7cb36850d79b44faa548002eb817bc79974380f81810d12b1b8325e4c2cc7a51

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260808-d5th7abe54
SHA256 7cb36850d79b44faa548002eb817bc79974380f81810d12b1b8325e4c2cc7a51
MD5 53401445cab15c9c4291a0711ba1c69c
SHA1 ae403aaf11a0d887139f511a50e8cae29653c572
SHA512 4410279e37b4e857235de58836d38ba126c0edf5a68cb62f0a8def699899ed6dde8d64ee6c36cceda8c98e4db424f50301e5fe191b587dd269a69f88fff30ea4
SSDEEP 24576:pmewsAjQT7Jckdwi6i9bNrqq4E41WFpW3oRos:8ljC7Jckdwi3N7+WTW3
TLSH
T15615E031FA74E436C37B0DB21B36D716647C7A204F612AC3E3E85A9D59342D22376E26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4192	alg.exe
4440	elevation_service.exe
3448	elevation_service.exe
4180	maintenanceservice.exe
3504	OSE.EXE
3032	DiagnosticsHub.StandardCollector.Service.exe
3028	fxssvc.exe
4316	msdtc.exe
2968	PerceptionSimulationService.exe
2468	perfhost.exe
540	locator.exe
3328	SensorDataService.exe
1552	snmptrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c5f29586905883c7.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3764	2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	4192	alg.exe
Token: SeDebugPrivilege	4192	alg.exe
Token: SeDebugPrivilege	4192	alg.exe
Token: SeTakeOwnershipPrivilege	4440	elevation_service.exe
Token: SeAuditPrivilege	3028	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_53401445cab15c9c4291a0711ba1c69c_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2532

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2968

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3328

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1552

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:1248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2708

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:3160

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2628

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1456

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 37e3400dc77dd9d4c40a3ecce9efd502d92f80345016e3b46b26c5c10e4bc08f
MD5 fc7a9f78cc01f9c0955d3286bb581ef5
SHA1 967e189d3923c6b08a9306d40467c269bac9f4c8
SHA512 314092aecc8e315a848498683d52870062aa0497d36303c44f4225c9f370788b8a93e04eade28835de1a6ffd6113c507a5ee0f80fdd346196edd7b0a78b9d326
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnJ7Jckdwi3N7+WTW3:L3q6gjBIPdwi3Q
TLSH
T1AAD59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 410e01ae77a12e60bb4730269ae23377f1132c52f2b4cd660258e40f23514acd
MD5 090fd20bb681d1f041c5743a5026dbc9
SHA1 49946fdaa8adfa1cd32a9fc9bea4aa727ce57ce9
SHA512 edca354f18c10e02782e27dc0f0a55334d980ad6d93498e617eb86f9b0849d475f20a57a01eff47113e4790154b75f226df50b5203a6baaf475e49051c1ef5f2
SSDEEP 24576:TXYHDxczAxfT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcEb7Jckdwi3N7+WTW3
TLSH
T198050128A3D509F9ED678239C9B2C511EB7378514760FB8B03E496651F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7abb0fb623e78bfc066e636d5e02ab16b0065bdf6178bc23bb5977efbb2bf83a
MD5 5d87ddebe2610f447034974a79138d48
SHA1 960eed84a89fcd934b6001bb49b04d0f505b49ce
SHA512 7e1253943dd4db6a7fef8252a833e102f7aa3de8f61503408c4388937be09119c5fa070bd7f36d78c804797e0910d0a79a3726adb6bf38d8567daba48e79adff
SSDEEP 24576:T0Qeky90nlxOrMsZT7Jckdwi6i9bNrqq4E41WFpW3oRos:T3y90loL57Jckdwi3N7+WTW3
TLSH
T106359E16F6748335D073C0B9C5D2A69AEE7130825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 aec208ef895125cbae0df26779acb37775aab3045d7384a288eec0467812fbb3
MD5 9fdebfb2264fcf711645ae32bb459193
SHA1 b4c108b36310b223ea3cf0dff5b8fba98345927e
SHA512 684ab72c91d69e9132d0936c34ab6d9a129abeecc04e5625a65b003c92c5fb18dfff5f460c01fb2958a4007a23804dc259687f3c38b4653a84d7fa274b0f4703
SSDEEP 49152:I/ezSC6vUzPvuHjyl7Jckdwi3N7+WTW3:8ezSC6v2XuHSPdwi3Q
TLSH
T10B755C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 54e24c7e18ac21d847e3439f953dab4a1ec7d956d8ae3b786a1ab5ae35e02c0b
MD5 5a0ba620feee4e0ee7590b9f29d63705
SHA1 bff3e8f69e8e5f4a91f3f4497fdc2468b713138d
SHA512 d6ff438914ee6d13949b91dbcdbc8a3484f736ef7b3b3adf8d5f37e313d101e2042e63f3a94a7f30bc4569cb4bb4c5704a4992981bba27e84265ab240bf68d74
SSDEEP 24576:eabdPWwkYv/l+dzT7Jckdwi6i9bNrqq4E41WFpW3oRos:eaAwkYXl+R7Jckdwi3N7+WTW3
TLSH
T17A559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677D6D73A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 c2746e00fd45aff051d1540f9371f44f07f7edf51fea8b90e8560a90b6f89d4d
MD5 ae806def98f982388bcd7e50693030ed
SHA1 6daedb917e65d8f17cb5aa4f4b8245e0d56f0709
SHA512 d547aa3b3421aae16e55cd01ac05e426c1914a9088286935be5bffa69d85365f9607729d38623936bbeb8c501eb36088536195e53a35cc2745eb8b1b0ae178f8
SSDEEP 12288:QU9GT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:QU9GT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T196D4234CC65916ABE3A7D231877DE6E8FAA42E423855BE0547A473E0543D340B78BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 47e00d25620d983466d26357efe85d9dbedee4f5da2be6282e24c3038da05355
MD5 ba869b8963ab37f87cd02177ea748909
SHA1 04f656eda7e0442731e442661451eca1b7c781ab
SHA512 4189169df022e6dfcc32cb7fa4737ea4e5bcbcd07a413b737ba3f06596786270b62b73045841c43725640275b17d441b2128931e28bc3c490525374c9806afaf
SSDEEP 24576:TRIUbT7Jckdwi6i9bNrqq4E41WFpW3oRos:TRIUn7Jckdwi3N7+WTW3
TLSH
T17A15CF2BEE28FCE2C27A9D795751C640E7B278314F62A3CBD164820DDE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 d04aaad446eae618fca4fa938756fb9fd058c02e836f1bc7fed0d15449047e05
MD5 0c2f960432266c54de2cef51e1255cfd
SHA1 b722659da2ae5a2c75f82218b1a99d402fc4b2d9
SHA512 063908fb535a8f87c7d36bc56a667d670fe275c3b8314210550274056ae6dfb7c8783b795615bdf76173eb8b85ec68464975588d311ddea91814798f4e8d689b
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3TH8:DQvGAdlCEL8c/NRNw5C0Pdwi3Q
TLSH
T196367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 00a277a69f65e580240235d2c38972b69120f1e6bd37f112a5fea524d36bd695
MD5 5ac929dfa2a4f73dcca31f09ba2517a4
SHA1 25be4fef060eef32cf602639143d36f16a4ee7a0
SHA512 612f2e4f8d109644e69ac1d21bbe13f42eb97ce4633b681414f0eb2010fc01438d26a91c2f5c798ea0363d6cdc5a35c9695c4fc12c22bf86e3f012f7c47efa0b
SSDEEP 24576:7mewsAjoT7Jckdwi6i9bNrqq4E41WFpW3oRos:Cljq7Jckdwi3N7+WTW3
TLSH
T15815E031FA74E436C37B0DB21B36D716647C7A204F512AC3E3E89A9D59342D22376E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 5.4MB
SHA256 a30ebaaa22f907b5a64613aacd1363afe4edc652a8535ee2f1b530d73560108b
MD5 a8c73dc6497ae999ecc42a749e48aabf
SHA1 042869e5ee428a4022cb576970102d3c41c208d5
SHA512 b605276c03c979723fd03baa4fd4b086de8ce40307d78e8c71c1aaf711a1891bba5ecf135c48fcc7d035c6781af9fb02cfc993447a571dbca5392a15258d7943
SSDEEP 49152:yYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ86fHxq455QJ7R9+Ju6am:pVJ3MXEJqyQdetVbvC+2K
TLSH
T153469D9657B801FAD56BE088C79B8537FBF078060534A78B46B1CB5B2F37A315A2E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4373f2abe395666f7cfab8ffc43e0dde7eddc1c651ac477567eafb793bda5426
MD5 86e17465895cab43605ef2315ec3ed44
SHA1 538ba852c1264fe56817e02e2795269731f71027
SHA512 f49badb6c7283edfc74cf0e91716dcc6f75946d4120e60e01866ca266fc248b35b6708c7f647182e20213aefe8796489a88a46cae174202f879a3b8f4b9d0bd1
SSDEEP 49152:JKbRquA/m2yL5zM9FiV+XenmE3/zd7Jckdwi3N7+WTW3:ioqLVjnmcPdwi3Q
TLSH
T1EAD58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cf13b0904cddbfccdb8a774da1041a8d549ee1199feddb45168c529ff2ecf084
MD5 7bc305d94ee4b4c1ca3b3ba87bdea2e6
SHA1 dbb9a98b5970d54f6107e6cde9321d75a3ac34d5
SHA512 e5d526cba68484b6b776e47dd8cf2ede74673924c9847a75b95561d1f3d511fdc4c2198f1736bbe310b6ccb9d83e1c8d1dff863998b707c2ac33f53d8ff93f4f
SSDEEP 24576:BAhGLvbFoiwtA5l7S53KT7Jckdwi6i9bNrqq4E41WFpW3oRos:BAMPFoiq5w7Jckdwi3N7+WTW3
TLSH
T11945AE80E7F955D4F5F3AA7899B69170EA76BCA65E31D20F1260D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 9bd329198ecb66e615a99f408d6fe28da18fbed877b2415ced26b69e19186217
MD5 4d6a98681d6edb0d3318a075f23bf6d7
SHA1 c842b629c7aac01366696a8225fa8a60dc019835
SHA512 96db7a9c4fe7e357765d4bae954b6c77504628b5ec257963044c6393132eef99852d291c4ae3ef29b83d896557d73dc5084576e7bdd02a2a60ebc0b2bb034ee0
SSDEEP 24576:Owu+OWyT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOD7Jckdwi3N7+WTW3
TLSH
T10E05F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 1f32d5581c8ff6457b9c47ae367956396cb351ba914a949d402c9a835001b962
MD5 315df979e23781d8e8189f130862d7ed
SHA1 1674ba67fbe71a1ac7feab05b5c372fbf3191fc9
SHA512 4ec917592112b397923aec98637cee36727cc68118b4cd15c30f26f08fd095f3a51f6deba6cbb562b7426419d131682fa133184d4bdca73a7e2dc7492cc6f36c
SSDEEP 12288:FXL1IBXT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:pLuJT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1F9E4124D23D421FAE2A3D239CAB99644E7B138532775A7CF066443A41F277C16E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 2.7MB
SHA256 03c945afd19d9f3a49d7dda20bcd41886a951ece78fd389c17947f55b68d0583
MD5 b8f73ecf837dfcd57b2e78e9b7d883a9
SHA1 b8fbff78cb348050b2134e9ac88bb51eddc76279
SHA512 8480c3431d1c86c9b65776872f5102df9cfd632cd77227950564fa40be97fe18078a809374684ee155fe77027e758dc0175cfc3d9e934c9e304b5491c2d63d3a
SSDEEP 49152:CJsdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGe2:rQRQyi36YOcP2
TLSH
T11AD53A97E36211F8D80FCCB4576D65629829748F5734A3EF09E84A721672EC96B3CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 3.0MB
SHA256 852063065703908233309b8eac04ee2ca88f4004f0aa7ef03de0317f710a4a3a
MD5 a109848b7b2dc0520647e3740aaee147
SHA1 c38b61c0c8105217ceff61b63f9db7322bc0729d
SHA512 1c931d75acaece3aff0f95f1b6e1730a06d5cb34e26dd9f9505d7866270e9fe210d69fd70b441eba6b733e22a99eaa331d3e3a9186ae3da9350b8d0ccc042d8b
SSDEEP 49152:CJsdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLS3:rQRQyi36YOcPP
TLSH
T1AEE54A97E36111F8D41FCCB44B2D6522A929748F4734A3EF09E84A721672ED96B3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1e4732e10066392029629a71a41b47ac168567c3e9e44b106f1a832041933957
MD5 fe3d3dddd44866ef6974b382333756ca
SHA1 a502402afb55342cdd55c3e72c22b47aff1ca920
SHA512 3bd27d17e1790ca9aa09b810f2ecbff342ad71d290694b4bb0d3721c7f61e9bd30f0a1d6fffb31e0d2894aa2366696cfe2e983ba1e7d1837c5560fe80088df47
SSDEEP 49152:E68Qg55nhMeWu7PNU3/V7Jckdwi3N7+WTW3:uthbRc/TPdwi3Q
TLSH
T114B55A33B2F600A9C44DE1769F4A873196E17C718FE0E3DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 3.6MB
SHA256 9e76852d041b97485e5cacf03e71f072038a965eeb66b0331201f7ca6d34fad3
MD5 55bdc493de9fc680442f74a76d944960
SHA1 0753db271111eee3c5317c2807bf2d0b3ff82a77
SHA512 4c2d6326c03cc3c2eadf74b72e1ff6e49079d43cd58a0bcc53da75524633c119e8793c07aea5871c18690ea6261839f00b06a9b6410e52fd07b30a9466ea1397
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99I:ny5112gYy5azzVv569nLKnhZqPdwb
TLSH
T1A7066A13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 77e084d9775c3db9952c2e0c9b2ce151631dfba72c579bb8f090e0dad2345491
MD5 d6ed011ed06674bc147c2a2d2d4f3957
SHA1 a97d24997e59b612a93ac03ad49c86d2174c0615
SHA512 1bbabbbad272a6f8b60e83bcb1cb64b90496024b457c281a5a8e14ed4a5877ca353c18ad549707931845a855d8f87ff17126e64876142ba80d9850394e7b740c
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1gli7Jckdwi3N7+WTW3:Hu6JmTxd2dwPdwi3Q
TLSH
T101D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1d251101f70acd413eec0d946a21bc3fcda5cb20aae18f0b03c496c1c6239962
MD5 6d52591c5d6bfdd9af7f5d2f7dcd8a87
SHA1 2b3205fc7f7a71e9f39e490097e62243d1403b55
SHA512 38079163e87e36f2ad656cf74030adfaacf2b3621fbe28ae9091492fc9b6c1513d3d13b0161aca62abfa6af0a56ccef5cb5e593834c8af3d339f90c25eea0f47
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x47Jckdwi3N7+WTW3:ImifPbRXPdwi3Q
TLSH
T147B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7951F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bdcb6a1ca9e5857416fada3818cb7ce93fce7c7e90bae6e19db9275808b5ca18
MD5 9215da42a1d36f8ebfb2860ae4895846
SHA1 ebaae64937280dc10d4ca93abec1b74771fb3ae8
SHA512 8de6087e05b544a63fc858e4f728ab1e5e8196a720e16022cb542a3c7270eb0dc8e46e67013583924571ebca907c0b34ce58bac51ce8e8150d4191388546daeb
SSDEEP 49152:bSuZQIY0Be2K6RVtOnks6NMHqT7Jckdwi3N7+WTW3:J5dKoi615Pdwi3Q
TLSH
T14BC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2cfd8c051c85b11c05c6be3c4e154f66373cf0a970df35aa23bae6630d4a9538
MD5 fd79e0a0532ecf019241fada318bd4b1
SHA1 63d9dd1f1dbb62e4c72cf893e4069f76451f6f73
SHA512 60d30f5d7bdfa4ce452874a58f248178ddb6a6ecc43f6582ba8d28f303200f5143a61e5885d635281f04f8c816a379af0b2738760960334ede9109770ea498e4
SSDEEP 49152:PPSSn8EApI0figTgiDn0AP5w47Jckdwi3N7+WTW3:zX2iyphPPdwi3Q
TLSH
T190A5BE13F2D900E8D05ED174C7568632EA62BC060B39BAEF0A90B7551E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 dd4bc1eeeca4f220fc840f9f215f9197583cd49e8b160f1fc80d192725e73571
MD5 ba5ba1e41486fa7fa299a5e4ce91a560
SHA1 851aba5174e1643c41e8a95f738983a4ae90f0d5
SHA512 53f6b2322a0a006df0556a9cc5315f3916ebd8388909c7c521833193e02794bbc2b6815c0533d68798c89636d7e3e46de238743ada8059a2d66514bb4121fac8
SSDEEP 12288:7RT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:7RT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A9D4234CD65A47ABE353E232C33DE6D8FAE83F437955BA05479862A0551A340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 2d4426da73525d93d97983d297c18f754853aa39b339fefef6c3c57a8d9e5a11
MD5 471d7f2edbc89a7592ba8f2f4730b2d4
SHA1 2aa99db3425dfe7413b829f5918be8944ff096b8
SHA512 262f101dd4738af28e6bfaefb3ea34036aa45794a53fbfc41185fd75066bd21cf4eb95f5ed4770c4ab54d8721a5d410ec917671826360371b8188aa472a1e49a
SSDEEP 12288:R9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:R9T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T106D4234CD65A06ABD353E232C73DE6D8FAA82F437D59BA0547D862A06559340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 86969e34d329dab46b4da6e09e97e41588912fa3f7f71bd021661fa86a96647d
MD5 bb23b64f0c562032f0511ac44b385f0a
SHA1 662ff003546f2b4df5d1f2281025786ee0ed20f8
SHA512 b76047f28a4524b59128bf9e019f9e04915b36c34c674b9d0019812cce47081872f21f70d889f0c3887e7f08163c99a92ac1fab376321c6423ef52fbbebe5a36
SSDEEP 12288:TfT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:TfT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F8D4234CD65A16ABD353D232C33DE6D8FAE82F437D55BA0587D862A0655A340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 6e390bc4270bce19689594d6db36c2b8b0d6429ce2250d85a938add5fa6103d4
MD5 5b89ce8440fbd5f09ab959560cf652aa
SHA1 2560d2e03d51cfa7c65b509aa2d83dc4ef7956c7
SHA512 3c1d855de981a4e492a3cd21ae3f6c55f7e77bc2eb3694370c68c9dbb8522b84a1a25753b513e8e368e8f40dbccf396fd6c6af5fbd7548cf7445a2a83071e86d
SSDEEP 12288:Kl3AT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:KAT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T19CD42348975A02EBD663E231C63DE694F7F83E827A35BB4F879012A01D66340775AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 e4c1a93dc6c5840579cf9271e9f4b704278c2756e0d0221336dd2ef4a7379882
MD5 ef642c47e7939aee42921e569e7c07ea
SHA1 c75093447bcf8ad4cef5b5007fba61d61f95eb82
SHA512 4e9adf9ae68bf05577889efc92b72c460688c59dfce5724473a3b1bdaef30539ca0749a8b3f4ecb3e62f374a75c76c9515d0bc96f9bdf1602705c9606894cd30
SSDEEP 12288:CYT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:CYT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T136D4230CD55A06ABE353E232C73DE6D8FAE82F437959BA05479862A0555E340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 312b21d7d79c672f80c4bbec9db2853bda0485c32976aa5b30706e3178fc0f5f
MD5 c9ac89adec5ce0e5684cbffdd10cdf2e
SHA1 4e7d36a05c32682e5a0aeadbc736abffcaf72f39
SHA512 895d395c53d3ba8599a3d4527f3c35e63d4f64c2ebb9e84ee886026dd084fc295445166502c6d22f0daa3f3b6371325018fd6425f36aeb4284841c79e645326b
SSDEEP 12288:xST7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:xST7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T132D4234CD65A06ABE353E232C73DE6D8FAA83F437D55BA05479862A06559340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 1d7043b07bec1eabc9314e93d26142d76135b10eb525ce9c194f77d8b1740217
MD5 c36d4a6ae568972ff22050dd0f44ec78
SHA1 aa6e454a4c6532f056444e18e8f7bc6abdfa416d
SHA512 06195515fbcef47648ec430da893a1af07457b945930e796c9168ad1dd656b0bc9a5430e20eb1520330249a0f28b2dc7d9beee4a97b8bc8f0b09c58c4054bd0b
SSDEEP 12288:e/T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:e/T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T138D4230C965A066BE353D232C73DE6D8FAE83F437D59BA05479862A0655E340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 b082e0670bfb7b792f99b96ea4c4469113fa846e60990d52d585cfaa3a76f69c
MD5 14eea4c0e9a76d5d373614eb0eebfd2a
SHA1 6a9b018ddd186746bb6c73ca93740c63f6f4db23
SHA512 7aa5fa8e16ba8d5db0de046540d4b5d5a589252ae746d9fca4d32309c8bb87dc3d5b01cc1509a577e05e831a484a469cce3a50a7f513d2e5b50ea4763aa0adec
SSDEEP 24576:BZMlzFVSjaT7Jckdwi6i9bNrqq4E41WFpW3oRos:BZMlzfb7Jckdwi3N7+WTW3
TLSH
T1DA150298B39018F9ED67823EC9299945E6F27C561B70DA0F03E432665F333901D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 6238996febadc154ce5d1fa153719ce4172e2c8576995670595d5840109b6eae
MD5 ff4869d271ea310d4e4263b2d7517d9c
SHA1 ddb27573fddaca1f7f9ebbf9dfdb5929e7828fc3
SHA512 49ef58cb8e6607bb6aeafc33104f4a543af398ec1546b6a0d4c9c4adace8a92b88241ac2db16ada874f8abbd3bcde1944378577d8c9c3d4b495bf034aa9b9e22
SSDEEP 12288:jwYT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:jVT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T13ED4234CD55A46ABE357E232C33DE6D8FAE82F437955BA05479862A0651E340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 d1eaaff21a73924a6dd973f486d339501db09abdb383f7035e83f2798f5cc621
MD5 25cceb337d0120f2041d25725a60dfb3
SHA1 9a8d4156652f4678cfa2509a052b74a8bc3b75e6
SHA512 18fcdd0ebd71a657c54f50b980543838127c5f8c8fc9afcee2ef02ee2d2ad3b2483b8880c9df7b3d09f844d0dc8a6fd36165d9fec236a7f8d0bb05da3182935b
SSDEEP 12288:ZTYT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZcT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A6D4234C955A46ABE353E232C33DE6D8FAA83F437956BA05479862A0655D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 45292c5d4480b9ec3764f80afe5be6f26ebf49766667f9b4728d64a74b54dcda
MD5 b41aa5f6827b6dd12eaa41583ecc7a8c
SHA1 98aa5224d5dbba573b5ba9f21b7779526644de8c
SHA512 3005f1b0cfa3afe6f93b52ddf5c512b2c4bbbc7dfc298e7c6e664a4dc2c301c6eda0d6f210c5e5212c44ff45876a3777ba3b103ebc55e73e71026d4c7755de0c
SSDEEP 12288:BuPz5LAhT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:IzyhT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T141F4020B63A521FAD167D235C9665A45F7B578321B24AF5F03A403B52E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 3cfaec22ffcca60421fdc9fc5b09ffebed2df790d1d06f471abef699455b307a
MD5 75009e29a732df69cc066fa17cef26da
SHA1 c1302f0a671e6c111550c3f4763cb687834cb380
SHA512 24300d073405e691412250037d61d7c8ce144cee65e5540643058898015e10b89fe04526018e9b6b11fefc20297c6cba90b8ab7ea42ce88c93a55422509e0e98
SSDEEP 12288:mKO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:mz9PViR2SQ9LT3DO33k1rd868k
TLSH
T108D423EE30B49255FE0852BCC11BDA8A524496D6ABBFAC713FC2911033CBDB54932DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 df6f6e8a225bb91eb62990e672ffe6de5b2e3d32499ed92e19f96041b0a3cd5d
MD5 eac6b39cc184899e11b07ecb4d689a1a
SHA1 9af32ce8573170683dee8aa32af32ccedf697020
SHA512 62fd04223eccb22684dcbc1d6c4990b3300570be1d31ec798eca1dea5385f6b2f354cb3b34eb4f76a18fc61c141561785263e5b35dda3553db035860b814e547
SSDEEP 12288:uUWO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:uUX9PViR2SQ9LT3DO33k1rd868k
TLSH
T15FD423EE30B59255FE0852BCC11BDA8A9244A6D6ABBFAC713FC1511033CBDB54832DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 be68f88b792550defe218feb6912cfd9cf1816efbf2d4cc98a28a9c50a210044
MD5 a2342c2137269200b31ccf9c0178e51f
SHA1 0ee059d5fac8b381a26ca200e0d52208607524c2
SHA512 753a1586a6e3c54af26d5689a3f33ca64d8cdb08f197d3526b792d3ca917aa872ddcf167f7eb225050ce4c0907d80d3e60ebec6030514de6451e887cb212b0fb
SSDEEP 12288:3yPz5L8VO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+F:azyw9PViR2SQ9LT3DO33k1rd868k
TLSH
T1CBF4125B32B130F9E5269278C8535A42F371B8720B359E7F279003752FA7AB15D36BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 4bab133e7eff5c0c9db0f27628958ee411ee84629b825dadef8da654c73e8829
MD5 41a517bdbfc15c33e38607a2393dfbc5
SHA1 20e665b01937078b33eb2894d59389f4e566d89f
SHA512 6adcb6c3add44ff43ae9042ebd33fb7955884827ea48a3c82d405f5f9296bd6e52b64112e58a3a0f3deafe0fdbcf3bc6402658d272edaaa07f8a2fc0ed3e35a3
SSDEEP 24576:cTkaLB3z0zmA9PViR2SQ9LT3DO33k1rd868k:cTTLBjojrG0xd868k
TLSH
T1D71502A973A018F8EC67813DC9168906D2B27C5A0B74CA2F17E432665F737710C3AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1024KB
SHA256 72d15753949d4ec5ac8a0d3f6e1d40f7815274b400a051b277671f859e6ad19d
MD5 f35843309a33a754024a0a8c2a8c927f
SHA1 9ba6d601aa760cf09481bad647afd87b38f5e671
SHA512 0a8287eb644f9f31b5d55c7a3d5aa83f8bfc1d9eee14451cf6f1ed0fc75e9d1c6837fac3e88558e9a554e0ec038ffcf665d8109be9bb8721f802f37309e12022
SSDEEP 24576:y34dcCH0y7wZn9PViR2SQ9LT3DO33k1rd8687:U4dcCH0ysTjrG0xd8687
TLSH
T1B825CF90F3E410E8F0B79A35C9765511DAB67C9A1B31DE8F1394261A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 9406cce5e9969ec6f5bed7249e875e6fb871a76b598a33a76d09cd382204082e
MD5 7f68b479fa1d15c672bd21c2687aea3b
SHA1 9ef9cc0fdfc98ffa43261dea2bc638815f72bc9a
SHA512 f5f068f67139909dd088b4161b71b2782477779a5c560326cfb2d410a98e95d7aadbabc01ddb44e9d92b3b9627d3e9af3202d44192e5b73ea5ac7a5718acb19b
SSDEEP 12288:EmO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:EH9PViR2SQ9LT3DO33k1rd868k
TLSH
T17BD423EE30B59255FE0852B8C11BDA8692449697ABBFAC713FC1911033CBEB54932DE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 ed73abd32a8b30c7262f463c150d4e54b78c74da6a269faa481c83f08ede3007
MD5 7f6b1b717aabe4c682dc68dc8e159d4a
SHA1 0f92a31ffd2f44d08e0d2e102a1736d8b238d66d
SHA512 16c87f3f50255f621de23e96c6755e3ee382a78a3186332728622993afd013e768807e8fc625bb7ca0510e8f1d9e24ff28227dd85228b355a6852f30d58af664
SSDEEP 12288:+6O2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:+D9PViR2SQ9LT3DO33k1rd868k
TLSH
T14AD423FD30B49265FE0852F8C11BDA865244A696ABBFAC713FC1911033CBDB64932DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 fd60e90ac9744ee766f11aa10434731efc2364ebcd79bc99e7e78098943795c8
MD5 821468eacd9f1529a0fa5c70916e65b1
SHA1 0098adafae10c24794d41d24e5cf4e81a4efb794
SHA512 77a9e8044625858b2f74dc357bc8ef4da85b0804673933b881c3af9713f4914833ab23fac4846bf309337949ef0b32c903746717bbe93aa92e442b78072d9381
SSDEEP 12288:HWO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:HX9PViR2SQ9LT3DO33k1rd868k
TLSH
T144D423EE30B49255FE0852BCC21BDA86514496D7ABBFA8713FC2921033CBDB54932DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 f6fc56fb6dee32bd2d6c2718f06bd861c94ab56cd633e5c6bdbaf3ba1a810fd2
MD5 be573535cd3a962df1ef02c2d605fca1
SHA1 4a9b902657bc46d8dcb6e6f929c5c5659cdef133
SHA512 6cebcb176820596dc0e1a3d65b86f372f8c53ea20fd189c98d4e5a80bbc7a8f1dd26e60f8c154d7e84f952454aa88544ac8e1efaec2b6b62a2b4311c4efa01a4
SSDEEP 12288:AbO2A9rEwPV4vBfRBS/aQ99SWT3DOGfQ3X3iUUGMfVrd8Y4rfEFks7wL+Olk:Aq9PViR2SQ9LT3DO33k1rd868k
TLSH
T119D423EE30B49255FE0852BCC21BDA8A514496D6ABBFAC713FC2921033CBDB54831DE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 719KB
SHA256 abde22752fcfa78c780f35a8e5a64405fe89b50d7d3ea469f3ad85879002cabf
MD5 39a89ae2c4b3fd0f19979e93211ccb29
SHA1 cbde4f050e780d22b28c127c235cec41270b7425
SHA512 1110783bd617f525406cca35735029dd500af9877887b675f31ff85b74a7789bcf4b3ae975bd6c9c17d58264f8632d1a8c7481ed16bce09afef9f03b7948500d
SSDEEP 12288:Gpsf4T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:T4T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T113F4F009D25802E9C16EA235C7699680F7773C2257E1E7CB42D0F57D1F7A2806EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 cef17ec82474cb0a5577de01d558ec43037bb40ff3c5d1c1364f34acd7927905
MD5 bac22c9e6e6a9faaf42b305413f322af
SHA1 1f9e37371e994aedae2d1f1ed4e4b9a19a59e3a6
SHA512 f5273f6a85006ec4cbcde106a496aa21683f0ed96969ace440c1393403f9d4342e50994f9442a54781451930c71666facb803b5a61f732a994c0bfc8c3e4b514
SSDEEP 12288:rNT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rNT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T146D4230CC75D5A5BE2B7E231863DD2A4F66C3B123E55FA47878422A054293807B6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 f215747027197bbd268c012745221dbcf0fcdd36d617d2b9376ecd7767edab88
MD5 9aa1d109b60a4ef04524eda880bbbf0b
SHA1 44a6ee800780a9f69fcc7ce504b731364bb04ca3
SHA512 b6230223da529b856ae40058e756b297f912bb2c66932ddd34cefda3e1b562c9f38af27b62cfa222e2998932c8f8aa349b3e7e5ee23be16ff9d6b2c86f0ab824
SSDEEP 49152:Ca0h2GEkuAe73q3ppt6zwwQo7Jckdwi3N7+WTW3:Ca0hNYGtJw1Pdwi3Q
TLSH
T18E85AE1D67EC82B5D0BAD278C9A6814AE6F2B4221B3156CF1151853D3F37EE44E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 677KB
SHA256 6325f11a3dc024848b84e2c2cde2e3a4354bc00fae460c1d899258079cf8b2d1
MD5 440576e471d7d07a8831c40eb3aa32b7
SHA1 385bf061267c231cc11879eafc272afb25b23118
SHA512 f5bb28bced7b044bd744a4e2917ef699b9b0263a1504484e64762d186e95b516c79c93b76448600b067d32d883c7e79da324556bcf81715f10ec40441fdf81ce
SSDEEP 12288:rhbHjfX1T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rhbHjP1T7Jckdwi6i9bNrqq4E41WFpWc
TLSH
T162E4126D16AC11DAF272E27986698649E7707C122B21B7DF13D182780F2BBD02D3AF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 c143070e925766f37c2721e9254d3e1523dfeca848c9ab34d2fea8b92d0351d4
MD5 c074caef4b0551fb0e8a34414a0ea791
SHA1 55414301975faa3e0a7d03b99072ac3980068f31
SHA512 61d35c4547c9791b9f64740d99050d968095deaa075e8d1e19996d477119d18cd64007e6ef4196c0abc78d859633acbb7b984514ea61fc170eb47e6ca37c2610
SSDEEP 24576:Nubg7acRTk4yti+R5dUR/OT7Jckdwi6i9bNrqq4E41WFpW3oRos:NCg7bTk46pUR/07Jckdwi3N7+WTW3
TLSH
T11545BF2DF2B910B9D8A6D236850147B5FB71782D1F209ACB0170C638AF1AEE45F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 596KB
SHA256 bbc70ce334919a327253826ea2797dbd6c80c302ded3d5961954440c506344f4
MD5 d024a95baadc4df40981ee508cced54a
SHA1 58f456ba155ba59fe759d598d73398d285ebd4a6
SHA512 acfd5f48f8e20760821ffc9aff552dad392404be10302431a647b152298489bdac7cd8c1fbfbd0a7207f5fe229e404e78dac35d475adcf8fa9737f2a5c8770a5
SSDEEP 12288:3TT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:3TT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T12BD4234C92494A6FD353D231873DE6E8F6A83F033A66BF4246D462A0655D340779BF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 959KB
SHA256 ea1c453f86812c69e00d8a3a7a3526702782e283efd00dec155c75edb38d786c
MD5 cf8212ff7fa1ef4126a6198652757c56
SHA1 ae5eb5ce3bf77783f4a5cd58cb3bafd29703cf85
SHA512 5b3a0e553fb148bc0e21a92fde293a2b77d5b037cc605f12eb41d5755e29ed5a74eef3d5af7d1b4eeea7f671434d13de8afb76891d33beb660735d6ec906cf02
SSDEEP 24576:DeLwUTOT7Jckdwi6i9bNrqq4E41WFpW3oRos:DeLwUI7Jckdwi3N7+WTW3
TLSH
T1F325F148E79400F9E96BD13CC9769A16E2B278591764FBDF03A84B651F133E14E3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 689KB
SHA256 0c0f6226d4fe293df202b572ff380e3f97390aa90bb5f74917c5e982adfde5bd
MD5 5f9f3e32b33f83b32f5d0d6a76c4d511
SHA1 ee46be34a635d407e75874e0d68acb00dcc6a11d
SHA512 9fa6c5a5f0626e83cddcab761533db398f4ee2bb99f74dbc747efc78b5670bd76c5658fcc3ea58ac181b67895acb355fea6600500c8cf3cb60eaab3573369749
SSDEEP 12288:EpFtzOVT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:EOVT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T139E4021D32ED10E9E176E1398666934CE3B178621B2267DF02D081BD5F67BE06D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ea404f9450c38824f6d2e4eba531f68490f403381316b44d25f5863b76cc76db
MD5 d4ab513ef84e95d98a0b6024eabe7f6a
SHA1 4986102fdd3de73b8cf4d75732f0a19c91577806
SHA512 aeb52730f413ce184712fb20196b30a9b2a77f6b27d27725fb875b0e802151a38875164b43c564610c78693e0df373bf2b0b39919642cf65e76661defd5c2723
SSDEEP 24576:47NM9YeZqmWMUkPjZM48Mv6bEhszT7Jckdwi6i9bNrqq4E41WFpW3oRos:47cBWMpPjN8DbEhW7Jckdwi3N7+WTW3
TLSH
T1A465AE1E6BAC81E5D577D13DC9A28205F6F1B4611B318ACF1162833E6F37AE44E36B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 114c03445821c55115dff1b394287bb939c4d65f101be25dcb5981e0cdb9ec5a
MD5 cb64cdb750791018e32a978402d68a16
SHA1 d462fc95c58be675dcff377c0eb201ebbf4aee24
SHA512 bdb692b01e3909d815c7684ed7bc39027cd81c9254635466964d532236ccf41f588a9f9ef6ffd93848caa2f263a88fe01df142a9bfe6d0d040cdc07ef7e2c9c5
SSDEEP 49152:MF2YuHNETovIvNYf8km07Jckdwi3N7+WTW3:p6ZCf8kdPdwi3Q
TLSH
T1A7858E2927ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF45D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 60202da6ab742f77a2af0797b70d330ad868137c3f914dfc1165027ad4249f71
MD5 f8e6faa462033bd30eaf23965c79a444
SHA1 b2623e2e526bbf1b0e402a1561e5367c05e7cda1
SHA512 1d5b125bf3859a81d4c67038956aa7868c4cdaf52edb92538afb2b9295f0f2e9bbc8ab23fe41028723b5df7cf1c64fc49024a7f95b46480efe6557ff4a9d9f91
SSDEEP 24576:NAFs06+OmlfzNXEbToRT7Jckdwi6i9bNrqq4E41WFpW3oRos:CFs060lBXuM7Jckdwi3N7+WTW3
TLSH
T1B965AF2F62AC00D5D07ED17D8A97C91AF7B1746307256ACB0260867E7F6BEE41E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 903KB
SHA256 0cfece7b958998c0f260b38d47ccec598cde45b8c8a5a0d77cbf66cf08e7c2db
MD5 64ed6080d9f20ea2b1b9c5474bdce160
SHA1 65f1e800d2d738a018582e1dfaee054cb10613a6
SHA512 a19e3d7602db1f02c4c7a75c2af32c9b52003f4b3d1cb853208201c20020fb83d108e91bb2296242a9bddcda4eefc6d8a7569e901cda357bdd9e0b43bb45348b
SSDEEP 24576:lJnJ5D3W2pT7Jckdwi6i9bNrqq4E41WFpW3oRos:lJnJ5DG2J7Jckdwi3N7+WTW3
TLSH
T1F215D02CD2A810E9D4B7C274825A5795FF72382D2F226AC718B4D5353F12FE0AA79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8edbd65e3e2378d34155d8f5f82bc248bc85e7a94efd84904a83a32997238451
MD5 5976b4aa876aa6177e453f948ca5307e
SHA1 ccf77aa358826eec1d2be15fefa4d1f5c9a8dc0f
SHA512 cdf4cdf931a9cafcc86f69777f5d5387dc928707f96acb05a4e84362f6439e30c240494e5a4d3842d64f7b15e100300533adbcbd5aea90ffc57e99cad88074d2
SSDEEP 49152:5F06DIKdwc+eQnSt65aVc7Jckdwi3N7+WTW3:r8Pdwi3Q
TLSH
T133A56C05B7EA5294E8B3CAB1CA62A5159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 678KB
SHA256 bb7f960ac5739c501dca891b864bcd80242c2ab5559c7c5bf87b6d6e9c0a4dfa
MD5 245baff84e67d249c648eeba1184d0f4
SHA1 a84b7469c89d8765ff6d6ab8932c1391731015c2
SHA512 78dd93b3acebc13521222fb66195785a1096e31addf25874a13c1870b49023fb95fe754167a25121aca94127a5336d4fb4d3d1642517166091e4f52135c8de5b
SSDEEP 12288:uEP3RiaT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:NiaT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1ECE4125D679D60EAD127E1398665C648E3B1F4612B527BDF06D0C27C4E2B6E02E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 730KB
SHA256 4f6c5811ed4a960ae28d0af4e56a2fc746d69c085ddc6789b621a1d7b0246b97
MD5 b3558514ae55542c75ac71b22adacd07
SHA1 60a3d24be60bcb61c6245080fe90341c01e553fb
SHA512 936f4917c82f1fe2c6fab300d67f97323f120a5f8c64f54aefeaf71471ba6cc17a954da11fe9b03c3a3da56faea414bf0fe7d62d39fc8e95d5504950b37b3776
SSDEEP 12288:njkybT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:nIybT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1D6F4120853985199E6B69234CA7A82E4EA747C216F21B7CF41D0F33D6E3A7C07A35F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 601KB
SHA256 6a673b7a4a12c71c955a0851582298183ce19536ab5ede500ce0df7d92f1f35c
MD5 2ffc27cac04c75d97cc0ee0b79438d2f
SHA1 7f7e9796c80edb47003cd537ee0d53c86c3d7443
SHA512 fe0e56f9466438d6d9bb48d23fe107f9aa7ac4e2eed3a2cb53af19d0be6864b5ff6c6e297f986bf5864cac8554880aaedcd8e9906c08dbfe086806fcb29005fb
SSDEEP 12288:zmtT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:qtT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T13FD4230C525A266FE753D231833DEBD4F6B43A223E157E5B06D4A2B0966E340739BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 8ae65256657f91e94e1dbcaa934437addeafff2b8af9bd1d43d879eb0f8a8834
MD5 663d7d456f07d5667e68095d25bb4969
SHA1 8c95ecc2213e8b7dea7bb799c1646e52b03a185f
SHA512 8ebf3f8ee541788d1ec5b5502ac8fe0fa84817cb4e26ed2bb9354c3ed5697fc3f74bbe82ae759899eb6faa1d1d138f84c8e4746ce729b2a0622c4fc9ec174b27
SSDEEP 24576:4Q9MxZKdcz9ew3cT7Jckdwi6i9bNrqq4E41WFpW3oRos:4VKiO7Jckdwi3N7+WTW3
TLSH
T184558C2DABE9059AE173D23595A250C3A673B4311B31D6CF2448D03D4D7BEE8AE78F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 790KB
SHA256 b404f6c6ae78f5a3090e918821d8c6ac22fde7595ce8340d79e25218061e2239
MD5 2fae66dcd4b4c2061226c235fc5f5913
SHA1 80b18d421fb6cdb84c51414a152aded72cacd678
SHA512 e75ef3ef265226188a68596898937e8f258bb7b58f800847d828a3c73f62d3722a5e83b4e6d9546692fcffd660a02f5b5eb1c1ed7c8b0ee207a20f92bf138a8f
SSDEEP 24576:byoc8ApDT7Jckdwi6i9bNrqq4E41WFpW3oRos:Ooc8Apf7Jckdwi3N7+WTW3
TLSH
T19805E00FB76E40A2E166D13C89958744F7B370312B6267CB5691C33D4E27AE8BE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 f14c9cbe514917ea30f905d08ecb033de9d44d502abc86fd92defb73c327f2af
MD5 f9221b420da55f08fcf6b42d818cac47
SHA1 daccfd4a9bb05812f66fbe2f9f47787a1b61c0ec
SHA512 0e08de47cce1a8d5d4655dabbf6366ad3ff9566ce37c94ef9d04e5530da3e707c17b650e76d4fdc08a39d86d2ab931fe9a9b8995fa852234ce850cb41724afab
SSDEEP 49152:kPcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKC7Jckdwi3N7+WTW3:x0zuNIQPdwi3Q
TLSH
T1C6A57B3DA2BC00A9D9AAC375C54513A5EA71742E3F2065DB01B0C57CBF2AEF19A38F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 af4d073a19d24c1cbe24e4406532665252f9dce65809661bf7cdc99aae363ca5
MD5 f23330f1bf0e161a6eb5821644a3ad59
SHA1 ef688cbdf1c24fb8a94624884e2c4f3793fabbc9
SHA512 3854f84ea58952dad4b2a774a8c9e9b6618859df2164f7948a49049e1707df7f0a032d4a4222c59d462a7038edba02a69b14c159d1fc9c83a2ec0e9d52f529a5
SSDEEP 12288:qJE1QTPTZREqzzfp5txR+N5gdqqyAz3ooAXY98eVM8GNUbT/5FMtgb:n1QT7EcpfxR+N5AWAz3ooiYjjMqb
TLSH
T1CE555E2EA7F815E9D1BEC5799A23C512FA727821033193CF42A0C17E1E679D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/540-290-0x0000015BB8810000-0x0000015BB8876000-memory.dmp

Download

memory/540-289-0x00007FF78F070000-0x00007FF78F117000-memory.dmp

Download

memory/540-363-0x00007FF78F070000-0x00007FF78F117000-memory.dmp

Download

memory/540-291-0x0000015BB8810000-0x0000015BB8876000-memory.dmp

Download

memory/648-377-0x000002877BA10000-0x000002877BA76000-memory.dmp

Download

memory/648-378-0x000002877BA10000-0x000002877BA76000-memory.dmp

Download

memory/648-379-0x00007FF65BD90000-0x00007FF65BECA000-memory.dmp

Download

memory/1248-314-0x000001FD321B0000-0x000001FD32216000-memory.dmp

Download

memory/1248-315-0x000001FD321B0000-0x000001FD32216000-memory.dmp

Download

memory/1248-316-0x00007FF70FCA0000-0x00007FF70FFC3000-memory.dmp

Download

memory/1248-376-0x00007FF70FCA0000-0x00007FF70FFC3000-memory.dmp

Download

memory/1456-368-0x00000178A69F0000-0x00000178A6A56000-memory.dmp

Download

memory/1456-367-0x00000178A69F0000-0x00000178A6A56000-memory.dmp

Download

memory/1456-369-0x00007FF6E41A0000-0x00007FF6E46CA000-memory.dmp

Download

memory/1552-306-0x000001BA32B20000-0x000001BA32B86000-memory.dmp

Download

memory/1552-373-0x00007FF67E590000-0x00007FF67E63A000-memory.dmp

Download

memory/1552-307-0x000001BA32B20000-0x000001BA32B86000-memory.dmp

Download

memory/1552-308-0x00007FF67E590000-0x00007FF67E63A000-memory.dmp

Download

memory/2468-278-0x0000000000870000-0x00000000008D9000-memory.dmp

Download

memory/2468-277-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/2468-283-0x0000000000870000-0x00000000008D9000-memory.dmp

Download

memory/2468-356-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/2628-357-0x0000017D35FD0000-0x0000017D36036000-memory.dmp

Download

memory/2628-468-0x00007FF699090000-0x00007FF69956C000-memory.dmp

Download

memory/2628-359-0x00007FF699090000-0x00007FF69956C000-memory.dmp

Download

memory/2628-358-0x0000017D35FD0000-0x0000017D36036000-memory.dmp

Download

memory/2920-446-0x00007FF7E4020000-0x00007FF7E42DD000-memory.dmp

Download

memory/2920-352-0x00007FF7E4020000-0x00007FF7E42DD000-memory.dmp

Download

memory/2968-271-0x000002283BDA0000-0x000002283BE06000-memory.dmp

Download

memory/2968-269-0x00007FF62FE90000-0x00007FF62FF79000-memory.dmp

Download

memory/2968-270-0x000002283BDA0000-0x000002283BE06000-memory.dmp

Download

memory/2968-354-0x00007FF62FE90000-0x00007FF62FF79000-memory.dmp

Download

memory/3028-246-0x000002A811EE0000-0x000002A811F46000-memory.dmp

Download

memory/3028-254-0x00007FF62A4D0000-0x00007FF62A757000-memory.dmp

Download

memory/3028-247-0x000002A811EE0000-0x000002A811F46000-memory.dmp

Download

memory/3028-252-0x000002A811EE0000-0x000002A811F46000-memory.dmp

Download

memory/3028-245-0x00007FF62A4D0000-0x00007FF62A757000-memory.dmp

Download

memory/3032-238-0x00000241475B0000-0x0000024147616000-memory.dmp

Download

memory/3032-239-0x00000241475B0000-0x0000024147616000-memory.dmp

Download

memory/3032-333-0x00007FF64AD60000-0x00007FF64AE43000-memory.dmp

Download

memory/3032-237-0x00007FF64AD60000-0x00007FF64AE43000-memory.dmp

Download

memory/3160-324-0x0000017D86F00000-0x0000017D86F66000-memory.dmp

Download

memory/3160-384-0x00007FF65EA00000-0x00007FF65EBEE000-memory.dmp

Download

memory/3160-323-0x00007FF65EA00000-0x00007FF65EBEE000-memory.dmp

Download

memory/3160-325-0x0000017D86F00000-0x0000017D86F66000-memory.dmp

Download

memory/3200-389-0x00000295575B0000-0x0000029557616000-memory.dmp

Download

memory/3200-394-0x00007FF63EBC0000-0x00007FF63EF13000-memory.dmp

Download

memory/3200-411-0x00000295586F0000-0x0000029558700000-memory.dmp

Download

memory/3200-395-0x00000295584C0000-0x00000295584D0000-memory.dmp

Download

memory/3200-427-0x0000029560AB0000-0x0000029560AB8000-memory.dmp

Download

memory/3200-388-0x00000295575B0000-0x0000029557616000-memory.dmp

Download

memory/3328-297-0x000001B9DAD20000-0x000001B9DAD86000-memory.dmp

Download

memory/3328-299-0x00007FF6300F0000-0x00007FF63055C000-memory.dmp

Download

memory/3328-432-0x00007FF6300F0000-0x00007FF63055C000-memory.dmp

Download

memory/3328-366-0x00007FF6300F0000-0x00007FF63055C000-memory.dmp

Download

memory/3328-298-0x000001B9DAD20000-0x000001B9DAD86000-memory.dmp

Download

memory/3328-429-0x000001B9DAD20000-0x000001B9DAD86000-memory.dmp

Download

memory/3448-39-0x000002933FAD0000-0x000002933FBCB000-memory.dmp

Download

memory/3448-40-0x000002933FCF0000-0x000002933FD56000-memory.dmp

Download

memory/3448-42-0x000002933FCF0000-0x000002933FD56000-memory.dmp

Download

memory/3448-41-0x000002933FCF0000-0x000002933FD56000-memory.dmp

Download

memory/3504-62-0x000001AFA57E0000-0x000001AFA5846000-memory.dmp

Download

memory/3504-61-0x000001AFA57E0000-0x000001AFA5846000-memory.dmp

Download

memory/3504-60-0x000001AFA5610000-0x000001AFA570B000-memory.dmp

Download

memory/3764-1-0x0000000002D90000-0x0000000002DF9000-memory.dmp

Download

memory/3764-7-0x0000000002D90000-0x0000000002DF9000-memory.dmp

Download

memory/3764-27-0x0000000000BD0000-0x0000000000D76000-memory.dmp

Download

memory/3764-0-0x0000000000BD0000-0x0000000000D76000-memory.dmp

Download

memory/4180-48-0x00007FF6AB900000-0x00007FF6ABA67000-memory.dmp

Download

memory/4180-49-0x0000023B0B2F0000-0x0000023B0B356000-memory.dmp

Download

memory/4180-50-0x0000023B0B2F0000-0x0000023B0B356000-memory.dmp

Download

memory/4180-57-0x00007FF6AB900000-0x00007FF6ABA67000-memory.dmp

Download

memory/4180-55-0x0000023B0B2F0000-0x0000023B0B356000-memory.dmp

Download

memory/4192-16-0x0000025CF5860000-0x0000025CF58C6000-memory.dmp

Download

memory/4192-66-0x00007FF73BC70000-0x00007FF73BD56000-memory.dmp

Download

memory/4192-18-0x0000025CF5860000-0x0000025CF58C6000-memory.dmp

Download

memory/4192-15-0x00007FF73BC70000-0x00007FF73BD56000-memory.dmp

Download

memory/4316-351-0x00007FF7F69F0000-0x00007FF7F6B03000-memory.dmp

Download

memory/4316-259-0x0000024B0CCC0000-0x0000024B0CD26000-memory.dmp

Download

memory/4316-258-0x0000024B0CCC0000-0x0000024B0CD26000-memory.dmp

Download

memory/4316-257-0x00007FF7F69F0000-0x00007FF7F6B03000-memory.dmp

Download

memory/4440-30-0x000001BCA2440000-0x000001BCA253B000-memory.dmp

Download

memory/4440-33-0x000001BCA2660000-0x000001BCA26C6000-memory.dmp

Download

memory/4440-31-0x000001BCA2660000-0x000001BCA26C6000-memory.dmp

Download

memory/4524-341-0x000001BAE4E60000-0x000001BAE4EC6000-memory.dmp

Download

memory/4524-340-0x000001BAE4E60000-0x000001BAE4EC6000-memory.dmp

Download

memory/4524-342-0x00007FF76C5F0000-0x00007FF76CA18000-memory.dmp

Download

memory/4524-346-0x000001BAE4E60000-0x000001BAE4EC6000-memory.dmp

Download

memory/4524-348-0x00007FF76C5F0000-0x00007FF76CA18000-memory.dmp

Download

memory/5108-387-0x00007FF79CC00000-0x00007FF79CD8E000-memory.dmp

Download

memory/5108-334-0x00007FF79CC00000-0x00007FF79CD8E000-memory.dmp

Download

memory/5108-332-0x000002080BF70000-0x000002080BFD6000-memory.dmp

Download

memory/5108-331-0x000002080BF70000-0x000002080BFD6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads