ab157f794dd252abbe51517f19f0a49b1c3b2146c7d77bf059ed753ac52dbe7b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.4MB
Sample260822-xch2jabl3x
SHA256 ab157f794dd252abbe51517f19f0a49b1c3b2146c7d77bf059ed753ac52dbe7b
MD5 156bcb417f9fb17d5b8540cbfa010b32
SHA1 b53c829cff1ef1dcdedb3b298e7b1d85e80ee51b
SHA512 078f05af2d08e257814eea546434375d56aeafac55835d0d3676545dcd67b8090d40eb5992c15ab0b660c5e10b211707103eb9d7ef30b3be180e1d9cabe726b9
SSDEEP 24576:j9L4E0VXLP7DhspWcY/0eaNodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:j9UrXr7FspHYOOR518/HFGcct78i6+dK
TLSH
T1AC65D00BB6A900FDD06DC139C7565232EA71B8460F60AAEF0391D3693E77AE45F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2292	alg.exe
5664	elevation_service.exe
5108	elevation_service.exe
5040	maintenanceservice.exe
4468	OSE.EXE
5444	GameInputSvc.exe
3224	GameInputSvc.exe
5436	msdtc.exe
1772	PerceptionSimulationService.exe
5280	perfhost.exe
2324	ReFsDedupSvc.exe
5400	locator.exe
5540	SensorDataService.exe
5656	snmptrap.exe
1876	ssh-agent.exe
6028	TieringEngineService.exe
872	AgentService.exe
2932	vds.exe
3320	vssvc.exe
1956	wbengine.exe
4964	WmiApSrv.exe
5988	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9e08613e23e529ce.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3224	GameInputSvc.exe
3224	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3036	2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeDebugPrivilege	2292	alg.exe
Token: SeTakeOwnershipPrivilege	5664	elevation_service.exe
Token: SeTcbPrivilege	5444	GameInputSvc.exe
Token: SeBackupPrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2324	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2324	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6028	TieringEngineService.exe
Token: SeManageVolumePrivilege	6028	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	872	AgentService.exe
Token: SeBackupPrivilege	3320	vssvc.exe
Token: SeRestorePrivilege	3320	vssvc.exe
Token: SeAuditPrivilege	3320	vssvc.exe
Token: SeBackupPrivilege	1956	wbengine.exe
Token: SeRestorePrivilege	1956	wbengine.exe
Token: SeSecurityPrivilege	1956	wbengine.exe
Token: 33	5988	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5988	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5988	SearchIndexer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 3224	5444	GameInputSvc.exe	97
PID 5988 wrote to memory of 4504	5988	SearchIndexer.exe	114
PID 5988 wrote to memory of 4488	5988	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_156bcb417f9fb17d5b8540cbfa010b32_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3036

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5108

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5040

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5280

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5540

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5656

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1876

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f6a4554014e360babe55442d760ddd19ed58948be4a19855bc2db3994220e436
MD5 2ea57f2fdc1914f4eb50d18dfd7fa8eb
SHA1 16e028feb323fe82bb62d090796aca08a3579900
SHA512 ed64f438dba46eeee847783770241fc44156620e7d56c514518ad146707b127f9720094f06ee5563845353f635179f887027222fff08a75a57e406c4e39a0dc1
SSDEEP 49152:6Mn632BuPkFKRrdE6oh7stBhuXjfS4LWxnVOR518/HFGcct78i6+dDoyLs:g3q6gjBZR518/XOhD
TLSH
T14BD59D03F29900E9E06AD178D7569133E9A2BC890B34B6DF0780B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 f1a17be0e013ffd45967a0b24db5ca33da1d11a0d8df5f1bd8aaf54cd84bcec5
MD5 7d8f99211dd250b61ddfa11bc08d4aa6
SHA1 f5977b74df8cf72cc0e93d88d530f8bda6069a28
SHA512 74202d0cccfbc16c78a38e1c779efa6c6a8f343d7fc52b71f2e8e493895d11886d1275c758a9a3ae1b92d7521f347873b66d83b143b98f665fef759cb2b383d1
SSDEEP 24576:RXYpV5czAUodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:k5cDOR518/HFGcct78i6+dDoyLs
TLSH
T12B05012863D40DF9ED5B823CC8B29515E773B8444790E78B03A4CA665F237D89E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4ce228d6fc44aa3197663ece0dd2620ff6b261cdaafca3be73bd67158ab1eefe
MD5 8f2d30d2699021de1907f871f15c8d5c
SHA1 b89699e3b23c01420ead1dc20b23dda091513492
SHA512 d1af00060f76bd6748aa349e90b98698e3bb2509ec112a98f79b08e446a4c429e10804aafb2078bcde4e333894f5febad1c2a51a611d127c4f7ef26351394b5b
SSDEEP 24576:J00emjT0hrexOrMEodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:JFjT0IoXOR518/HFGcct78i6+dDoyLs
TLSH
T13D359E16F6788735D073C0B9C5D2A68EE97230855B308ACB4246C77C6E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0e574883d3187f88308d11e45de4466347e7178cb0059c6cc4a3976ab735b532
MD5 4810fad1b23dba7138f5fd171477f81f
SHA1 d655e6b6c0380834645afa9de35a2c0c1f000b4c
SHA512 c34ec74eb0e1407d2ef930dabb25f12c4e00b779e977387a8e41bde16365bb9df6b2e41461469b3beb8c0d19f5f456549a5fbe3d6d5e626c8d13b74b7751799a
SSDEEP 49152:e/ezSC6vUzPvuHjympOR518/HFGcct78i6+dDoyLs:6ezSC6v2XuHcR518/XOhD
TLSH
T1FC755B15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7b284369651eb3c7b000f4e1453c11f272252c24064b2c8b6593a694aa52b489
MD5 50361e4a9ae6b20ab55df26cd53f1f80
SHA1 3942116e090f46e56ee4e3dc2b50f8196be2eedd
SHA512 05b0a2f83a0eb6c8a8cd8a3dd8e8f63d16680958ffdc15f345acbd21d40583a793f72ef69d3cd2877190333f3b56699e0cc8c836de99c14dded4aa37c0ce1b97
SSDEEP 24576:8abNPrUWL3Ol+daodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:8adUWL+l+8OR518/HFGcct78i6+dDoy
TLSH
T1F9559E66F5748335D073C0BAC4D2AA9EEE3234415B318ACB0246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 064ded6b1ec281e81ca9a28e6c916785290126c53e2316c702bc6e288be1f1b8
MD5 d06ad6a4097f8c2e2484fed7f7f7d461
SHA1 749abeaa633d9bd1a59d10e81855864fee2d8460
SHA512 f0160a8c3ee40fe3274e1a7d2841492c36d870ad39b2658cf34afe3ff7c52edc2bda00f910ccc283431cf2939d388423c44354f4d457bc5beac371213dda0ef9
SSDEEP 12288:QAVodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:QAVodOEvx18/CkNTjacctck8DVk61nQU
TLSH
T100D42309024D0EEAF3CA473464FA3A5DA3939F446EC086418D04DE86CD77FA7E1667E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 6485310d50a583bb5fe9b2ba85029a7d08139a53ca9c028964497e7970e791c9
MD5 6e16071d2fc54afb19879c891c7fda11
SHA1 09b5d7350167e5e5b134f20af4ff914589924643
SHA512 13a9881b3bfc929fc66a629bffa64a06711c1cc724309f7c070155e17111d6d7c53643354bde25b8a3b63020333d6531afc60aa1ee745672a719e21d2ba6a477
SSDEEP 24576:3JIU4odOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:3JIU4OR518/HFGcct78i6+dDoyLs
TLSH
T1BD15CF3BAE28ECE2C27E8D7856A18600E77278704F5193CBD125C30EDE235E15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 2b4f289bbba0c7da05d546cc4bd0ae35ac2572b2b407c5410b25db216d8f5cdd
MD5 60b38c43d48ba0fce368ed908f555e02
SHA1 94e8537945754830ce50108f4b63a62f6e7c7a17
SHA512 c3d682f498c9bf3f84181b30cda7212d96f03fc582b5da9949308b123eca173163b1e6c5a19c244ce7246d57288e9e6d4518aa0d88de61a92aeb353f7f67f7aa
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THZ:DQvGAdlCEL8c/NRNw5CXR518/XOhD
TLSH
T151367D656BF880F5E1A7E138897AC6B2F7B678420D31EB4F0251C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 e00a9b52d262cebb1564ec27626d4d0a5d1556ef574f712c6125f15543ed5559
MD5 59cbdaa5cbe821d26dd678a0510376bd
SHA1 4e2c1d0505953b16bc33dbdcd600a232f67a3d57
SHA512 6b172ad7dc9f8ed2dddb1993c98fc6c849667408b484a20fb407325e43f23c955abd66341e1fa98c3012ab07c20147423a18fc174bf189a454efd8cec1b20c07
SSDEEP 12288:cRwSfxL/2Dc3bDLLmt0LDQewsAjVsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSpz:QmewsAjVmZRMG0xrgvtUbXSElq6f
TLSH
T16F15E031FA74D032C27B0DB61B26C716683D79204B6619C3E3A89E9E59702D22776F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 03d7c58ab406f22bc3d80b21f66028a03c1d2069915f92497acd3ba8d89b9482
MD5 b928d2f575d1157b4b9911299d90f80e
SHA1 c64cd3c3a647672640044bd65b6b21604798c60e
SHA512 5d61a633187b69f8f208ac8daf64b5e5a92146fb948cd287cc82da0eaf00b90b40ae9dfa3a97421de28777735e46ef5f38eb85eb07e8a13badffc5ffd1e82663
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHbiS:FUEtQevvqc2W1cpV2X132biS
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2ddd99bbe6b6e7f6752907ebe0247e7f254981b987bb431937ca4db5453f1438
MD5 3615d797db72417b17de242f0997a5af
SHA1 dd96579a663e32ff2505d4ec40d572e7a067e589
SHA512 698238e03b02954e6d3c3d114e4f036e95e59a4a97dfd1566ea6566c2d751893e2713aefa1521fd56017a999de569d7e2b72cf631df4066b27aaca91db790766
SSDEEP 49152:JubRquA/m2yL5zMfFiV+XenmE3/zUOR518/HFGcct78i6+dDoyLs:Soq1VjnmMR518/XOhD
TLSH
T1A0D58D0976B882E4D1F6C77886A2C647F37178154B3197EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1d84d29784471a0add4a9289f6f1bf51f48f23d7801dcdd9a010c2c813e398c6
MD5 44757ccad739ccbab04cdc2a7f6ad98a
SHA1 cde32656fbb8edc427d7d5941bff43d95bdb175f
SHA512 56a42f8e0b95499ad93de7e8bfa8c6c04a8c7d9be022cf9098bd6d1f5eb98bcbfa7ed393ec8224b5189ec7a7e550f0b55f68f21f8491bc304f4bc5898c5b5582
SSDEEP 24576:BAhGLvVFoiwtA5l7S53umZRMG0xrgvtUbXSElq6f:BAM5Foiq5jurQt3a
TLSH
T19545AD91E7F945D4F5B3AAB899B68171EA76BCA95E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 38a11e56f59abeae3ac27c31ddbaa894de073e0c2a9e3d5d8cbc6fae25ca205c
MD5 9c7c8471f6d9abad14b165fb86ac64ee
SHA1 f9f02a9c36d2b8cf12147f7488d0a78acdbf9776
SHA512 d7f5d0e4dec8b3ba7bfd985f3bbbebd1ab3b8d69dada712b08be9a633ef0cf37a1ff62f81f42952e2629e8187dd1be4a93e40b44a558c9760080d00ce866d2b6
SSDEEP 24576:Owu+OWQodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:OwlOtOR518/HFGcct78i6+dDoyLs
TLSH
T1CC05F14933990CF9E6A7823885A79536F7F3B8012A61C71F4720C65B5F33761AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 6952f76e4808bb9f11c95ad3e71fcf6c62cc96016808b1f8784418fdd0700fda
MD5 3a1b306e2018100678039caa89b22897
SHA1 ced363cbe8e4f80eb5fd9540dd4978926d494d2c
SHA512 04d0c437493d02b56bdb012ffb497f943f4aeda51a38101b5edbb305afcd77a6606ed01a24a621024ccfed86ee819cb5f1f6e488f5fb4cf1e053593d4c5d7ef1
SSDEEP 12288:KlL1ITzsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:YLuXmZRMG0xrgvtUbXSElq6f
TLSH
T141E412AA22C410F5E257557CC8A1C54AF7737865273A43CF16384ABA1F63AC11E3AB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6aa3c578b7edb290b6bfb4764cb06b7bd81219e058ed2f386317bb9ba03c5c06
MD5 70d5e8ddf0de8d420ea4e13268bc0070
SHA1 90e6e227f2607e5bfd044b88101e980c65a451b5
SHA512 6214bca402a6067af9d5f87f3c2022025237634c21ae2cc5fbfed669ef87359e4a993bd8e4d7a49ab8d9334321d92779cd6e697197194943086b1b05e50722d2
SSDEEP 49152:Xshdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U9:wQRQyi36YOcP8Lvw2gAf+PN3B63
TLSH
T124667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6404ec83c5aa1120772a19131b1205ed74eb8003b68fbcbc5724a0d76008e738
MD5 456ca147b80c9d10b26290bbc8157719
SHA1 a4d8ab8f87b682deb07812d1921fce7c0367f8f7
SHA512 f40ee8d17553b7f1ac37dd0c1eb45d9979ebdd0d5f7778f7322c3f0e570a939e99d756a554d43320baabc0c86832c0f8661390a2da98021d20e8cc3e5418ffa9
SSDEEP 49152:Xshdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U+:wQRQyi36YOcP8Lvw2gAf+PN3663
TLSH
T106667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3f92ce12d4195c0c5fd928fb216121b9812948fb4519094de8f2e0fcdedb771c
MD5 6374f3f37c1b1456a2ffaed152c950c2
SHA1 d5bbae0363c79cff3f01ea660589fb0fab665bf2
SHA512 7fe8ba5b100ae87d9c4bb7dfca39f02a7db35bb2661a694cac0b1709085ebf024070d9162ffb577d77ae438f16d6ac95ef0b10f67c903d668c16c122f82b3694
SSDEEP 24576:Jwvfkf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL03mZRMG0xrgvtUbD:h68Qg55nhMeWu7PNU3/VurQt3a
TLSH
T1D3B55A33B2F200A9C04DE1769F46872196D27C758FE1E3DB8515721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 78126a859a258b3d506e6b8081808a3d260a1118d7e3e1c35c0027119219435f
MD5 06fe42f26bd3e605dfce879ffb81be3d
SHA1 27f0f969a6588ca807586e9d55340e260d6ba778
SHA512 e6c461d193323d2896b16c67880a99a69798b128f0cc832c23c05370be9aa797671bd3fca3f9760a1ae0b9124dfc233bdce10dd2282aaab160663f6f22000e16
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99o:Py5112gYy5azzVv569nLKnhZp63
TLSH
T1E4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f82c46d8f681ee1b9034be1a2f011654f1470ca5c9fa44e1b933c958acab74d9
MD5 aab2f39e2942e73aec0e5192563e60bb
SHA1 7787e4fac8d5d1a909c9b7df21b524201c0478f9
SHA512 4fed039febf5312114f88e414bf1ef51de8526924bb115d88f41cb4d5f9772db0a56ffd9586d86fb22d4b7dc5faf77c8a5ac8caf46474f867384ceeaaea3892f
SSDEEP 49152:nu+taZ3usBWOBr4tEGp0bqx0z+n217aau1gldOR518/HFGcct78i6+dDoyLs:uu6JmTxd2dQR518/XOhD
TLSH
T19AD59D13F1DA01E8D05ED578974AA233EA62BC490B34B6DF0A5073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 12785b1a58ca731f4e9f52ced743dd2fdfe6d096b64fc7070ad376691be1c786
MD5 76d60f805c9dedadc9c7f58ced2f0fb9
SHA1 baaa9a4df3bb76b46f725202f7e892a72390c0ee
SHA512 0d16d36da52189bb1e73d8a8e2515b6f16f4e927a62abc1540fd0585a8ac893661994847dc59f602bf5e89bb7411ba53c18a31a153c56c7edfc99cf6d0c69bd0
SSDEEP 24576:ohvyE1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3YmZRMG0xrgvtUbD:C1hpsNoJpF1A6UU44CwH7R4xNurQt3a
TLSH
T1FCB5BE13F2D800E8D06ED17887569232EA62BC450B35B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8827a57b21f95f24db7b1339df54bda18acd6585a9aa7787903768666847488a
MD5 b3899dac163a98ad785891c20ceeb558
SHA1 152857fa51b0f443eac5f7d7deabf70be57ddccd
SHA512 88082bb294dce9848a94b56ddadad7155a911ef6f418d64c8617541ec11a85f4cf03121c764d321e91a124ace3b0ab05233fe49ea750f02c382c5a537a679b27
SSDEEP 49152:DSuZQIY0Be2K6RVtOnks6NMHqcurQt3a:h5dKoi61L63
TLSH
T1B5C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cc8ca0ca5b27ccdaf14a8359d8e05d95f24d3f1c67dcc8fa031b6e6ab8710c22
MD5 fd45027e69ea78df05e2448f915e7fdc
SHA1 4ef6bffd537342d956c7ddc610553ad0d1d29542
SHA512 0bafd79f3540bfdfa913ed4009491795c51a471a6b0d8fafdb2c52371500c95e530973ae3541fa544afd4d542ed2fcd6f49a7a1b5c799202d8fca87e1907f5e0
SSDEEP 24576:VsxavjPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLsQLmZRMG0xrgvtUbXSy:VskSn8EApI0figTgiDn0AP5wuurQt3a
TLSH
T1CFA5BE13F2D900E8D05ED178C7468632E962BC150B39AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 fa311265e25bb4c6c4bc18736c8aa5118f3de06c4e0fee74c66af3cb57e7e394
MD5 c49edc7c5ecb1a28411dfa37e27d82ec
SHA1 755d87d65a87a2292e993eb54fd0df68445f79c3
SHA512 0c7748dfd24bbd6a87a96f740d51b3248fd84498c73e6370ed36efcdaa5931ee568bb8c8022ec1309406b126adcca9f4915c1b2fe267cc5a870d80db32d3a9e7
SSDEEP 12288:9IQ6syX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:9IQ6mZRMG0xrgvtUbXSElq6f
TLSH
T16AD423F629894061E20699F5C111C0CBBA377D6C392F14D5AB7C6EBE09A56001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 82498bf7b47d73b898830feec49f81062103b0a6cd8ef4bac2844b4d285189f7
MD5 8fb292136f0943b4c3ae79e41b58116d
SHA1 d0e6907df50989f3d89f11fd76678837bc75a08d
SHA512 64173f656b2f9d0ef426adb2ad37664ee6271776396c1b5e1af7ef24b4be408ba94b0eca42675965360becbc6812389214c8e0f4388f10eba38c19aa7fd6fc36
SSDEEP 12288:DuQgsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:DuQgmZRMG0xrgvtUbXSElq6f
TLSH
T192D423F625894061E206A8B5D121C0CABA377D68393F54D4AB7C6EFE0D956001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 29706043b5ecae6ea8c2b0bb0b0514eaa6141fbb341ef246a98da1bf9e3480cc
MD5 4cb574b169bd769fa48a4f113edfbdfd
SHA1 4b579c882dbccb14fe12d0a595af5171a4eab168
SHA512 fde8a211e623247d5538b2c53a830a4d1dce6352cc9a93fdf515e2bf42a6349e454425a41f9a57ebe4890359d7e2d503b6ff03bdd90da2b41fc7aa4bd6c986a0
SSDEEP 12288:BfQgsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:BfQgmZRMG0xrgvtUbXSElq6f
TLSH
T149D423F625894061E206A8B9D111C0CAB9377D68392F54D4AB7C6DFE0D966001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 95c45342004cd76452adf830b849cd4a38e6ef147f29e2222eeb9855c4b249df
MD5 087a25e6017112af5ffc541a240e02e1
SHA1 3f504a8a7e34be2fd3a7b19b3ba8698864610f52
SHA512 46ea8ba357692b59188b1a749f3821cfdd53980e7b9c3b76d7dbfd5fd604db81224fd3439e785a69c1b4038cdc73d2b8dac1b5fe383fbf2103e6f9fad37dbb94
SSDEEP 12288:DlNQ1syX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:HQ1mZRMG0xrgvtUbXSElq6f
TLSH
T156D423B6268940E1E516D5B9C121C08AF6777C68693B55DF9B281EFE0EA13001E39FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 765e53f43ab6fc6239c757403e4e79bd4e5bd4abda8d87ff23eda9eb8e619fed
MD5 e4c79f5b968f3e95efa6625dca08e6db
SHA1 655caefca796e166f85c56913e776b4cff87f28a
SHA512 3917d5cf8087f3316cd87413d901694300bea22ec63826fed15d239e8c102bc28731d2be4661b3ed0cf8b15e6060192da6bdb6fab3ea524c7febb80a46098b14
SSDEEP 12288:QqQUsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:QqQUmZRMG0xrgvtUbXSElq6f
TLSH
T1F0D423F629894061E206A8B5D111C0CFB9377D68392F14D5AB7C6EBE09962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 1177a3aab14fe1ffd35bb89dadd3518ac47395d9a708755138281da3cd15852a
MD5 4b78d668e20fa6928819508606b6ac44
SHA1 c659fca0bf58596b7d6a837d8bf265e5d2bdf053
SHA512 da51324d5f72caf2db3286bb9313542a1a6c86cab54af814337613becccbe29a1cecc7301d63236d66a57ec6307e5bd407551b080e39087e1875f7280f3eaa74
SSDEEP 12288:jbQZsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:jbQZmZRMG0xrgvtUbXSElq6f
TLSH
T132D423F629894071E20698B5D111C0CBBA377D68393F54D5AB7C6EBE09962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 b652633299af498d1a1121cde1a4c4870c7031d47c4fb5490758b0009752110b
MD5 074bfa62b5f39d4091a12f561c870117
SHA1 c97f0ac072effaba711ea22ca525f488b61bea1f
SHA512 8bdf7815ceb55f8b2fe400b541d43aa0bda284f4d20cf7962eaeb7c47a35bbddba3eb79d799ca71c095f01a6941e10911baa9506cbf2ec5e0654f8a7ec4c1998
SSDEEP 12288:6FQCsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:6FQCmZRMG0xrgvtUbXSElq6f
TLSH
T144D423F629894061E20698B5D111C0CEBA377D68393F54D5AB7C6EFE09962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 fdf10713e9c88443b26f79938edfa81d097129cc76b6bfd84b142e8d01220248
MD5 4cb5f343b5a5cd3ba9741956957b0066
SHA1 2c5daceb9f0dd7387194e55d83c1f1de002e7042
SHA512 8c508d78bd51c5d0be06bc6611fbab87e4fb0fef47200f6283f45ce6e2f235fcdd645492b80f18c004dbc058fd2cfc4c04c41cfb139af4afe01111c9ba2517bf
SSDEEP 24576:BZMIzF8SCPQSmZRMG0xrgvtUbXSElq6f:BZMIzWWurQt3a
TLSH
T1C315F1A5739008F4EC67813EC9258946E6B27C691A70C61F13B83A6B1F733511D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 b2b5bc2a1b428ecc0279ac2a392437024c65c2a0822f4c824f1c2cbf2dba57ad
MD5 34b06e7d1ae8f62f8969cdfea83f09c7
SHA1 2b63e64d2bc93301177041c062353aa06f915831
SHA512 e89c3c34c288308bd2b6a7d6ac1fca77c60684c35cb0c890dbe6f3dd821d1a8e2f3ec902d756e7ee63bce62721999055046377fc0fcaa892fe05a0ecb244968d
SSDEEP 12288:L8QHsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:L8QHmZRMG0xrgvtUbXSElq6f
TLSH
T1F9D423F625894071E20668B9D111C0CEBA377D68392F54D5AB7C6EBE0D962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 398e42b5d00ac7fe0ca5ea2314dd0724e8a9dea98c1b9b823fcd7f36f3df5af1
MD5 9e8d71a064eb38cdc7fa0cef143014af
SHA1 fa89f29dca362c3587b7be3bb7f8d604f0aa4f44
SHA512 7e6641105b88ea4804abaebcba047052a817eb4dde493cefc7c33d50bef9d0812f31ff80db0c2f0c33d4cad8485d2491b649554dd0023403a295a709d786fa61
SSDEEP 12288:5WQQsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:5WQQmZRMG0xrgvtUbXSElq6f
TLSH
T147D423F625894071E20658B9C111C4CEBA377D68392F54D5AB7C6EFE0AA52001E79FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 94eda6a4db8c0754df96d5905029a539aaff693281e4d060676ef281002da00d
MD5 5df47b307e85691b4541834d0842ad5a
SHA1 f5579653a3d3a05a536efcd8c88dbbd3f22c224e
SHA512 4ce5526d130318912abe20adccaf68fed723c16ef097f0ce7afa32fe9e8218dab73b6991990ad5146e1fdc827985b771e2c4cfd4d2ce0e5e761843e800780409
SSDEEP 12288:JCPd5LMdQtUrsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:IdudQtUrmZRMG0xrgvtUbXSElq6f
TLSH
T12AF41257339520F8D1279178C8628946F772B8351B358AAF57B80BBA1F232505E3EFB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 f10317cf4e50c09d8a280b7660416139719b90cbee4630bd760cd339f5f139af
MD5 1b8f2d8b7a594fa4758bb79b626dea2b
SHA1 5cbd1a711dbec606c326cfbb6ccd79604da89a03
SHA512 c3ba93c046525f458963ae0abfda2e71779562ae1a08dcf95f5b14abe376e7325799444676424e5fbf7335da4370650ddc2f39de9b76ffb9d7a069f38a833f4b
SSDEEP 12288:ryQRsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:ryQRmZRMG0xrgvtUbXSElq6f
TLSH
T11BD423F625894061E20668B9D121C0CBB9377D6C393F54D5AB7C6EBE09962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 d3b5788eab518f8741ef8388ef7d4fc7edee4134187075d3322fc111f2a7d957
MD5 09677c609975694caaa33c543370a8f0
SHA1 322325892223b3b9a129c343a9117556123fad7e
SHA512 59f4374e2af02054e69d55e595f0d8264e2a3084370d76916a89393b8fa896e00319458121e877d5eab488555d7dfece3fb714d9295439afaebe3f9123ab90bd
SSDEEP 12288:38QRsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:38QRmZRMG0xrgvtUbXSElq6f
TLSH
T18BD423F625894071E20658B9D111C0CFB9377D68392F54D5AB7C6EBE09A62001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 ea877f725ae2e8171a62904b05c82cbc143f3c532265c2f2885547442150d8b6
MD5 f88da44356c7e62ab3a2aaa29b9171e8
SHA1 87aa6555d0e9432dfb3b70217bc5659e42cc7600
SHA512 8340d7efc8be3e0ccecf01612e17203e9b02f3ffe67856e0f371e0b7e51407ae612ef1e7400e4b7acef7e375c4a919dc52334beee7623f26ec7e6005f491f6a1
SSDEEP 12288:gCPd5LMCisyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:BduCimZRMG0xrgvtUbXSElq6f
TLSH
T18AF41257339520F8D1279178C8628946F772B8351B358AAF57B80BBA1F232505E3EFB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 09aa55dc2428ed1cf45ef307b671dd017edb897c94192062b4c1b6f320b4f8d5
MD5 f6e3aa579e01739ba0567fd558214f34
SHA1 65ba7d0159138d6b9e62eb6bac0b5d241f818b6a
SHA512 5c3c1784795177e5e550807c3b2fc78ebf425b5bfcdfd5ea6b60f654c8198933332d5355afad1816c20ecaf4478179a754b8c0077a18eba0a117598673223b5e
SSDEEP 24576:cTfaL93z0zS9mZRMG0xrgvtUbXSElq6f:cTCL9j0urQt3a
TLSH
T1541501A5739008F4EC67857EC9258946E6B27C690A74C61F03B83A6B1F333511D3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 6c2023de401491ba5c7f825caf3ccf7b36686f282e1f09e14a83b163a7c5060c
MD5 e7ba11acf37eecca02550424c9c5dd73
SHA1 7727ae2c3e4d9fc3ff20c9949204202af110dde4
SHA512 f4b169af21d83cc9ad604169c3621af1d1f1f8c58abe4d3a44a81baaf64dd032636c0b2f49b5eaf97ca50869be3eeaa4ff6f13c2467e37e6c4e0f67f1bd6d735
SSDEEP 24576:W3yd2CHLy7iMnmZRMG0xrgvtUbXSElq6f:4yd2CHLy2VurQt3a
TLSH
T1A535CF90B3E410E4F1B79A35C9768512DA767C591B31DA8F03A8266A1F337D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 cae447e2825fdb70ebefe5e07273d89ce108af3b80b6093fc16b6532ec65ba16
MD5 4d89789cbaf93d0ed07d121a69110eeb
SHA1 e27bbaab5d1fcb9d5507e0e6dacff7784d5c2630
SHA512 62efa32ee207ee9afdcd2635c8e9c8f42fa86088d5c721d4f95f59af75fa850360e531930ecd596fe65e3e55d3fe0b494beb5ed5bbcd404afb2c3a8d8623c8e3
SSDEEP 12288:fwsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:fwmZRMG0xrgvtUbXSElq6f
TLSH
T142D423F625894071E206A8F9D115C0CAB9377D68393F50D5AB7C6EBE09962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 745d83fa8155d55bf81f12856275beb4f599a357e2b0b90bdcf7bb1a2d2bb32e
MD5 eea46d44f9fdd3128993e8c378100aa5
SHA1 552a927f03e6d01fe1dbf189ce8efe0c40999956
SHA512 5812ccc40518dbe71c5276a17e5e70c239043318ea601a2b56ae4f7ee6cfce973ea24645ca8bef4cd5a94d9bf242d373e6cbc1ae7bfefcf3abe55219dbf6a4f3
SSDEEP 12288:IrsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:IrmZRMG0xrgvtUbXSElq6f
TLSH
T1FFD423F629894071E20658B9D125C0CABA377D68393F15D5AB7C6DFE09A52001E3AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 22d0e9e7ceb6b9d937d90591943f3af67bcedd61acbf95960b3149ae4e07285c
MD5 ac6f869d764a4a829a882062cd7078df
SHA1 d6f45eace72ee0835406a4bbaa1345fb01849f49
SHA512 194c92ba8293572e19e7bb667f4b75e89f5a37a7b7e80736b78407667c695d8558ba1b73d9baf1512693e87d11a98b7cde7de1029e98743186f42ee8fb826277
SSDEEP 12288:uUsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:uUmZRMG0xrgvtUbXSElq6f
TLSH
T106D423F625894071E20658B9D111C0CAB9377D68392F50D5AB7C6EFE0D966001E3AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 9b6321afcdb2ec36336229b5bc259f47f815867e039a5c8a023ef75da0dccc46
MD5 ee8e632fdb794ef3669e8de9df2725cc
SHA1 1e9d10f5bf0f1590bb36015b892a8a1085f1162b
SHA512 c102e8bf8e5cebe0f0a5065e11bfe461d7ff17ba71cab49a480338d5868e083296c01f5bb0af06a980813a697d1a25b00ba2aa042acbdf8f834bd95e7c6a264e
SSDEEP 12288:ByisyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:ByimZRMG0xrgvtUbXSElq6f
TLSH
T16DD423F625894071E20658B9D121C4CABD377D68392F50D5AB7C6EFE0A962001E7AFF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 aa300c601a0ef111d4c7da8169d2a8c924ef8a9b9fcc24d0d363bf435752efdc
MD5 dd58993a54b2448908ceacadf850c070
SHA1 0d687476fa831e19c5cfa5184ec3e9d017591c2d
SHA512 af1911ed6f16100ec808f7685c62206246830a23983df97002b9ebecbf0e9c7a852ca5a82aea2e0ce7a1c0bda19c49f78c3ada02df08203d82c0b9d9abec82e2
SSDEEP 12288:NVBfbsyX2DZEGMG0q03AH/WvgB9S0vU7nfgAjXSptWx2lQqLyWPifD6dv:pbmZRMG0xrgvtUbXSElq6f
TLSH
T168F4016AD28802E8C02E6179C7528681B7337C2457F6D3CA57E4F97E0F762405EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 74c1083d0dde9ed8b7d9097f10765cdea056c72b33973a869b774758ac6a9480
MD5 3480d6f2d34788138ab6ec49fb4a5036
SHA1 aae52b6fcebb99f3c1840e0aef93a99b83b0c951
SHA512 276a77bdb1d50601352a4d6a919c230c68e1b0719708cac270a84e2756fd37f589d1a62bbc0bd8b9c0177dd179736f27e08f9ce4e70d3520cf9e8c6d596dca7a
SSDEEP 12288:cS7zodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:nzodOEvx18/CkNTjacctck8DVk61nQdK
TLSH
T195D42309034D0EAAF39A433464BA362DB257B7446F8081C38D04CA96DD73FD6D976BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c08c0058127d638c6b9654f4f76b82fb63214ec9f78d6c261e93049bbfd45cc5
MD5 816f27eb55dfc054c50e865d66e4ad73
SHA1 fe2a5de669b5ad00a9e7872ed549499da2a739a6
SHA512 474e034a77b783373ef7c7e00201a669cd29f9904c52dd317e65b253d01c5d50b2de1f1103ebd94afa3a5ec419f6dcf3796bfbfe20b0819aba65dc528d6ea119
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYkodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:/gb4mBIBhGFFOR518/HFGcct78i6+dDe
TLSH
T1DD65AE1E22EC02F5E1FAD2B89DAA4417D6B378160731D2DF0151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 6cf76426c3004c9efd17655fed5d171aeaa28890b74cebe491f81d7120481f15
MD5 02ae082ebf4f8adffff455fe1de7f598
SHA1 821930cc3524ee0b38b0ce13b9680ce81dd1671f
SHA512 3ec1c397c70a7541be6a1e1278b4e1b315aac3b45236239bf8f7d1d4409091902b856370dcff68e440498859f2e599693547b39a388029f3510b083d0c1224d2
SSDEEP 12288:cIGUodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:ZGUodOEvx18/CkNTjacctck8DVk61nQU
TLSH
T1A8E4221D219E19E9D27A833894B6295EB1B276406F4042EF4900C976CF63FF1F23AED5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 4b905970b726d81528fabf472728453427c7b92d34a4c00afa29df0c96ea491f
MD5 df6bbd4edc39b9e22b5f4017246b4596
SHA1 239fa4aba65e78f3dabb2025cc61e994a26298c2
SHA512 6eb7c9c861e00084f557c17aaf0ae0aaffba99224b6e9717de612a2b4f2634257d43a70d06838053f93b59117a6c068612de569f7edc283b0304212de90e8eed
SSDEEP 12288:DEodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:DEodOEvx18/CkNTjacctck8DVk61nQdK
TLSH
T10FD42309024D0EEAF38A473454B63A5DA253A7446FC043C38D05CA96CE67FE7E636BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 37876d390680c60692f5aa3d5b927dc16412a8bacb2d47f5a3dcf4b3b1796e1c
MD5 040c4586797f49f77ac716d440cfb623
SHA1 6064ccfa35a9a1648e0d43d8c5e201a977660c8e
SHA512 01e4adacf23ce414bb446cc1e8ca3982728b6246a773fe8ade1e044a9c39e84d546d8d59520ba2de01cd6a57300aeff2bb89a5ac6add70e1e71625880766fa30
SSDEEP 24576:5388u8FpJqH11Srga7/mUodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:R7ZFPqVna7/tOR518/HFGcct78i6+dDe
TLSH
T18C35012563E502F1D07BD13889964A67F6B2B4150360EBDF0B688B521F23BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 ad5d47036bd1159bbee20afe6adf66f4e9f67c384d51a43e8c90617d9a7c5758
MD5 82a38bf4c5e3958f8e56ac69898711c4
SHA1 7a896ba8c6ed9037f1768b9f1e67c6e07008f151
SHA512 89399c15de6701095068e592c4a4217f53d8b1d824eb72e07384a32e43f624fb82feccfdf47e1c54f463c23e85819da2f5a3705380826a9e8892c160f9514f6e
SSDEEP 24576:TPUr+NQtodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:TJQtOR518/HFGcct78i6+dDoyLs
TLSH
T13F05E11F22AD1CE5E67AE13C8996570DF772B452174192CF0290817E4F63EE8BD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 d60455d61f8d3c49eaf6899fd957fb88ae9c8dc9e1892099abe3ba0d28f0c9ca
MD5 a003a146b39d71540ab7ca338e161050
SHA1 7a02442eff7ce67d024118adef0ed9b1e0375fa4
SHA512 be1142efc2760138b9f520bdced55dbf73b7ed9b35b2c25b25f4c772d5d086760a93678bbecce0a4ba43600f5a27ac393aa5136af8f86af8f3aa1f1e78f79818
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjtOR518/HFGcct78i+:FG05lO43bPR518/XOhD
TLSH
T10ED5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2cb9dfa1f488f5ae651d716c853dbe246628c7d2abcea13c25d2f250b0d31a82
MD5 59430a9cf3343eaff7eee1787423b8f5
SHA1 bc489f5a1d8d77d415ec6b3ead1ef3678e76e910
SHA512 081b56705e4a699a28c929bb2acac78dcdd04af6f26ea7dc0ca55f627cba1cc8b9ed0905ceca85d5b34ad3e2b496c49c700cc0fcf57dbfd32174d54344970e3a
SSDEEP 24576:DSa5POZ3dpbWVM50JicR2hG0lasx2+47eidneodOEvx18/CkNTjacctck8DVk61x:Ga5POZ3wJt2pasx2+mAOR518/HFGcctY
TLSH
T19B65AF5EA6FC01D5E1B9D17DC583461AF5B2342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 49d324f4cf5233f355e1c5a8b86fef1407a6459c4a16d0b661ff9c363d8dcce3
MD5 cbb49b04ed0417adae35e7f11e66b71a
SHA1 176551b20749846a8c1de12d7b57ccdfc7dbc283
SHA512 9bd5fbdd54ef9093274677579d34adc80754e29c0d19bb021a06b52b5c5d74aab1287c057fac4659577f85850649c914d76503138770d3d806c7b822653a2175
SSDEEP 49152:RNc/zEOVHFVOR518/HFGcct78i6+dDoyLs:EIAiR518/XOhD
TLSH
T160858C1623E901E4F1BBE1BE89779946FAB17865173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 43d6a0221f6a00fbe3d3d18bd9e04774a0db8e00553abc775411fb8366b5b7e8
MD5 87064d9f0e89890380cd24213d2d0654
SHA1 d83f27d36eeca805669b91fb2b4e2f78cb92830b
SHA512 48b7855f01ff36821ed88b20e272276f3cbd3be8aac4925d17e9a8ccdebfdf509fc06e107a13c79e55c494214b3e26517b0badb6cca9474d3b44c11ba5548b13
SSDEEP 24576:yJnJPbzB4SPodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:yJnJv6SPOR518/HFGcct78i6+dDoyLs
TLSH
T19515E02DD2A810E8E4B7C274816A2B5AFF31386C2F1169C71974D5357F12FE0AA39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a5015d1d77e5184816ff5bb972e82e85e8d90e549696eb0d7e60718dd2cb624f
MD5 57a2b2f90d013336e18ae0edbdfa4088
SHA1 e6bfea429dc403cb7ca6e68407ea3a7a5890cbe4
SHA512 9579bf9a1ca29b8db13c3868f7ab42e4c463909d774cc19e03691f5fb6660c4af450b6946485063e873678cf2bfe83b823b119b85c5f64bc17abe1f68be60cc0
SSDEEP 49152:2CLHGeeV5ijCmlDWDkHOR518/HFGcct78i6+dDoyLs:9wR518/XOhD
TLSH
T17EA56B05A7EB4188F8F3CAF5C92694169A327C549B34F7DF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 5ba78638b35e095f3246f80813ce9beed8842291a49f07487c26d3d9011e8839
MD5 e3a077bcad5b6110ad92b03dd63ade31
SHA1 72015cc6d64d52cbb1896b3c993e66166e5a23e7
SHA512 3b6f6daff7e22ec85e2afc28cb08eff28f43ea4bd3b0525c96c6925c3440f99b9fa5e6f458e8a392b0980995f80cbe44e86d815fbcf83243c3a5ac48f43c9011
SSDEEP 24576:B6DIXodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:B6DIXOR518/HFGcct78i6+dDoyLs
TLSH
T1C7F4010D237A01FAD1ABC13D85A30506E2B2B1609B5146DF4A44C5BA8FA3FD9F93DF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 c92df14d180d4083445c3fd5de64a288d328e8942479d0d36b7f6ddaf58998f1
MD5 fec03c513ee5b68cebd8ee921d1e5c93
SHA1 f407cd6f4669ace4ae71ea1abd70892d5eb537c4
SHA512 22661683d96095751c1dad456392ac7d3fd306a5dd9a654e56a5a861825b9082cb45306f101e9e91dd1c8e422a4a630e9ce9e40fbd6108c9f35a2d60c2231060
SSDEEP 12288:6G6kyXodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:TtyXodOEvx18/CkNTjacctck8DVk61nx
TLSH
T194F41209138819D9F7AA433899B356989B72BD106F4043DF4900DA2F9F33FE5E931B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 abe586bca66c17154fff40fb666db718823020c6a0eeb9388077173a696a8d02
MD5 5bb296289d9acd7dd5a4cde6213cf374
SHA1 d320979624672c474d88dc12727e994919f85d42
SHA512 16bdb8a959829a227542e54b0aff9e9a5e7c3828d76251301a87df22e8c57bce774deb12e456d45d56d39185aa9be0eaeb6a6444ddbfef6938549773f5a372c6
SSDEEP 12288:DFCodOEvx18EyA/k2eT2Circctck8DVrD7L9+61seQd6UdRyv506CkP1nt:RCodOEvx18/CkNTjacctck8DVk61nQdK
TLSH
T1C3D4230D024D0EEAE38A873454B63B5DA253B6546F8042D78D04CAA6CF63FE7E136F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7ed89bc9ba2ab136d8b59e9bc2662fddda63f79b8c18f8abaf201dc044b66993
MD5 12d3be38218ba304ad62e1a8c4ebdf6f
SHA1 c798e5f2800e6dd99a8c91228a0f7b70d5cb04e9
SHA512 1845c725bcc4e7dcd73dcc0d9f84934fbec29de0bb9140f73212e1d361b99a12551a2067020f72cb744d54a62b33c1a76e9495a2b918c2f2cd2d9b54a67911c7
SSDEEP 24576:xfgH+hoTfaidZnbodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:JgeqTrZnbOR518/HFGcct78i6+dDoyLs
TLSH
T16F558D1D63EA09DAE2B2D635D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 0a1a4e8e365bff5847374a31e145d7e98073714cfe53ba48c534074ee83dcba4
MD5 3c73ece9a0f3153cffa21929513ff022
SHA1 fb96647a36e9e3abedbfc08923f3e50687f91d3e
SHA512 38a92495c605da3e386922de907270ab607716caf187f6f18b6bb8f990444b67bf8813806cafb0cd8d86b357013f376bed95a0f11ca51fe996f35a91e99a7015
SSDEEP 24576:crcmRhodOEvx18/CkNTjacctck8DVk61nQdZdoB0Ls:2cmRhOR518/HFGcct78i6+dDoyLs
TLSH
T13805F10E726E00E6E2B7C23C88920659F2B3B030675153DF4651C77E8E67AEABD35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e630783e4ea7f5fb2c19c9c88074208e1ee57de96f31a33868ede42cf4c0c24c
MD5 570db80c3163837dda26103321e17994
SHA1 5a8208f86f54daec8f4cc054b76a4b95be779fb0
SHA512 123cd9eb00d47a3f024c242cbabfa704e393faf8f969b51148f098f080d7d8f306c2f67d3d24a62240425a1fb20bf7b6d41b831f11474408dbaacae1f68856c7
SSDEEP 49152:RDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3LOR518/HFGcct78i6+dDoyLs:i3Upow8sBlR518/XOhD
TLSH
T158A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-336-0x000001A1BC560000-0x000001A1BC5C6000-memory.dmp

Download

memory/872-337-0x000001A1BC560000-0x000001A1BC5C6000-memory.dmp

Download

memory/872-344-0x00007FF766000000-0x00007FF766320000-memory.dmp

Download

memory/872-342-0x000001A1BC560000-0x000001A1BC5C6000-memory.dmp

Download

memory/872-341-0x00007FF766000000-0x00007FF766320000-memory.dmp

Download

memory/1772-260-0x00007FF76BDD0000-0x00007FF76BF19000-memory.dmp

Download

memory/1772-347-0x00007FF76BDD0000-0x00007FF76BF19000-memory.dmp

Download

memory/1772-263-0x00000131A08A0000-0x00000131A0906000-memory.dmp

Download

memory/1772-262-0x00000131A08A0000-0x00000131A0906000-memory.dmp

Download

memory/1876-437-0x00007FF771770000-0x00007FF771A12000-memory.dmp

Download

memory/1876-319-0x0000027761230000-0x0000027761296000-memory.dmp

Download

memory/1876-320-0x0000027761230000-0x0000027761296000-memory.dmp

Download

memory/1876-318-0x00007FF771770000-0x00007FF771A12000-memory.dmp

Download

memory/1956-367-0x0000023246A40000-0x0000023246AA6000-memory.dmp

Download

memory/1956-366-0x0000023246A40000-0x0000023246AA6000-memory.dmp

Download

memory/1956-365-0x00007FF714220000-0x00007FF714726000-memory.dmp

Download

memory/1956-445-0x00007FF714220000-0x00007FF714726000-memory.dmp

Download

memory/2292-11-0x00007FF7D4A70000-0x00007FF7D4B92000-memory.dmp

Download

memory/2292-13-0x000001B05CDC0000-0x000001B05CE26000-memory.dmp

Download

memory/2292-12-0x000001B05CDC0000-0x000001B05CE26000-memory.dmp

Download

memory/2292-14-0x000001B05CDC0000-0x000001B05CE26000-memory.dmp

Download

memory/2292-66-0x00007FF7D4A70000-0x00007FF7D4B92000-memory.dmp

Download

memory/2324-283-0x000001F1ABFA0000-0x000001F1AC006000-memory.dmp

Download

memory/2324-371-0x00007FF6D59B0000-0x00007FF6D60F3000-memory.dmp

Download

memory/2324-281-0x00007FF6D59B0000-0x00007FF6D60F3000-memory.dmp

Download

memory/2324-282-0x000001F1ABFA0000-0x000001F1AC006000-memory.dmp

Download

memory/2932-348-0x000001908AE40000-0x000001908AEA6000-memory.dmp

Download

memory/2932-443-0x00007FF675D60000-0x00007FF675FEA000-memory.dmp

Download

memory/2932-350-0x00007FF675D60000-0x00007FF675FEA000-memory.dmp

Download

memory/2932-349-0x000001908AE40000-0x000001908AEA6000-memory.dmp

Download

memory/3036-3-0x000001C9ED6B0000-0x000001C9ED716000-memory.dmp

Download

memory/3036-19-0x000001C9ED6B0000-0x000001C9ED716000-memory.dmp

Download

memory/3036-1-0x000001C9ED6B0000-0x000001C9ED716000-memory.dmp

Download

memory/3036-0-0x000001C9ED3E0000-0x000001C9ED538000-memory.dmp

Download

memory/3036-2-0x000001C9ED6B0000-0x000001C9ED716000-memory.dmp

Download

memory/3224-240-0x00007FF7CA980000-0x00007FF7CAA48000-memory.dmp

Download

memory/3224-242-0x000001F7540C0000-0x000001F754126000-memory.dmp

Download

memory/3224-241-0x000001F7540C0000-0x000001F754126000-memory.dmp

Download

memory/3224-326-0x00007FF7CA980000-0x00007FF7CAA48000-memory.dmp

Download

memory/3320-358-0x00007FF717C40000-0x00007FF718110000-memory.dmp

Download

memory/3320-444-0x00007FF717C40000-0x00007FF718110000-memory.dmp

Download

memory/3320-357-0x000002B1D1800000-0x000002B1D1866000-memory.dmp

Download

memory/3320-359-0x000002B1D1800000-0x000002B1D1866000-memory.dmp

Download

memory/4468-55-0x00000245D1EC0000-0x00000245D1F26000-memory.dmp

Download

memory/4468-54-0x00000245D1D20000-0x00000245D1DE9000-memory.dmp

Download

memory/4468-56-0x00000245D1EC0000-0x00000245D1F26000-memory.dmp

Download

memory/4964-378-0x0000023FE3680000-0x0000023FE36E6000-memory.dmp

Download

memory/4964-377-0x0000023FE3680000-0x0000023FE36E6000-memory.dmp

Download

memory/4964-376-0x00007FF61ABE0000-0x00007FF61AD0E000-memory.dmp

Download

memory/4964-446-0x00007FF61ABE0000-0x00007FF61AD0E000-memory.dmp

Download

memory/5040-51-0x00007FF7A7170000-0x00007FF7A72D7000-memory.dmp

Download

memory/5040-43-0x000001A62FFB0000-0x000001A630016000-memory.dmp

Download

memory/5040-49-0x000001A62FFB0000-0x000001A630016000-memory.dmp

Download

memory/5040-44-0x000001A62FFB0000-0x000001A630016000-memory.dmp

Download

memory/5040-42-0x00007FF7A7170000-0x00007FF7A72D7000-memory.dmp

Download

memory/5108-33-0x000001546DAB0000-0x000001546DB79000-memory.dmp

Download

memory/5108-34-0x000001546DCA0000-0x000001546DD06000-memory.dmp

Download

memory/5108-35-0x000001546DCA0000-0x000001546DD06000-memory.dmp

Download

memory/5108-36-0x000001546DCA0000-0x000001546DD06000-memory.dmp

Download

memory/5280-270-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5280-275-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5280-356-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5280-269-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5400-290-0x000001C1755A0000-0x000001C175606000-memory.dmp

Download

memory/5400-291-0x000001C1755A0000-0x000001C175606000-memory.dmp

Download

memory/5400-289-0x00007FF7E1210000-0x00007FF7E12BD000-memory.dmp

Download

memory/5400-375-0x00007FF7E1210000-0x00007FF7E12BD000-memory.dmp

Download

memory/5436-335-0x00007FF761B90000-0x00007FF761CA9000-memory.dmp

Download

memory/5436-250-0x000001BD4F270000-0x000001BD4F2D6000-memory.dmp

Download

memory/5436-248-0x00007FF761B90000-0x00007FF761CA9000-memory.dmp

Download

memory/5436-249-0x000001BD4F270000-0x000001BD4F2D6000-memory.dmp

Download

memory/5444-316-0x00007FF7CA980000-0x00007FF7CAA48000-memory.dmp

Download

memory/5444-233-0x00000267F9260000-0x00000267F92C6000-memory.dmp

Download

memory/5444-231-0x00007FF7CA980000-0x00007FF7CAA48000-memory.dmp

Download

memory/5444-232-0x00000267F9260000-0x00000267F92C6000-memory.dmp

Download

memory/5540-384-0x00007FF687210000-0x00007FF687626000-memory.dmp

Download

memory/5540-300-0x000001E480830000-0x000001E480896000-memory.dmp

Download

memory/5540-441-0x00007FF687210000-0x00007FF687626000-memory.dmp

Download

memory/5540-438-0x000001E480830000-0x000001E480896000-memory.dmp

Download

memory/5540-299-0x000001E480830000-0x000001E480896000-memory.dmp

Download

memory/5540-298-0x00007FF687210000-0x00007FF687626000-memory.dmp

Download

memory/5656-310-0x000001DBC5D30000-0x000001DBC5D96000-memory.dmp

Download

memory/5656-309-0x000001DBC5D30000-0x000001DBC5D96000-memory.dmp

Download

memory/5656-308-0x00007FF6F2440000-0x00007FF6F24F3000-memory.dmp

Download

memory/5656-386-0x00007FF6F2440000-0x00007FF6F24F3000-memory.dmp

Download

memory/5664-26-0x000002BD5D690000-0x000002BD5D6F6000-memory.dmp

Download

memory/5664-25-0x000002BD5D690000-0x000002BD5D6F6000-memory.dmp

Download

memory/5664-24-0x000002BD5D750000-0x000002BD5D819000-memory.dmp

Download

memory/5664-27-0x000002BD5D690000-0x000002BD5D6F6000-memory.dmp

Download

memory/5988-387-0x000001D14CC30000-0x000001D14CC96000-memory.dmp

Download

memory/5988-388-0x00007FF7ECAB0000-0x00007FF7ECDEE000-memory.dmp

Download

memory/5988-389-0x000001D14CC30000-0x000001D14CC96000-memory.dmp

Download

memory/5988-447-0x00007FF7ECAB0000-0x00007FF7ECDEE000-memory.dmp

Download

memory/6028-327-0x00007FF71A290000-0x00007FF71A424000-memory.dmp

Download

memory/6028-328-0x0000021C92000000-0x0000021C92066000-memory.dmp

Download

memory/6028-329-0x0000021C92000000-0x0000021C92066000-memory.dmp

Download

memory/6028-442-0x00007FF71A290000-0x00007FF71A424000-memory.dmp

Download