2ea004d3545574fb1f342cee426c2e078294a6037ebbd346ccab412
MD5 c753ab6a021d80699db1d4a645a5ef31
SHA1 c6ac3c220f9abb25467e9ba943762556c2f93f0d
SHA512 c738a8f2ac5511751302fe4ce5c747f8ccb92bb6b888e9fd144b32063c267e1734dcfad314071ded330dc8a6ff38c65c68035ca1d9cbb7a410baa8813c9add1b
SSDEEP 12288:FyNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Fyx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T12BD423CF426B497CE17E2177640C22F9DBBBF544B1CAE32A710D19B0C6DA874814AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 97a8fac293c2152e0242ddc4c33b5c707ea7769f4d43c486f0997f6fce53def3
MD5 7b9097f1ab844693f511fe06472caede
SHA1 076c4d9e8a802052409ce743ea7fa1eefd90fe0b
SHA512 0ad8cec853124e6905ee685b2703d6a8321c87d83cd214db4ca3ccb98a8ecc065194cae29804d05de11c59421122aa61906d1e378ec3f53da05b55f89d24c4a8
SSDEEP 24576:HZMtzF/SkHx1vudUXRpdkrmXMLZHuSwyfyC:HZMtzdtadt0zYyC
TLSH
T1551501D973A108F8EC7B413EC8155956D7B3BC1916A0C61F13A836664FB33A10D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 83f81b7068a49de2047bebf7737d6a6cd478eb6fe739cb1a8ddf4faf8cfefcb8
MD5 f4c26c9fefd2265af36dec4ffa760bd7
SHA1 33f06160095674c443bd8cf828a5a19fa20091c8
SHA512 41364fec5137af10d993e0b833891c3a6705db4d9ea382db22df7e1e57e6438edc2892d84dc295df87d41bef7b6dc4a5e1950b618e82f128280d36a60df142a7
SSDEEP 12288:yaNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:yax1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T148D423CF426B497CD1BE213B640C22F5DBBBF544B1CBE32A750D1970C6CA865824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 8c62a3b13f190de3af7616fc8ad6d08dd6186bfdb16148cc3e14145d9ac3ccf9
MD5 293f3196418346ba30678d65e87b4c22
SHA1 2765a3851d679038372e780b09e2984669c3a9f8
SHA512 8d9c9f7c957c16f0cf6d03bfb55ec7479a43755ca10eb0dc90d301c8d3f8ad65cd1ffb7740e0ba31b39721c9a67b346728912636f6a94a9f1edbc78b6bba0332
SSDEEP 12288:s9NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:s9x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T18ED423CF026B497CD17E2137640C22F9DBBBF544B1CBE32A350D1970C6DA865824ABAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 1674cc662dba5046096d646372a29e993fd990a726e4844d594cc089b221fbf7
MD5 8e99c622d7e2f550069a67fd6a007b06
SHA1 17104a245bf0fc8fface25dd99e3240330cae36c
SHA512 aa88bd8dec12cf7de92e996ef929f11b3a967889ff9147da5070669039e4fa604fd376bcc0d2c7b4f511957c7322a0e98dfc9379730c337105c6cbaa2d0c1526
SSDEEP 12288:N8Pz5L8oNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:2zyox1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1E4F4128B23A220FCD17B5239C8552652F7B3F8301760DB6F235807765FA75A09E2EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 3c2d79230ab6c567dfe4dc4721dca5f543ee06e82da2bf350b71fc3543230fa6
MD5 3fd7d0e952494cc6801b4125b7673f0e
SHA1 d4ad6acdbb5b6866bcf29d1276f549c3072d9c7e
SHA512 884f565abe15297c00721a749f3b1802539ff8ed97b554da3e2417e6670a8927183a0a95095c4dcb0d6de8a360b0776eb2ea490c8deb34dafc1a35d92148347a
SSDEEP 12288:uyNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:uyx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1B9D423CF426B487CE17E217B640C22F5DBBBF444B1CAE32A750D1970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 5380fdbd78274fca3d2b751256e12dc3eab7f08031cdebe1a567e4feb4e5eb9c
MD5 90943e15001365709ccc797d3d64d123
SHA1 c11b9018c84081bae16ea8cede2b185695d0ff9f
SHA512 46dbee222ffb3c9cd935728a9e0747000faa71bf0c488517ad42ecccc74908f542608d567b616253ed5e8945baf461bbdc8c3495b9cfaf45b5f7dcb54ab92225
SSDEEP 12288:a2NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:a2x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1A2D423CF426B487CE17E213B640C22F5DBBBF544B1CAE32A750D1970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 ec2563d1a66efdb3e397c72180b8ea16ebe31a9fdae2592e6b424abe02645db2
MD5 9a05502cba7179aa682c1ad102a1a840
SHA1 328b37c1c8c8de522138728ed38221e5aa3e09ee
SHA512 e0356d92a314defe36181f2c44c5e8aec9ede8101090605d63e872e80ef802668a0b58679437eff837456a9d766802f1d5ee8ae74256a9a4b124bff2d0789ea5
SSDEEP 12288:c8Pz5L8qNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:fzyqx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T171F4128B23A220FCD07B523AC8551652F7B3F8301761DB6F235807765FA75A09E2EB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 e2ed1458a62c3d173185fb82e0f792a0ecc49a89ddc5e267dfcbe03d1664d092
MD5 ee269478a48cc50d92e74a32c166ca96
SHA1 877ee6c03473db4ce8a65b5947e6d159a0587303
SHA512 bdad337aa730f2bc9741a560af1c84d185427b01ef9c9e6a96edcefde037b340bc481cdf02e1febf4fec1c7fbd2b93976b9c0d1d6e48df16bcb3942f31fdf256
SSDEEP 24576:KT9aLd3z0zffx1vudUXRpdkrmXMLZHuSwyfyC:KTQLdjaadt0zYyC
TLSH
T19D1501D9B36108F8EC7B413EC8195956D7B3BC1906A0C71F13A836664FB32605D1EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 6ede0beb847cb78177d2856be012fd6ff92521ee3b9eab1df96fabde54a64c5f
MD5 de875b162f2c1f8d39e3612a03daea16
SHA1 5830073afe107c1ad5c17275c96b66eea067fc4f
SHA512 072e362a473d5dcd75401d1b2eb6f9ff3b29c48c374b0fce5cd8a270736270c1edce465e865151c9ba3e567f27568ff01973e2a494a8655f050de083febce711
SSDEEP 24576:C3Wd5CHRy7gZhx1vudUXRpdkrmXMLZHuSwyfyC:kWd5CHRykDadt0zYyC
TLSH
T11235DF90F3E414E8F0B79A358C765511DAB7BC591B71DA8F03A8261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 69c6dea3538e83c528b6330affcd3eff293489aeca067dfc4ef9b80533b3719f
MD5 703ee05834398a5120b9ddc1f35bbf08
SHA1 97ebf841a9de8bdb1fe9763c8de195c58607b1cc
SHA512 829b27fcba6d58bb67dec571304107faddda9e03524e26c75b049638d8762be361676660688ce41412b2c3529179438812c98cfc200bd1da8ab59c61e2f56a99
SSDEEP 12288:c1NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:c1x1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T147D423CF426B487CD17E217B640C22F5DBBBF444B1CAE32A750D2970C6DA874924AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 75f56f971661c95e50939818c1735e1c90b7522b73f0d480815175139006dc36
MD5 a1ff8145e7174ff41ac56a4afbbec052
SHA1 92249943d8eb01217035ca608751915d7b31df08
SHA512 34ee00e06b8d727c25e219043a41d308f1164e7b8ad6fe262f8e373c4d7a7fd2de1e56569e6a05be6107c61b42cdd890eedd9a3016c88ea34aaf1a91d23e97d0
SSDEEP 12288:YL5gNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:YL5gx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1D2D423CF426B487CE17E2177644D22F5DBBBF504B1CAE32A350D1970C6DA878824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 08d656042c687c6192d09b10e4d97aeab00367ec382bb7907b8eb16a21f3346b
MD5 0ac4c07a7685acfcc9eb2e89adcd493c
SHA1 61ac03e4350f1e9fab325c96628adfc49a232de3
SHA512 4c7c3df8048611d87b61a1eef3cbdcb974183c9c965de8e9824f2b527608f6ec096eaa0b3375407f3a5af9e1b4d90fb90c164318cc590486b3ce53d3395e69ff
SSDEEP 12288:nGINDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:nGIx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T118D423CF426B487CE17E2137644C22F5DBBBF544B1CAE32A750D1970C6DA878824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 a26c20161ea64d6a18fe57be7db828f11d6ed7e1fbc42dd0b1cbee39249e7388
MD5 f5ec7c1e5ff77c801a1ecfe12ec172ef
SHA1 acff31329f7cee4b2f80448b5c0a603c6b308beb
SHA512 9f46c191b36cf77ee2a56955ab53818158efa632fca9a0c7dd925765544af72bb626a7e2be0ddeb78571fd9c559e0ebac8fa83fe54d18745c056de44fe4a190c
SSDEEP 12288:olNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:olx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T107D423CF426B487CE17E217B644C22F5DBBBF444B1CAE32A350D1970C6DA875824AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c5045da6523ceb6711b5132c7cbf2b540d9939319bd15136f328718813608507
MD5 3f286349b606e13cb0d213c15c6de34d
SHA1 bc6afcbe5a44fe0737dafbfaeafefb00ce075831
SHA512 335e4aa7f74f0281d9a025c1443f361c49d2cee44dd9ec726a4ecc1e1cfb14deb9fea7e95bcd7d64bfb62330a0e6dda3a0b30306f65f375098509310b9629ace
SSDEEP 12288:0PsfSwNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:7lx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1E0F4018AD29901E8C06E213AC7491691F777BC1493E1E3CB62C4F57D0FBA5909DCAB47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f3fc321764c069c75a5f63ce50e1adcf0d58fc919be5b2bc6f0eabf400553a99
MD5 126ea39c8f2d551b4ece77653a6ed4e1
SHA1 12cc91d6656b516a9f8c18b38c679098691748c9
SHA512 7cc92391baeae539bd68da36ebd02e44aba3d28a95b4ac23573c5a0c8d6cf33a73e458a0e0f4a67869bd5bc3d2ce700d967737fb0cc565406ab66f9133d47a13
SSDEEP 12288:jU7mhNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Yux1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1B3D423CB436B483CE4BE2136644D22B5EB7FF504A7C5E35B700C16B4C5E98A4CA4AB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d6614e442b20482f26adab28510427c6e03cb0c668bafd3ab4af1f4b7fb162d8
MD5 021a759179322d11ee6250d1b1c55b52
SHA1 6efcec55fdb4eb66e12f5edabd37a9befcc37df7
SHA512 49204f0226eba77d7e82aa1596893f2733780577ebe474d00f49441633800a130549acebd3028465a2c83beed50f9e27b1e72df26300bd4b839725125f54de9a
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYWx1vudUXRpdkrmXMLZHuSwyfyC:Vgb4mBIBhGF1adt0zYyC
TLSH
T1FA65AE1E22E802F5E0F9E2B89DAA4417D6B378161332D2DF1151427D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4edda6fca9dbc842fcb290c7d51e0276121df007a0362c0e53db6eb0e9665a09
MD5 bd4faeb99465dbf75b13daeba53a3594
SHA1 76f4c7faf07b7383b5dac1ace69fe74c5b28c783
SHA512 9dc88fb7b7a18b33481e166b03e6bb302a2ebf276fb965245f8e13ec6bf42178e0208f62868bfebf4db56176fd93058d3a4060527e34e81d0ff3940de13abde7
SSDEEP 12288:hbGPNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:VGPx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T10CE412DE11A764ACC47E523A645821B6FBB3F0406385E2FF1488A574CBD98F0923DE9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 4c00ed338511bd17c0978c74b32424989b88d32cccf176104c20573e6b3621bf
MD5 5e41ca27f69bd8a910ded5e618834e93
SHA1 97b7bf7ba96c6a238d3123bec2bd8e4fa335e2ab
SHA512 6445cc107dcb2277a297d6f19e7a7c87f79eee4f5d040c9023364a8cde7d70678ec3abf2fa5000f034234a43ee9398fc4caacb16cad2ecfc094acd6d5ccd3b28
SSDEEP 12288:0HjNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:0Hjx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T1CAD423CA026B487CD5BE2137644D22B5DBABF40463C6E3D7740D25B0C2DE8E5827AB9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 07e3b9d13873f945f8576823d6aee6c2568e04ff3ceb6c702769e0e05e246759
MD5 c66c9f5e5946961ee2b85533ce0df3d7
SHA1 fcf3be96ce14c9832a386d2d239815f1a1475ca5
SHA512 860c2961644f4bd2d4f60e52d7644222b7c6bef0d70b3aedb2b2c0db802b53eff241c5384af438c503215941248fafcb47b94e88f0c9e5f31963daac7698d25e
SSDEEP 24576:DHq8S8FpJqH1Mzria7/mJx1vudUXRpdkrmXMLZHuSwyfyC:TZ1FPqVra7/2adt0zYyC
TLSH
T1193501A563E101F4D47BD138898646A3F7B2F4141364EBDF06AC8B610F23AE54B7EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 c757c76335be870c63415a13a4557a0bba1c006fa638e2a304d3b25c280d95c6
MD5 87289718a4e35cd6d3e0d361f5d15fc5
SHA1 54324c481b06b66d5ea99d6777fcd43c4fc3dd25
SHA512 9024c3f4b4d25e4e2e26d32140bd3d68433d4d4345ac8a4739d784309be18762f91c148fb172390ead6cf4ed3937e3ca9df4ea96fdd5ec5495a388bfd831bc95
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhadt0zYyC:QG05lO43b4ktUYyC
TLSH
T152D5CF6E62EC11F8D0BBD17CD9C6460BEBB23415032596CF02A486A91F67FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 7979c4e887d1328cef0442708cce6201d1091a5650b4b40a4020ed2663b71afc
MD5 23e5fb43b0951fea19549dd07b8ef811
SHA1 b95828b9a4c04f2917792e56309b0fb761acd88e
SHA512 47af83956ea265eb60a5af5d1a1f363df9f925658f348a9361e88d076fc03119b06b996fd580d881dac93e8c53008e8a192bccecaa35267200889a27e7d4eea5
SSDEEP 24576:z2a5POZ3dpbWVM50JicR2hG0lasx2+47eidnTEsNx/UzLbmoXWJk1LY1LVkqYPj4:Ca5POZ3wJt2pasx2+mJEsH/GLd5Ysqoa
TLSH
T1E365BF5EA6FC01D5E5B9D17DC583460AE5B2342553319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2b1d1b4430287d4643250485b853aaca855c87b322ccb77eed2755e0fae69cc2
MD5 b5b92366644e9824744180e739e7454a
SHA1 8022fc2622d72bf79b50139271a1aa58d51dfab2
SHA512 cab67b8b17d6ca0353d2d1df645ca8fddd72d02c39a9195a1286090e2f35858b15e8d89f676e16da1bfc43adfb0b944f82093525248c6dd404ff3e6c70d05705
SSDEEP 24576:QNcwHdjbyQ4nLC18lb/EOjowL7Fktx1vudUXRpdkrmXMLZHuSwyfyC:QNc/zEOVHFaadt0zYyC
TLSH
T1C1858C5623E901E4F1BBE1BE896B9546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 e557a9c69e934e4255d21b3a67e43c0f63fa19e9ca0fad678e21dd984b310110
MD5 051994de754640c2d6c62a949c932b3e
SHA1 c6c8418a3cfac045e8e7ecbe342af755bb27c0b7
SHA512 9aea303263fb727c4be12d37f2aa0091fa9a6ed186570773f56e841840e4b882b2a7be313bba67d61021d2dd8994d09ff3c13ffd8431d425cc50c24a29b1cdaf
SSDEEP 24576:0JnJPbzB4SYjx1vudUXRpdkrmXMLZHuSwyfyC:0JnJv6SYjadt0zYyC
TLSH
T1AC15E17DD2A810E8D4B7C274811A176AFF32746C2F26A9C719B4D5343F52EE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f1c55e4b70033346bbb45426cb2256620495fe9e5179e3966dff521f055f1a81
MD5 6f12ec6ce697b0c19880057106d64c7c
SHA1 8a12fbdfd302069165f71ce6501f0062ec78edac
SHA512 45003a3066b87105aade4bf0c07f8917f583d70a8766d996160a18b24a297c143389ded039921fd2ba6adb8a3fb37582f16c51f67213bda4626919caff7ec189
SSDEEP 49152:MCLHGeeV5ijCmlDWDk5EsH/GLd5Ysqoa:3wuwoZ
TLSH
T139A56C05A7EB4184F8F3CAF5C92694169A327C549B34F7EF4A80C96A2E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 01c2a65d0c16905444ba7e3349868ea171a1fe17da6dc188db2a037829058c73
MD5 ff43cb78c81830eadc76d9fc61dc18f7
SHA1 c4c7fbbb8bd26fd48b13430fe4c5f7d636e8c5af
SHA512 c69d0a6c2e2d3610ed8fcb7724cac58e09d4aec4393237d2a99e777da42bd218af389961911737f16585bdf6fb86334d7c70bbc22be927dd79014eaaf5028af4
SSDEEP 12288:b1Hck6j5ZI70NDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo3:/6DIox1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T198F4019D237B00F9D07B903E95820252E6B3F0609352A6DF1698C5B98FE3DD8B93DE45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 de8f9fddbd0a08c8a73fd078e74b66c04410dc45bdccfb1756a49313f9df4e6d
MD5 078e90755f8ca8989424cfee77b9962b
SHA1 d729b49dcd790f920e5f7d479c3e85f4a902e807
SHA512 3018b53cf1fcabebd8272afd0fc21b2a7148b51f5ec59ea3536289319eba354ff56352e5de872c6c12390e1dee7ede860d3a139aa20b852846ce6a9d9ab3ca9a
SSDEEP 12288:xG6kyXzuNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:4tyDux1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T186F41289139950ACE5BE1239985602F0DF37FC106752E3DF2040AA3D4FFAAE4A535B5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 94b5442d8e7dc4712d397dbd9e3532eef889ba9cda0296f7b42d9dfc29f3af65
MD5 6f9c05dac9edbccf5ce88aae49f76d27
SHA1 d58d3300feddde68dc6eaeb868c75a7381ab4408
SHA512 5b26d7f624cba6c8bd105f8d2c871e0c7d1e1dcc221027cb351dd2082cd2524084ea370d76d418676d65a20fa28bf59ed6a147912c9387c9cc636c2ace3c3a60
SSDEEP 12288:mSvNDjWwyGVtsdbB+++RiUeXEh0hrm4aylBJKgLZHQZWNe3JGvfyRo6eF:Tvx1vudUXRpdkrmXMLZHuSwyfyC
TLSH
T109D422CE026B587CD47E217A640D22B5D7BBF0146386E3EF344859B0C6DA8E5827AF4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 a9c4ec7d6cb7a85c99c00f96df0be1e1d06804f099ef49fd07890a7086dac93d
MD5 4a139081c289d95e9f2a6a4bbd227d0d
SHA1 43cea2c6d3fb7544ffa848143c3199afc31466da
SHA512 89197adbdeaa26f7bf5a3671fc8625906ddef68fc6b660baa57ff6f8d84d6df5d912160311a8c74b0003d16cd2152e136cd6a6dfa5f366d24c81d0e9ce6581a9
SSDEEP 24576:QugGLoTfaidZbEsNx/UzLbmoXWJk1LY1LVkqYPjGmA:rg1TrZbEsH/GLd5Ysqoa
TLSH
T1C1559C1D67EA06CAE2B2D635D8231493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 f5efbad9c8270380a698b2a991dd23e24c75723a5a0a342423bc5cb3648194b0
MD5 4d63734405d70f2dacff7b9695b72479
SHA1 d4515a48e693c544ee4a58c33f690f5838e238de
SHA512 2da8a77e486a255b2b259ac4a065ea02ad008d618a6323432218d40bfdf34f0d26f509aafafed5786bd96fd3496cbdb4e7c1f3e191c4d014cc703290a750f6fb
SSDEEP 24576:vrcmReEsNx/UzLbmoXWJk1LY1LVkqYPjGmA:zcmReEsH/GLd5Ysqoa
TLSH
T1C905F20E77AA00B6E1B7D13CC8464655E2B3B0306711ABDF02A1C7BD1E5BAEA7D35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2fb30dc86d4baebd9d7c2630ff32f2a12aab889d9c7ecddbd312805cd49fffd2
MD5 b3e76decc27cdf1fb7d7a5bbe4e86984
SHA1 8e0926db57bd59f93f1aea545d2e305a43e8ee7a
SHA512 485bafe2139e75fd68f4013d5b004df8a9a4d38f751ea0930b4e17eff0d997f66706db1077e64a8b114b11e248b42922c00542353df3689d06e71a6a8602e895
SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/EsH/GLd5Ysqoa:K3Upow8sBZuwoZ
TLSH
T1B2A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C1B8BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 0875017ec23589a57fab74aa7ff916683f720c09e3bf3a07de541bda41d03ee7
MD5 74a6ad095dda696c97fc15160adbd69d
SHA1 198444c27eb7b82930beac188e5a57f7b7e86d55
SHA512 e394e3f72a2112b374c92e76b7c4a3b0d1dcd51e2eaeed31380d4ef04da83bc60fd575f3ee85d19269129be24cb1e807e28c47bcfdc986ede134f9ecfb69c00a
SSDEEP 24576:uPUr+NQvx1vudUXRpdkrmXMLZHuSwyfyC:uJQvadt0zYyC
TLSH
T16A05F15F22AD18E8E67AA13D85864319F772F4511352E3CF0290817E4FA7DE8AD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-35-0x000001D9C80D0000-0x000001D9C8136000-memory.dmp

Download

memory/596-36-0x000001D9C80D0000-0x000001D9C8136000-memory.dmp

Download

memory/596-37-0x000001D9C80D0000-0x000001D9C8136000-memory.dmp

Download

memory/596-34-0x000001D9C6E80000-0x000001D9C6F8D000-memory.dmp

Download

memory/940-260-0x0000017C02720000-0x0000017C02786000-memory.dmp

Download

memory/940-261-0x0000017C02720000-0x0000017C02786000-memory.dmp

Download

memory/940-258-0x00007FF7FA2A0000-0x00007FF7FA3E9000-memory.dmp

Download

memory/940-347-0x00007FF7FA2A0000-0x00007FF7FA3E9000-memory.dmp

Download

memory/1488-378-0x0000025666CD0000-0x0000025666D36000-memory.dmp

Download

memory/1488-377-0x00007FF6AB8E0000-0x00007FF6ABA0F000-memory.dmp

Download

memory/1488-379-0x0000025666CD0000-0x0000025666D36000-memory.dmp

Download

memory/1488-447-0x00007FF6AB8E0000-0x00007FF6ABA0F000-memory.dmp

Download

memory/2140-57-0x000001AB5CEC0000-0x000001AB5CF26000-memory.dmp

Download

memory/2140-56-0x000001AB5CEC0000-0x000001AB5CF26000-memory.dmp

Download

memory/2140-55-0x000001AB5CC90000-0x000001AB5CD9D000-memory.dmp

Download

memory/2264-370-0x000001B50AC10000-0x000001B50AC76000-memory.dmp

Download

memory/2264-369-0x00007FF663DE0000-0x00007FF6642E7000-memory.dmp

Download

memory/2264-446-0x00007FF663DE0000-0x00007FF6642E7000-memory.dmp

Download

memory/2264-366-0x000001B50AC10000-0x000001B50AC76000-memory.dmp

Download

memory/2468-320-0x000001B280980000-0x000001B2809E6000-memory.dmp

Download

memory/2468-439-0x00007FF79EF20000-0x00007FF79F1C3000-memory.dmp

Download

memory/2468-321-0x000001B280980000-0x000001B2809E6000-memory.dmp

Download

memory/2468-319-0x00007FF79EF20000-0x00007FF79F1C3000-memory.dmp

Download

memory/2612-69-0x00007FF7715E0000-0x00007FF771702000-memory.dmp

Download

memory/2612-14-0x000001EE2BA10000-0x000001EE2BA76000-memory.dmp

Download

memory/2612-12-0x000001EE2BA10000-0x000001EE2BA76000-memory.dmp

Download

memory/2612-11-0x00007FF7715E0000-0x00007FF771702000-memory.dmp

Download

memory/2612-13-0x000001EE2BA10000-0x000001EE2BA76000-memory.dmp

Download

memory/2752-0-0x00007FF6602F0000-0x00007FF6606D4000-memory.dmp

Download

memory/2752-22-0x00007FF6602F0000-0x00007FF6606D4000-memory.dmp

Download

memory/2752-2-0x00000247FEE60000-0x00000247FEEC6000-memory.dmp

Download

memory/2752-3-0x00000247FEE60000-0x00000247FEEC6000-memory.dmp

Download

memory/2752-1-0x00000247FEE60000-0x00000247FEEC6000-memory.dmp

Download

memory/2752-19-0x00000247FEE60000-0x00000247FEEC6000-memory.dmp

Download

memory/2912-296-0x00007FF721920000-0x00007FF7219CD000-memory.dmp

Download

memory/2912-290-0x0000019CEAD40000-0x0000019CEADA6000-memory.dmp

Download

memory/2912-376-0x00007FF721920000-0x00007FF7219CD000-memory.dmp

Download

memory/2912-289-0x0000019CEAD40000-0x0000019CEADA6000-memory.dmp

Download

memory/2932-443-0x00007FF7E10D0000-0x00007FF7E1264000-memory.dmp

Download

memory/2932-329-0x000002194A270000-0x000002194A2D6000-memory.dmp

Download

memory/2932-330-0x000002194A270000-0x000002194A2D6000-memory.dmp

Download

memory/2932-328-0x00007FF7E10D0000-0x00007FF7E1264000-memory.dmp

Download

memory/3004-339-0x0000020C51540000-0x0000020C515A6000-memory.dmp

Download

memory/3004-337-0x00007FF721930000-0x00007FF721C50000-memory.dmp

Download

memory/3004-338-0x0000020C51540000-0x0000020C515A6000-memory.dmp

Download

memory/3004-343-0x0000020C51540000-0x0000020C515A6000-memory.dmp

Download

memory/3004-354-0x00007FF721930000-0x00007FF721C50000-memory.dmp

Download

memory/3476-336-0x00007FF660640000-0x00007FF660759000-memory.dmp

Download

memory/3476-249-0x00007FF660640000-0x00007FF660759000-memory.dmp

Download

memory/3476-250-0x0000019854820000-0x0000019854886000-memory.dmp

Download

memory/3476-251-0x0000019854820000-0x0000019854886000-memory.dmp

Download

memory/3640-309-0x000002C2C1D90000-0x000002C2C1DF6000-memory.dmp

Download

memory/3640-308-0x00007FF6BEB90000-0x00007FF6BEC43000-memory.dmp

Download

memory/3640-400-0x00007FF6BEB90000-0x00007FF6BEC43000-memory.dmp

Download

memory/3640-310-0x000002C2C1D90000-0x000002C2C1DF6000-memory.dmp

Download

memory/3888-327-0x00007FF6C4180000-0x00007FF6C4248000-memory.dmp

Download

memory/3888-242-0x00000299A6B40000-0x00000299A6BA6000-memory.dmp

Download

memory/3888-243-0x00000299A6B40000-0x00000299A6BA6000-memory.dmp

Download

memory/3888-241-0x00007FF6C4180000-0x00007FF6C4248000-memory.dmp

Download

memory/4120-282-0x0000020A82070000-0x0000020A820D6000-memory.dmp

Download

memory/4120-295-0x00007FF7A4FD0000-0x00007FF7A5713000-memory.dmp

Download

memory/4120-451-0x00007FF7A4FD0000-0x00007FF7A5713000-memory.dmp

Download

memory/4120-449-0x0000020A82070000-0x0000020A820D6000-memory.dmp

Download

memory/4120-367-0x00007FF7A4FD0000-0x00007FF7A5713000-memory.dmp

Download

memory/4120-283-0x0000020A82070000-0x0000020A820D6000-memory.dmp

Download

memory/4244-440-0x000001F370D30000-0x000001F370D96000-memory.dmp

Download

memory/4244-386-0x00007FF7A3B20000-0x00007FF7A3F36000-memory.dmp

Download

memory/4244-301-0x000001F370D30000-0x000001F370D96000-memory.dmp

Download

memory/4244-299-0x00007FF7A3B20000-0x00007FF7A3F36000-memory.dmp

Download

memory/4244-442-0x00007FF7A3B20000-0x00007FF7A3F36000-memory.dmp

Download

memory/4244-300-0x000001F370D30000-0x000001F370D96000-memory.dmp

Download

memory/4344-50-0x0000027831290000-0x00000278312F6000-memory.dmp

Download

memory/4344-52-0x00007FF7CD430000-0x00007FF7CD598000-memory.dmp

Download

memory/4344-44-0x0000027831290000-0x00000278312F6000-memory.dmp

Download

memory/4344-43-0x00007FF7CD430000-0x00007FF7CD598000-memory.dmp

Download

memory/4344-45-0x0000027831290000-0x00000278312F6000-memory.dmp

Download

memory/4364-26-0x00000249599D0000-0x0000024959A36000-memory.dmp

Download

memory/4364-27-0x00000249599D0000-0x0000024959A36000-memory.dmp

Download

memory/4364-25-0x00000249597A0000-0x00000249598AD000-memory.dmp

Download

memory/4364-28-0x00000249599D0000-0x0000024959A36000-memory.dmp

Download

memory/4376-388-0x00000249A5680000-0x00000249A56E6000-memory.dmp

Download

memory/4376-387-0x00007FF7CABF0000-0x00007FF7CAF2F000-memory.dmp

Download

memory/4376-389-0x00000249A5680000-0x00000249A56E6000-memory.dmp

Download

memory/4376-448-0x00007FF7CABF0000-0x00007FF7CAF2F000-memory.dmp

Download

memory/5340-267-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5340-268-0x0000000000730000-0x0000000000799000-memory.dmp

Download

memory/5340-273-0x0000000000730000-0x0000000000799000-memory.dmp

Download

memory/5340-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5496-363-0x00007FF7381B0000-0x00007FF738681000-memory.dmp

Download

memory/5496-358-0x0000026B54E20000-0x0000026B54E86000-memory.dmp

Download

memory/5496-445-0x00007FF7381B0000-0x00007FF738681000-memory.dmp

Download

memory/5496-359-0x0000026B54E20000-0x0000026B54E86000-memory.dmp

Download

memory/5828-234-0x00000222F78B0000-0x00000222F7916000-memory.dmp

Download

memory/5828-232-0x00007FF6C4180000-0x00007FF6C4248000-memory.dmp

Download

memory/5828-233-0x00000222F78B0000-0x00000222F7916000-memory.dmp

Download

memory/5828-317-0x00007FF6C4180000-0x00007FF6C4248000-memory.dmp

Download

memory/6088-444-0x00007FF76CD00000-0x00007FF76CF8B000-memory.dmp

Download

memory/6088-348-0x00007FF76CD00000-0x00007FF76CF8B000-memory.dmp

Download

memory/6088-349-0x0000022D8AB90000-0x0000022D8ABF6000-memory.dmp

Download

memory/6088-350-0x0000022D8AB90000-0x0000022D8ABF6000-memory.dmp

Download