e7d495aa1841a777a2f310817e01df94facb94db2df0654acb615d4c9ea6224d

Analysis

max time kernel
138s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe
Size 742KB
Sample260908-eb4mqsch23
SHA256 e7d495aa1841a777a2f310817e01df94facb94db2df0654acb615d4c9ea6224d
MD5 df3bbb31887c4de15f750eeab7439de7
SHA1 523963ab1423f0f9bcc298f4cd2a1aeec22524c8
SHA512 c2a00578e804ca59307dc77f042f856dc08c6495c639b012d58df5a8e9194bfbf6361c05a67f93bdd39814f8f056e9cd9e3a89d2a07b2773e5a678d72c440639
SSDEEP 12288:loNBnHmI0nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:eNX0nxD1vwakNwkqIivzksIBNyHq82
TLSH
T19DF402A7779524F9E0FA8278D9621901E3327C76072056BF07A852751E232D26E3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1048	alg.exe
3296	elevation_service.exe
5128	elevation_service.exe
2180	maintenanceservice.exe
2640	OSE.EXE
5932	GameInputSvc.exe
4644	GameInputSvc.exe
3076	msdtc.exe
4520	PerceptionSimulationService.exe
2104	perfhost.exe
1384	ReFsDedupSvc.exe
1644	locator.exe
3912	SensorDataService.exe
5252	snmptrap.exe
3736	ssh-agent.exe
4152	TieringEngineService.exe
4216	AgentService.exe
1200	vds.exe
1036	vssvc.exe
3536	wbengine.exe
440	WmiApSrv.exe
5228	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\baf1e5b3b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4644	GameInputSvc.exe
4644	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3128	2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1048	alg.exe
Token: SeDebugPrivilege	1048	alg.exe
Token: SeTakeOwnershipPrivilege	3296	elevation_service.exe
Token: SeTcbPrivilege	5932	GameInputSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1384	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4152	TieringEngineService.exe
Token: SeManageVolumePrivilege	4152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4216	AgentService.exe
Token: SeBackupPrivilege	1036	vssvc.exe
Token: SeRestorePrivilege	1036	vssvc.exe
Token: SeAuditPrivilege	1036	vssvc.exe
Token: SeBackupPrivilege	3536	wbengine.exe
Token: SeRestorePrivilege	3536	wbengine.exe
Token: SeSecurityPrivilege	3536	wbengine.exe
Token: 33	5228	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5228	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5228	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 4644	5932	GameInputSvc.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3128

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1852

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4644

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1644

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3912

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f56ecb0385e77a5d0a02967146a6068413253c60f7bed17952b3ce34ae6b88f
MD5 d88c2d212d5545ada44275531bd32b54
SHA1 2c9ad837f99ce0cb1bcd6e53842aaeeb35d3261f
SHA512 3fa61c38244713a9d2b13290a279834769d655de008ef57a60b64b02e67d1bb0b7dca6e9642d9d8350e99e71150a54dabf23589690dedf1f238994153cc05c4b
SSDEEP 49152:Kb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnXxhoaEWzQNsq82:83q6gjBaxhAO
TLSH
T1CCD59D03F29900E8E06DD178D7469132EAA2BC890B34B6DF0794B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 e98637caa6d0b40e324734cec7c132839c3a568f8391a86c0c6a731f6f171277
MD5 ab77c8c922a04cee62a58f5acb6f66f5
SHA1 56067c9944252462d2ca4c095adfb82802c25cf1
SHA512 5dfe69a2d14d5aab0f8e153ceb9818903bb089b3ae685af866f3ba0259f448c35f857b7306bf232737a4f1378bcc8d846c657092dd6dc88a4cd4e82b9a2f2cd4
SSDEEP 24576:PXYfDtczADnxD1vwakNwkqIivzksIBNyHq82:6tcoxhoaEWzQNsq82
TLSH
T10005016877D508F9EDAB817CD8A38911E633B8510360E7AB03E895754F233C92E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 159b4c0f088b27b72a5e84a3c831a3d291dda51b650c794d691ef78ec0f4b6bc
MD5 d3c36f132b743bb21797f30ae572236c
SHA1 8aec50156ce22b510dab7255968a2c907dbf7682
SHA512 6fdf98fefcc07504e208ab75d259be00e90617186ad5a709377406038a124d674a5e8646c4e24e6cea0cb733bf368c9bcbf09304a7f4c35a7e9d1834b7e51375
SSDEEP 24576:j0SeKcP0DmxOrM8nxD1vwakNwkqIivzksIBNyHq82:jHcP06ozxhoaEWzQNsq82
TLSH
T1B835AE66F6788735D073C0B9C5D3A69AE971308217308ACB4286D77C7E277E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b31b4262d89d8148a72728279460d245897a4ac1884521c805991d68b54833fc
MD5 3ebcfbcfe37cc1bf641201324b78528b
SHA1 bd3f1fb91b4b87a32644b701c43ef2fd5618df1c
SHA512 2c05dee5b3c08531515b0ff6f51cc040a211958c31ed1a3d33b1a1b41b33a56ce831dea04990976d56696def2a096a7ebe2325babf774bc4cd6be768773061a6
SSDEEP 24576:o95/ezSC6vUyD/aqgrvW/6q8wyufnxD1vwakNwkqIivzksIBNyHq82:+/ezSC6vUzPvuHjyqxhoaEWzQNsq82
TLSH
T126756C25F5788323D0B2D0BAC5D7AA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a210c02d44bdc15e1fd5b7a59808783ff190f1b0353c4b111ffc18be16ed516d
MD5 d2cb25596932c0f2fd42db2b9ba2c4b5
SHA1 51e020f70eb78d72865139799d3c42ffae47c389
SHA512 f3d2d5e6657e93ef1f1cc142ba071baaa0bbbbefa22a304dced698a484dba4c52004d18b393e302178e394112502c1db1508ebed93ee486ec37846dae5ef4fbb
SSDEEP 24576:eAb7PtC3Zv/l+dDnxD1vwakNwkqIivzksIBNyHq82:eANC3ZXl+hxhoaEWzQNsq82
TLSH
T19A559E66F5748331D073C0B9C4D3AA9AEE3234425B318ACB124AD76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 1576c278160c0a91dedb875b504a2d706fc2d2dc342a32f6722fac8782541e97
MD5 e2be883d42b8187a23793643473715de
SHA1 f15c48389e9133831e29d1a0ac8ca2948cffd08a
SHA512 b4862416c579e3592e1623c1e36cc52946b36dd4f3d636e737b69a0caf2c0869f3af3747c457480fdb347b8b9ee1641a3bc9a7b38bb7dde91493214fae9cbd3b
SSDEEP 12288:Q2lnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:Q2lnxD1vwakNwkqIivzksIBNyHq82
TLSH
T16BD423F29B0E09A8FBFC55B8B1F75E2052248E26100148B5ACBD76B5843614F72DEB7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 26c77a178e2d79561ee0643fc9a82bfa759b55813c9007fe6da5befd381250de
MD5 7ff1ea06e06bc892ce21c3e3fcf15883
SHA1 483ce95a2279ea1251c32790dd459b3a948e25f1
SHA512 89f1635762078fccda83e16383362a56fd3d1a3463a842862ab4bd12a69c659c3d2da315ac561ea066f726621c2f784a287fdb5910413cf7fa93f26207bccc34
SSDEEP 12288:veBNUbTVO86U/nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1FaZ:vJIU/nxD1vwakNwkqIivzksIBNyHq82
TLSH
T18615CF7BEE28ECD2C2BE8DB856928600D77278304B1293DBD179831ECE235D51E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 75e2f97e9bf44f5e33dbca47f3d08438b79d845404b384c27b1dcf3f525733ac
MD5 f26d8a2a7e55ec1c58fdcacafaeb1001
SHA1 5c94d2262167466cf375dd29e6dd0da921879e73
SHA512 a31fe61021c79a85d3fd381f76cc9cdaec68b2b3ab7129503ab8e1fbbd7843215df058457592479ea6f7731fce77cf06290cf995a205cf0d7b2b8135a2e81de3
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5JtNRV3THI:XQvGAdlCEL8c/yRN55CwxhAO
TLSH
T1EC367C656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 a0f8e5625ecad2a7a79b70ce60acc3413d5ca57798330ae7f99c6907a535d73e
MD5 bbdb88881912b088f7e1a6b523ae167b
SHA1 c27d3d26b0aca7f7ae1b358eff360f0a77979ef8
SHA512 25f480072ac40573127f5186b822c887a40d905479e633b47539ca2e4a3e2917131ce4fe8121a791bf427a3ee357eda628b488934d0d4a0a04e891f83fe36222
SSDEEP 24576:CmewsAjVnxD1vwakNwkqIivzksIBNyHq82:pljNxhoaEWzQNsq82
TLSH
T12C15E071FE75D436D6BF0DB62B76C716142CA9200B5119C3E3EC5AAD49302D2237AF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c85dba9854b79a2bf0b00ff11ebd3d37a8b08fdd2d2abcadc4cc7499d89495d5
MD5 6e6474886bbd1c8b07781774a8344ade
SHA1 becd024f3f02a61039ad16fd8bd7e332fcba9193
SHA512 96436518c2af0bdbc72ad278cd94578c2fc48199f5cf8ff5f034a13e9f4140e4bbbae0591d70b8c9b49c192c6c38a3935ee8440d51c4fddd853fac3ed924208d
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrddPlbuJHtO:xUEtQevvqc2W1cpV2Xrv2t
TLSH
T1BA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6823d1dc26f88a757f8294edccfdaecfecd4ebd53a422a29b48f1b951e47f646
MD5 e23b36a8c5cb74c31647bd8b062e334c
SHA1 749881ddf8d37a9119ebd28c79272229a0fe74df
SHA512 e8e20b2786d9bb6021dce0a8b387e56579de40cf09ee4d4036c6dc9d5a546eced90272c79f8da9d6c3eb75d4831421405b6989c4d5015e5447c9af2872005cfe
SSDEEP 49152:PXbRquA/m2yL5zMfFiV+XenmE3/z8uxhoaEWzQNsq82:zoq1VjnmTuxhAO
TLSH
T15BD58D1976B882E4D1F6C37896A2CA47F37178154B3097FF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e57d3c369909ac532d5664af680851edfa9e8602b4c34b87cfcc416d6ab756db
MD5 37db6ef30337b317fb1dc53493f3af38
SHA1 7773e35ca0cf91951ee76850358a6f8eda751f38
SHA512 d3303c8c63ff9ad4142cb9512251e66ac4fe569a1c0870853f8d1ad3ce1beddddd48f37b28ceaa048fd7cfd6f9db3de0ad5dbca20648047ea05cfa3a390aa45b
SSDEEP 24576:BAhGLvjFoiwtA5l7S531nxD1vwakNwkqIivzksIBNyHq82:BAM/Foiq59xhoaEWzQNsq82
TLSH
T14A45AE80E7F945D4F5F7AA7899B68570EA76BCA61E31C21F2164D11F0E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 df77de9df668acbc0f1a78109a667a54fc7a5a72f59e5456c5538743b9e91d79
MD5 c54ca5504c93d5cb375a2e5b3ae06e97
SHA1 fa315799cfaac1348b275116e1d80b4e1ef364e5
SHA512 31f4038ceefaa0bb83780763f5c293a7c52393eabcde7300e69c003f0953ae9dd5eeb2165257a741020d53be66ca9a4bb5bf855e2ed5386318ad109f2a31fac0
SSDEEP 24576:lwuROWwnxD1vwakNwkqIivzksIBNyHq82:lwGONxhoaEWzQNsq82
TLSH
T1AA05F19677990CF9E9BA8138C597C531E7B2BC122621C72F1764C66B5F332127E2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 e43923ce8039960906835d249589e73b1f42a9e529258d4618b46cb7c34768e5
MD5 bfc84abcda99dd2f57efefcbca32b856
SHA1 166a3f8fc454b55507157047b030cb1fc3d7fb7f
SHA512 85899b085ef7a1e4a52fc1c010c7e217da80047ab10ec715307e5622d49aa8956c1b49a11671a767bb11afec5abc943f8d7ca330b08a20e75839a69d3d891ad1
SSDEEP 12288:QPw1IOjnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:YwuUnxD1vwakNwkqIivzksIBNyHq82
TLSH
T156E412A6279914F9E2EE5278E9F35A00D3717822233143EF196942B54E236C73E3DB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b15ad1740ddd96c40b2ca244c37610500bff55a630af0dfe14f245c81a4c558
MD5 384407f0372e76ab42a11b6922ea68aa
SHA1 15ac3cd18430cd544f5700cb88a878ba614ba9f6
SHA512 252e49375defb137aea5a4013423e463912c73ef93289d0542bd1a075eb188217238483a80854ebc71e5b83f605a46cf32aec181b2f1e1c492b43032703b3894
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U1:6QRQyi36YOcP8Lvw2gAf+PN38xhAO
TLSH
T1FB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e3779866a3c86fc5f460ddc446a79129d5d9060d32009432c089d213f35e9315
MD5 3913c030660445cb96c57a8fbfde8e29
SHA1 66976e78eb71a52cf574c502e9d9c894e7830fa0
SHA512 8579f8820781dd481d1328dc864f77dfb02724202d711c4528c2128e97fd6abe0a9d25c6ab175946c1b0afae8cf91254d4aeaf5e5c379d30c7af245dffa134b7
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uc:6QRQyi36YOcP8Lvw2gAf+PN3fxhAO
TLSH
T16B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7f6ed12a476b82de4854a24448d26d519099f99bd1fcddbf49da004a6383fdfe
MD5 b852097f8ac4ef79afc566c6b876f50e
SHA1 3ceb229d9b0fbaca3f6d293a7af8a82af2e0eebb
SHA512 b21ac4fe3f67dcf49c6a386c073b40d78dcc3d8709f2b2fb42dad339174a4fe8aaaac903fae3c4dcce48ec3b75e7297ea5d97f5baa0eff271a93c6033a2ac9f4
SSDEEP 49152:x68Qg55nhMeWu7PNU3/hxhoaEWzQNsq82:vthbRc/hxhAO
TLSH
T121B55A33B2F600A9C44DE1769F4A873196D27C718FE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 24c07ea34355c42772b362848af9ea08df0bb645df5dc97e99e0da7d788df9d2
MD5 3e96f55c9bd4cd721754fab35272be83
SHA1 cf573bc478b0b39066cb8b9250f1f2b2b1cb386c
SHA512 e072c8e9e8e940673dcd224935e453ddac264bc40c53dd9a374d8d4bf9c21a892829ffbadbede40592f4018059710b0cbff151bf4abf42f49b993683f5d64b2e
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99R:Uy5112gYy5azzVv569nLKnhZDxhAO
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f64ab0057efbe6a1eb52ff66ef04f9eb752151ffa918618a5313f2cc534f793
MD5 3e830b08afa40610ae748230b3a41d68
SHA1 0da6fa23dcaa9644b6fdc63050c64a43b6fca46a
SHA512 e8c6fca689988c06acaec0667f0b5c79e2495cd0eb76f72203e7ba202d72e4f4fa5720b3d54f8c7b46b020dd7dbe03a6228784de68c838b3afb7e7d3a1d54d2e
SSDEEP 49152:5B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glrxhoaEWzQNsq82:vu6JmTxd2drxhAO
TLSH
T180D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a1747426c6902ee0167d6e65f4c2857274cb8ff3a34e4e7280c607eb2b1c37f
MD5 b4e3d8296b21c4d9d044eb6349c7c0a1
SHA1 7804cbd9dbc2c92d1ea9c83e8372f1e8c980924a
SHA512 b2b5e772528bd32d1e14234a9cf4ae28e8346c1bd974a30127c02ec45587aee5106809d7fbfb25372edf21c2be8276ccad1a47be43ee75b610b423bc47490c02
SSDEEP 49152:n1hpsNoJpF1A6UU44CwH7R4xBxhoaEWzQNsq82:nmifPbRexhAO
TLSH
T126B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 34c04d1def3840963788b8a6ceed76fd5a6eccdf30f7c184a604c3938c7dff2b
MD5 65eb597169c49271bd8e3b412077a963
SHA1 76dfd754bc3ebf2231b8cf7c5e7088047d0b8af4
SHA512 542c2c14026d925ee00bc548a46fd82ffd3ef6dd1ee168dd780a5e3be2e1422bd37b66b9abea8aeb9069c6e977c030fed7fd1e285c0479b08208e6c8fe820483
SSDEEP 49152:5SuZQIY0Be2K6RVtOnks6NMHq3xhoaEWzQNsq82:X5dKoi613xhAO
TLSH
T146C5BE13F2E900E8E0BED67887669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 56d30cc57f5d1e1aeed2e5d3cd50f4096340b867f347eb14751cb78279031a19
MD5 9256d036fe41d9cfe4f7bb56a365aba4
SHA1 830553be1b15bf8727c056f44a7e80719720598e
SHA512 e3acba06a0ad41c6f8cbed4b0a72fd7f699946f6ea4bd6af4c5c0e937be3cf415a2d2275d3610459a36cfa1baf84ff7c81f61ba94d93807235be27627b8643c3
SSDEEP 49152:KhtSn8EApI0figTgiDn0AP5wjxhoaEWzQNsq82:rX2iyphQxhAO
TLSH
T19CA5CF13F2D900E8D06DD178C7568632E962BC160B35A6EF0A90B7561F3BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 8e36552fb8f5a18091fb3e0c9cbc6493ca39cdbdc0e1325beb64ecb2daae1908
MD5 244747efb65fb5d5f3040a49407de4d6
SHA1 98d50d13e57df05db36d68e0f4605d8c2b2004f1
SHA512 3870d8da6599b8460a7ba87df6c60217165b7716503a920e84713c5beaf9b995329801bed1661c2fd9cb7f2997eae9ca5120c93a9a471ce9dcb7a6b47244e5cc
SSDEEP 12288:jGWnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:jGWnxD1vwakNwkqIivzksIBNyHq82
TLSH
T12AD423F69A4F0D9DF6FC96B8B1B75E2052244E27210204757DAE62B1842714B339EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 6935ade041d4cbb8aeb02250138da4d9ba488cea8a38acd67141c974a386f66c
MD5 76c2a108a2d7eec9a9e597d70ebd3f3e
SHA1 eb45c41f4e29985cdfc2e861348c43a132905161
SHA512 ff3964cb6b5815296f2d87e8aaed612c65d4b2dc8a87b33e19479e846e86d1220e03e4f9e29bddc5a93d5971a77a350cf820aa32741868e38cecf00cd10d94aa
SSDEEP 12288:xSWnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:xSWnxD1vwakNwkqIivzksIBNyHq82
TLSH
T120D423F69A4F0D99F6FC95B8B1B75E2052248E27210204757DAE52B1842714F339EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 f26e8498bce1684adf0e3e17fea7ab528af32f6b68e714b2f4758b417551fffe
MD5 c1892743422d5d3b99fbd17cc1b36d8f
SHA1 b9182aeacc984915b59d4c26840db8dd21689a09
SHA512 2ab6f12a4039371b4172189ccc80bbbd046dd57dade8af0a573413c164cf4516de7db38632eff8b3bf8b6de647120c73035b7e556904c90a41bcd2fcf55b3852
SSDEEP 12288:7hnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:7hnxD1vwakNwkqIivzksIBNyHq82
TLSH
T105D423F69A0F0D99F6FC95B8B1B35E2052248E2721120475BDAE61B1842754F32DEFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 ac559df324e993fbf1d833588476b62a55ad693ddfc79b8f9c46ad61f93b514c
MD5 84f4ac501728c703ee980b755117a33d
SHA1 536cb878635e986b2b694a0415c0c6b673eb0cfb
SHA512 c4cd5733b46d831e29072eb644d1df7d6535c36deea2663cf6e094788e7c60b006759ef8738e556b260de2b01d0e205b9cfc216d5a0e7ff02b443dd4ac3d83fa
SSDEEP 12288:XlynxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:YnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1C1D423F26B0F09D8E9FCD2B8F5B34A209274BD661122457FAD6D11B5482320B369DF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 02deb46764aaf197c17cb151e6cd6470ba0b588b5ebd4b2bdda23495fc4751b0
MD5 7ac6b0b651c69c2e548509fbbc3287cd
SHA1 6164ccdeb0a6cf51eeea019b30b48e60e8bd1bff
SHA512 911496856bf3dd9f4cde5f4a339e7480ba4774476f51407297d250d4212a91014842517e66654540dfe515f3d8bc1c95ca7572c3914ba085c8d1d5b4b255e010
SSDEEP 12288:adnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:adnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1F6D423F69A0F0D99F6FC95F8B1B75E2052248E2725020475BDAE6271842714F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 0812ec9582c2c19c23795920410f73e75ef0e950d24085780b0d27791348bbf0
MD5 2be0654ff7e509af864d1f5620898a62
SHA1 00478612fcd8ca2f8832bc89aa5939cc6428d6b8
SHA512 90db68334c06764f0c6e05d2ac2735bd406d5c32ee715a4fda60a505df3cf27e078f5f14e4767406916d93235cb476679b0a610693433cf8a3624da4b097860b
SSDEEP 12288:5jnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:5jnxD1vwakNwkqIivzksIBNyHq82
TLSH
T11DD423F69A0F0D99F6FC95B8B1B75E2052248E37250204757DAE62B1842714F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 5bc1d89feab70b66d4e1266c891c0f93afc6e3eeb01dae16b1bbfb9156cd813e
MD5 847a8e91871f98c623c2545820c9a81c
SHA1 f72f1757e7093e1af1ff270d50b157105043d5f2
SHA512 2c5baeb70f28c48b33758501ff4486aeed0728f8e03a458ea8eac624f867dc1f4578d35ec81ed33b54550108a53c3a7b01c5bf33340387aae79542a26acd9f9b
SSDEEP 12288:+jnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:+jnxD1vwakNwkqIivzksIBNyHq82
TLSH
T102D423F69A0F0D9DF6FC95B8B1B75E2052248E6721120475BDAE52B1842710F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 74ad0e9a4ff275d10e743f8d34642a5dc2ad7e18c53525629b29679cac368f5a
MD5 9cb794df4f5696cc04620355029e114a
SHA1 a18947cf8de622c85eb9a4185b6ccc1d95d08cbf
SHA512 596b35f15806da9fd3d7065eab57b3cdb51ba35ca7dde0bdb8da48b3fdbe043188a8941d06d684d3a7df6142271223a5552e192a24cfbefe539a78cc0ef71668
SSDEEP 24576:BZMPzFbSHxnxD1vwakNwkqIivzksIBNyHq82:BZMPzRcxhoaEWzQNsq82
TLSH
T14615F1A5B3550CF8ECAB813DC9664915D2B27C260660C62F17F836764F333522D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 0349402519db9ef0e16e86bd83914c71bdd968bc7f3d55ffa6f397028d3ca93f
MD5 6735ca259e7d25dc22ac44d1e5767069
SHA1 91af99ad5f7916b7bf6abb29a2cd49972642f1e2
SHA512 bbe8166caad815eaf448165eed638f103f65986ff01f56f66b4bd1f90e9a23256b54256a8120f89ec42e3319913ee974334c227ff411728ba6d9b7669c97b157
SSDEEP 12288:pVqnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:pVqnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1F4D423F69A0F0D99F6FC95B8B1B75E2052248E27210204B5BDAD52B5842714F339EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 a412897b883e9a4ae3c00309e214ad987945dd9831de63185dc43084d04bdbbc
MD5 d7408f0860199f363423a1f45574a4b8
SHA1 8d20b3aed0af32b2f9a5dd7dfe772c7d4587c807
SHA512 f1e42fe70c4748deae0312472c64172586b1568f13a4f3589d958bd3a2bad203ccaab2d8a633ad7a6b633c71766638aa8e2353939058595261a5f03607e50877
SSDEEP 12288:7FnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:7FnxD1vwakNwkqIivzksIBNyHq82
TLSH
T120D423F69A0F0D99F6FC95B8B1B75E2052248E6724120475BDAE52B1842710F32DEFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 8589447e5b08f093574627f483ab66acebf91f8051e2574a828d78b8663f4617
MD5 f9157ab509a242ade5f037226cb7ae9d
SHA1 89b095be4524438b0daf769f1d8e7c284681c400
SHA512 c6022745d07c07ed5aad92e04d041a4b76f9a4dc2aa7b8854ec2ec241c31e3fd9542b8005a6ef543aede2a4686d28677441fdb6de46e3560d5007586ca183a6b
SSDEEP 12288:xLPz5L8NnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:9zyNnxD1vwakNwkqIivzksIBNyHq82
TLSH
T121F40297775620F9E1BE9278D4A31E10F371B83607204A7F57A803761E232967E6EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 5f79e503822d43ce8b0c61b7620edb352a31bb6a043fdc3846a9a2f8277c1f96
MD5 3a5304189e63245c9c8b6d4294ce8d57
SHA1 af504e721a05ee02aadebe044a407ea030af844f
SHA512 d14363a8f8a1a8316c4ce592c46a8793b9235eb55da24b2a5ad0ef3c57f9797d820adae835abb08af8b3beaf7e3143252eec932e3642f868f131a9e2d55d68ce
SSDEEP 12288:VKnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:VKnxD1vwakNwkqIivzksIBNyHq82
TLSH
T170D423F69A0F0D9DF6FC95B8B1B75E2052248E67210204B5BDAE5271842714F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 08d53ee52473cfc72f5aa50d05e78b6aba213b41f47ee305005d6468a42094d5
MD5 28b9b6c205d5523bdfb4d2a608b85714
SHA1 b87b96ede5df5b0cbe4ac9de3ee27db3e837e5b2
SHA512 e56327d7cbe58524a22c34d9b65ad4a5ebe944db874ed2c1f21086532743b2459d309c04996217bd21a33a7a26f911960a04b819d368a8fc829f86aaacaf01ea
SSDEEP 12288:JWnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:JWnxD1vwakNwkqIivzksIBNyHq82
TLSH
T173D423F69A0F0D9DF6FC95B8B1B75E2052248E67210204B5BDAE5271842714F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 098caf975281b90a76894a97b9c15f6fab8699decffb8072527c5418ff1c8c3f
MD5 613a6b5ab328c3f76eee69a6c7675ab0
SHA1 992d516d920d74764051d2f0aed0d1db443f77b6
SHA512 eeeedd8fb82a122d0dfa400f29f4273803a59bc500f6d6d062541c585bafaad8dda52429598289c2445d0177b41ded82bc31ddeac8c01662cf9325d61988111f
SSDEEP 12288:8LPz5L8E9nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:szy6nxD1vwakNwkqIivzksIBNyHq82
TLSH
T16FF40257775620F8E1BE9278D8A31E11F371B83607208A7F57A803761E232567E6EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 c85e2115bba00ceeebbb0eb4fa71029411ff2df0967fbec77206d0a9081f3a74
MD5 5369edaef7dbad81fa64f2ba75c60a7a
SHA1 c90cadff04b0a2cfc7846f1a281f5eb7e063db5c
SHA512 4f5147b64eb43caa25cdf8a8aaad2b175f9fe4ec2d03237e8bdf67bc33a74f2105a5866dffa568180c61c78287e7b53a2d77c1660a2b0fb4a79bb153f5f253ae
SSDEEP 24576:cThaLo3z0zmQnxD1vwakNwkqIivzksIBNyHq82:cT8Loj8xhoaEWzQNsq82
TLSH
T1CC15F1A5B3510CF8ECBB817DC9664915D2B27C2A0660C62F17B836764F333512D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 bd539fb224721d18abbb55a70a72328d989ae6af6725f84e74d825a775c396e1
MD5 e3905ec3b6a05ff422656cada7a349b5
SHA1 0b1d92f5cbbac37543dc738928a7c38e59796c1e
SHA512 14d8e87cadabaaa76104acebe48c4727143f50cba598a0cfb5c35d7dcb5f1bb7b254b41f611d493ac8d77d1bde14109e7db204710b5517ec7c00f11dca5e2b27
SSDEEP 24576:w3Ud6CHFy7/ZjnxD1vwakNwkqIivzksIBNyHq82:6Ud6CHFyzdxhoaEWzQNsq82
TLSH
T1F835CF90F3E814E8F0B79A35C9724511DA767C5A1B21CE9F03A8266A1F336D19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 0bdd52ef9883f8247734449923a070dcea34c22d62f42b61eb3f29d80169a1de
MD5 a40a407d61e45a94fa2bfedf9a06e4b9
SHA1 73e7a5f686dcfea974ddf762fb20a683d5aba44b
SHA512 47bd128e7981b72f444bdb56d41cbca02cbecd376757490098c925ac26c8d71ccd883d5d8a18cc5203cfccb0bc37b89a5a3e83c3cce28759a942a084d25b9e88
SSDEEP 12288:NtnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:NtnxD1vwakNwkqIivzksIBNyHq82
TLSH
T176D423F69A0F0D9DF6FC95B8B1B75E2051248A2725020475BDAE62B1842714F339EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 d6b24a049f9e0c81f046e545b44bd70a24acb0e84e7a291588c77a4ee918c269
MD5 bf193a4740814f741b19a07a68fbfc32
SHA1 901a5313f426803f070324efcdd39561db3863ce
SHA512 d14e60e768012e55099e6a17bef768816abcf8ac09b85fdad6257a01443862fc25fd9ab5aaf7cfeba13564e3d21663c19e023c1c7f79fdf121ac3d54632a148a
SSDEEP 12288:bZ5nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:bnnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1D4D423F69A0F0DADF6FC95B8B1F75E2052248E26211204B5BDAE5171842710F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 d0c99614b011b5f98dc70fa3efc2672a6e4a1118cbaf85f765b60e56faaa0529
MD5 0296f4b5fb3461caa7e4cf9c114c717c
SHA1 e467f5bdf2da4a2fc576e5532b312f97be2e09ca
SHA512 ec73ee33e9bb312431622ffaed0e531ca4670837adb778479bf79126642c5fdc9f926fa6c0cb11f38c92efa22f56c2bcf6e8036f5fa8ca758666a5282669e9cb
SSDEEP 12288:E5nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:E5nxD1vwakNwkqIivzksIBNyHq82
TLSH
T175D423F69A0F0D9DF6FC95B8B1B75E2052248E67210204B5BDAE5271842714F329EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 2c457e9291546b9080e02fa21d2fc89b47b5976471afb31d0c053ad62bd38bd1
MD5 d5d6ad904a8a85a4086b99796ac3d990
SHA1 4f1f557ceffd9b7454e0e9ae38f6f278882ac22d
SHA512 e8d52fc6fcd1c26a6b28e10fc9ad59c5a0a3fb3ab162944107fe4581cf6cba49ac32bb2313ac3a62bb5789a458b1d2de602992c816220ed6c0cfb42f9478ac62
SSDEEP 12288:TwmnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:T3nxD1vwakNwkqIivzksIBNyHq82
TLSH
T1F9D423F69A4F0D99F6FC95B8B1B35E2052248E67210204B5BDAE5271842710F339EFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 cdac3350b61ecf81380875bbcdd3fcb4030c3f7ecad1334cfba8a9c8d16c4ebc
MD5 d92d1a25450af876d2c12fc238f4fec2
SHA1 4b2bc4ae838802f24056d4d38e3591b0967f2334
SHA512 024f584ee0e9bd0de3ec642fafee68aa98cd9fc9a9b03ae03ce2f2457fc7084efd1056d21834e1e89fc15b6b74141b6bdb2692c9a124889ead2d15825a210665
SSDEEP 12288:gTsfgnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:PgnxD1vwakNwkqIivzksIBNyHq82
TLSH
T195F4F159D24902E8D0AE6178D7964A00B3337C2553E1C3DB66D4F17E0F362856EEEB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 2814db92d76fba0841b8e4a7d213a20c6cdb1a2c2a0eb44aaec795b7aacda605
MD5 d635d02b780a8a955f4ed4a65c3b275d
SHA1 9732f069c1f50da17d3d8167bcebb3aa9c085a87
SHA512 4f752a440ea6380bd54d5a22c15da42b68552320a249d87e88f7b34efef5c079b0461133df07b2b8b3e49622dfd34eecd55fefa6a7a7ffa81451648e6b2e0368
SSDEEP 12288:c67MnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:jMnxD1vwakNwkqIivzksIBNyHq82
TLSH
T182D423F2DB0E0D59F9FC95B471B74A3012299A36170144F7BC6D22B5803258B3AADF6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8bebe9bf1734dbd266f8eb8d051fa49f0ca4e0117927c38b2dd8c6608a774224
MD5 3caf13407829cb5553d853b14ba27604
SHA1 6b037fed5af6d7287ee23200ea597a6ee4692a4b
SHA512 49b1d5b30fbb38c5b749083428b65bd1108e0a7d219bd9f27b2aa47f9bec3cd14af38b52f50a57c45693fb8f43f0cafbfd48431431433a16872055dec29bd8f0
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYlKnxD1vwakNwkqIivzksIBNyHq82:Zgb4mBIBhGFdxhoaEWzQNsq82
TLSH
T175659E1E22EC02F5E0F9E2B89DAA4417D6B278160732D2DF1151427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 eaee3df5bb6026d64dfc8fa7dbfa8cacef9fbcdc0c75dca2ccc2fd6cf45435c8
MD5 531207a6c31d5e91144d5ee95df34915
SHA1 81590c689982f6f80aa6ce4e10447fcd07e2e8df
SHA512 b265f85a989a7bc48c644a90a824af28da1e223b6b8d7393159823e5d943e1ee3303fa07496e5ae4a4394430764e076576cef993853f77fe92ac6d600e112c59
SSDEEP 12288:9zGcnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:NGcnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1E8E422B9669B28D8E9FCC2B8B0B35A2071307971131014FF58EDA2758A265D6337DF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 3f3efe8444bc29ad8eb9a45adadeaf33439c8139035f536baae60889581c33fc
MD5 8378797d50ccb49e068c8ed359b3072f
SHA1 05fb27a6c651c2e8fa6617a0b73dffd741db5145
SHA512 e1f89334c78d79249664fb185a324f04041624592e507eaaf60ec9d3ba560a6268ba943eca26bfeb3b762c6de9219250012e7e2a1b0d1641b1a191f9bda6cf52
SSDEEP 12288:KlnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:KlnxD1vwakNwkqIivzksIBNyHq82
TLSH
T155D423F5960E0D99FAFC96B871A35E2052148A36131205F778AD62B180175CB37BEFBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7314d221eccb018df744f2a95110073731084975092dc450827eb1394233b105
MD5 e9a868864bd2d834fd13a0577bf3b091
SHA1 d6c52d5b869ad36b07ad35212d9a9a38c200dbd2
SHA512 490126f50e6c8fe235c17d833ff43b789f983a6e6bdc12d3a73e7f6da8ba8cdcdd8ae6b8e690d1ab49dacfb8b4ee4d0014af9a5548ffd436b39381aba4d7a55c
SSDEEP 24576:BBA8V8FpJqH1Mzria7/mDMnxD1vwakNwkqIivzksIBNyHq82:PvGFPqVra7/BxhoaEWzQNsq82
TLSH
T1CC35F16567E501F4D4BBD13889934663F2B1B8250360EBEF0AAC8B611F236D51B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 600292ce4bcbb32120f0996b42a3a673d70ff2d8ab0279dfb57137f86669f8df
MD5 4ffaa52b87d1688eecc3876d6966968e
SHA1 72e2e77a2477c422a0a35b4aa28dfe6b42e6f4cf
SHA512 b0802d78fdf54fcb63fb2642d842d04cf90e4b2a4062263672c152413397087d8d38ef23325fafc0037cb50162ad23aa2ea96c41ce3cc937c4dbdb58734cef13
SSDEEP 24576:CPUr+NQanxD1vwakNwkqIivzksIBNyHq82:CJQaxhoaEWzQNsq82
TLSH
T17A05F16F629D1CE5F6BAE17C95834718E371B862031292DF02E4817E4E23AD97D3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 1b7d828866bc5a4b8fb6f5530ceb0e34c732965236f8a060ddc95a73e6c511b0
MD5 e2522296ab9e32eeb6c35f46f28c8ad3
SHA1 4fdabef1c9219a69ec29bb084364d1389d354207
SHA512 a501e0cb8d328355ce6736f06999ee8b39e9388fb7e4467ef5087834fc1d8c927d3e49e378c2e4d734bb260bed6184f01104c040814b7c2803f24cb0720cd240
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlxhoaEWzQNsq82:YG05lO43bWxhAO
TLSH
T127D5CF6A62EC01F9D1BBD17CD9C74A0BEBB23825032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 24e59058867d357063fdd08238131134ceeec3a471d0a780e49bd18022791ae2
MD5 4eeb55196133394146f1e8ee416df961
SHA1 dcc2a945a24d09cf137d60daf33f6cbc9cf9b147
SHA512 ca7600e266563d136c41579010ce24ab3884ebae9302e0bd816c68feb1a35fed4511af1ac71219955ce62b7aa194be2d166a51ae369d3e7918810618a3f986a7
SSDEEP 24576:VLa5POZ3dpbWVM50JicR2hG0lasx2+47eidn/8nxD1vwakNwkqIivzksIBNyHq82:Va5POZ3wJt2pasx2+m+xhoaEWzQNsq82
TLSH
T15265BF5EA7EC01D5D5B9D17CC5834A1AF5B1342613319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 130d3faceed90cb12d719b26597a4c87c58c9e035df53db1e3e1fe04da4b5424
MD5 29b6b4116d9b616e2ea1accccf90442c
SHA1 063e63125ca30362d19ed31c1d72cef00a36f274
SHA512 44af1a9e4c49e467406ddd99750acfd8914c0364bc9caf76ea6e2f5e33a6cdf5ec3c7b4e72b45b707f6fe1143e3ed31be9fe884e4fda8d5911aacabb9c9f947b
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkIZnxD1vwakNwkqIivzksIBNyHq82:6Nc/zEOVHFfhxhoaEWzQNsq82
TLSH
T17C857B6623E901E4F5BBE1BE89779946FA717865133086CF0291811B1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7a5f0b8b7ad3cf3a2f2429f1e8a03428b858a9d3c085e18eaa142670495de9c4
MD5 3dcc276ae796c8558752fa497a3b542d
SHA1 873edfc3f582e70cd7cde0f14244d1a5cdc68c5f
SHA512 9b78ad616c8cc99e42a8c7dd2a68a28a0660d772ea2ae140331f2ffc85b2e8412f84c719e2cab12bec5e1d284464c331d1f28d24da971efc13dc59d8559a8346
SSDEEP 24576:MJnJPbzB4SQvnxD1vwakNwkqIivzksIBNyHq82:MJnJv6SMxhoaEWzQNsq82
TLSH
T1B915E07DD29810E8E4BBC2B4815A1B55FE31387D2B2269D719B8D1343F12ED0BA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 425b42431e684729e9073a6fbbb125845157ba4d32c46d67004f6215360e9a52
MD5 723d277650a4bf039472a3a28f594c60
SHA1 b8c4e29201130309c10f2f98e5b3c241e664282b
SHA512 85dfed06b06d125f95a6c737c074a5535b8f188226288b6f7c0e68a509240b91413fc773cac891d7d7bc7685364328ae5a2689b893c28c79382b35344636a7e2
SSDEEP 49152:uCLHGeeV5ijCmlDWDksxhoaEWzQNsq82:F6xhAO
TLSH
T131A56B05A7EB4184F8F3CAF4CA2694169A327C549B34F7EF4E80C96A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 a605c66ac2cf06afae580bdd19ffc15b359cbfc8175eeac2f414776345b730bb
MD5 5ca7bd466bd9dd4984e68b83a6da98ec
SHA1 4a98164c456808a64d9757723dc45f77123786fb
SHA512 d189d302f1c3931d759930346aabd0f44cc10f21f03cd3029da14be005987970ab9c990ad92923aab8147281d9bd82bf4e3b9601fcc2cefc602b36ca413b9e48
SSDEEP 12288:+1Hck6j5ZI7wnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:S6DIMnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1C3F401AD636A00F9E1BFD03D91930511D2B2B571431219EF1AE8C1B98EA3ECD7A3DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 5ff108592f3acf6a8bed78649093b34f98b992038ed884be0964e6b592ae0ae6
MD5 74ee5bf457791c12d55f509f5b72ddad
SHA1 08234159d6811d169f62962f37f1fd99b837dc9c
SHA512 ceda061853a3c1d4b5ee3ec27396c066568afa3e15ca104772411c1f6fd61e80f85bf7a0e134f5299a0c0e73a23c48ab7d15d1c030741090f63d83077f5c8db4
SSDEEP 12288:SG6kyAnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:btyAnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1EDF41291538914D8FAFC4278A6B346608634BC31171142FF69E9A33E4E337C67A79F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 69b2d95134ef9cc855b2083c4e8e0d6227a82f46869049d9f123f53c66b97540
MD5 fcfd000516ac8a0d830effce767ecd37
SHA1 f73ab384bfac4db4c8f734bb2ece6c35458bf87e
SHA512 9ee3f221111e05a766661de3cb42e936ecaa1a6b5ae98fbc1990af07ab9bf6ddb87c753e9a22fbd4703770f664404577923abef8adc140948fc7fca502029d57
SSDEEP 12288:77uSnxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:XuSnxD1vwakNwkqIivzksIBNyHq82
TLSH
T1A2D423F9960F1998E9FC96B871B30E2052245A36171204FB7CED92B185271CB36BDF6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2273e2ee74ef26d88a0ac8baeaa6d5760f7858e5314b4b142bf4bbc1c270b5ee
MD5 cc2cf1f9a814c31557ba8131a4ea8e39
SHA1 9e9762b2ba99c6735ed914ef546f3d8a1f1df321
SHA512 245f9e7e3612a34c258f058b177e8ae0d9991a04aac87d600736753bdbbb91403cffc4a90de3d9f57f833b52d73a800ec6472fc9ca96e28c290043f5cae1f241
SSDEEP 24576:EsgILoTfaidZqSnxD1vwakNwkqIivzksIBNyHq82:JgHTrZfxhoaEWzQNsq82
TLSH
T18F558C1D67EA09CAE2B2D675D8631493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 77a4eee1c0a95f6497f894d7844db3320337780178f21f9f3db999de19b3c9f4
MD5 2f46f0b2c3072b305ee786ba0ff6321f
SHA1 40207ab9e10bbe263247c6ffeb616d9de524e008
SHA512 cb5b1bc38fb86cd86569ab6dd07d9c07c56e0b9ce835eb71924c35616f7a9bf87d15d4b7cbd8a2167a0e518dbedcfab7f20bdd46e0b479c588cafb503bc9fce9
SSDEEP 24576:FrcmRNbnxD1vwakNwkqIivzksIBNyHq82:RcmRlxhoaEWzQNsq82
TLSH
T18605F19EB36E00E5E1BBC17CC8824615E2737431231257EF46A5C37E4A279DA7E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 53dfdfff606a42fb97cff7c248d36554461c3453936a5db0c4243a4d711262e4
MD5 f0fefca170a2139ffcfd513d074c829b
SHA1 07043f825d780564fbb25baa6fad3238a34daa9c
SHA512 5c2a87147e1b92ce2ad9e56c6a001329e1c926104d6aa2b68ea71ef46d61a5dcde75b884e148f302b1429c388ba15911290f1b7e67c1eb435e4586cdb922bca6
SSDEEP 49152:YDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3TxhoaEWzQNsq82:F3Upow8sBMxhAO
TLSH
T1D9A58C3DA2E800A8D9AAC379C54213A5EA71782E3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-379-0x00007FF71B3C0000-0x00007FF71B4EE000-memory.dmp

Download

memory/440-380-0x00000228C8580000-0x00000228C85E6000-memory.dmp

Download

memory/440-381-0x00000228C8580000-0x00000228C85E6000-memory.dmp

Download

memory/1036-365-0x00007FF77AC00000-0x00007FF77B0D0000-memory.dmp

Download

memory/1036-447-0x00007FF77AC00000-0x00007FF77B0D0000-memory.dmp

Download

memory/1036-360-0x000002324BFC0000-0x000002324C026000-memory.dmp

Download

memory/1036-361-0x000002324BFC0000-0x000002324C026000-memory.dmp

Download

memory/1048-12-0x00000223CDB60000-0x00000223CDBC6000-memory.dmp

Download

memory/1048-61-0x00007FF6DB230000-0x00007FF6DB352000-memory.dmp

Download

memory/1048-14-0x00000223CDB60000-0x00000223CDBC6000-memory.dmp

Download

memory/1048-13-0x00000223CDB60000-0x00000223CDBC6000-memory.dmp

Download

memory/1048-11-0x00007FF6DB230000-0x00007FF6DB352000-memory.dmp

Download

memory/1200-352-0x000001C31D230000-0x000001C31D296000-memory.dmp

Download

memory/1200-353-0x000001C31D230000-0x000001C31D296000-memory.dmp

Download

memory/1200-351-0x00007FF7ED380000-0x00007FF7ED60A000-memory.dmp

Download

memory/1200-446-0x00007FF7ED380000-0x00007FF7ED60A000-memory.dmp

Download

memory/1384-284-0x00007FF77C950000-0x00007FF77D093000-memory.dmp

Download

memory/1384-285-0x000001BB4C780000-0x000001BB4C7E6000-memory.dmp

Download

memory/1384-374-0x00007FF77C950000-0x00007FF77D093000-memory.dmp

Download

memory/1384-286-0x000001BB4C780000-0x000001BB4C7E6000-memory.dmp

Download

memory/1644-294-0x0000022991780000-0x00000229917E6000-memory.dmp

Download

memory/1644-293-0x0000022991780000-0x00000229917E6000-memory.dmp

Download

memory/1644-378-0x00007FF7FF2F0000-0x00007FF7FF39D000-memory.dmp

Download

memory/1644-292-0x00007FF7FF2F0000-0x00007FF7FF39D000-memory.dmp

Download

memory/2104-273-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/2104-272-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2104-359-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2104-278-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/2180-44-0x000001C870A40000-0x000001C870AA6000-memory.dmp

Download

memory/2180-43-0x00007FF72D400000-0x00007FF72D567000-memory.dmp

Download

memory/2180-52-0x00007FF72D400000-0x00007FF72D567000-memory.dmp

Download

memory/2180-50-0x000001C870A40000-0x000001C870AA6000-memory.dmp

Download

memory/2180-45-0x000001C870A40000-0x000001C870AA6000-memory.dmp

Download

memory/2640-57-0x00000248C8CD0000-0x00000248C8D36000-memory.dmp

Download

memory/2640-56-0x00000248C8CD0000-0x00000248C8D36000-memory.dmp

Download

memory/2640-55-0x00000248C8AC0000-0x00000248C8B9B000-memory.dmp

Download

memory/3076-251-0x00007FF65FBD0000-0x00007FF65FCE9000-memory.dmp

Download

memory/3076-253-0x0000024B897C0000-0x0000024B89826000-memory.dmp

Download

memory/3076-252-0x0000024B897C0000-0x0000024B89826000-memory.dmp

Download

memory/3076-338-0x00007FF65FBD0000-0x00007FF65FCE9000-memory.dmp

Download

memory/3128-19-0x00000129DF870000-0x00000129DF8D6000-memory.dmp

Download

memory/3128-0-0x00007FF636CC0000-0x00007FF636DDF000-memory.dmp

Download

memory/3128-22-0x00007FF636CC0000-0x00007FF636DDF000-memory.dmp

Download

memory/3128-1-0x00000129DF870000-0x00000129DF8D6000-memory.dmp

Download

memory/3128-3-0x00000129DF870000-0x00000129DF8D6000-memory.dmp

Download

memory/3296-27-0x0000026A27AB0000-0x0000026A27B16000-memory.dmp

Download

memory/3296-28-0x0000026A27AB0000-0x0000026A27B16000-memory.dmp

Download

memory/3296-25-0x0000026A27B60000-0x0000026A27C3B000-memory.dmp

Download

memory/3296-26-0x0000026A27AB0000-0x0000026A27B16000-memory.dmp

Download

memory/3536-369-0x0000023FBE6F0000-0x0000023FBE756000-memory.dmp

Download

memory/3536-370-0x0000023FBE6F0000-0x0000023FBE756000-memory.dmp

Download

memory/3536-368-0x00007FF73C540000-0x00007FF73CA46000-memory.dmp

Download

memory/3536-448-0x00007FF73C540000-0x00007FF73CA46000-memory.dmp

Download

memory/3736-321-0x0000027884720000-0x0000027884786000-memory.dmp

Download

memory/3736-323-0x0000027884720000-0x0000027884786000-memory.dmp

Download

memory/3736-322-0x00007FF6F1C20000-0x00007FF6F1EC2000-memory.dmp

Download

memory/3736-441-0x00007FF6F1C20000-0x00007FF6F1EC2000-memory.dmp

Download

memory/3912-386-0x00007FF766F90000-0x00007FF7673A6000-memory.dmp

Download

memory/3912-301-0x00007FF766F90000-0x00007FF7673A6000-memory.dmp

Download

memory/3912-303-0x0000029ABD3E0000-0x0000029ABD446000-memory.dmp

Download

memory/3912-302-0x0000029ABD3E0000-0x0000029ABD446000-memory.dmp

Download

memory/3912-442-0x0000029ABD3E0000-0x0000029ABD446000-memory.dmp

Download

memory/3912-444-0x00007FF766F90000-0x00007FF7673A6000-memory.dmp

Download

memory/4152-445-0x00007FF7E1CA0000-0x00007FF7E1E34000-memory.dmp

Download

memory/4152-332-0x000001F00B0B0000-0x000001F00B116000-memory.dmp

Download

memory/4152-331-0x000001F00B0B0000-0x000001F00B116000-memory.dmp

Download

memory/4152-330-0x00007FF7E1CA0000-0x00007FF7E1E34000-memory.dmp

Download

memory/4216-340-0x000001EE68190000-0x000001EE681F6000-memory.dmp

Download

memory/4216-347-0x00007FF6D7A60000-0x00007FF6D7D80000-memory.dmp

Download

memory/4216-339-0x00007FF6D7A60000-0x00007FF6D7D80000-memory.dmp

Download

memory/4216-341-0x000001EE68190000-0x000001EE681F6000-memory.dmp

Download

memory/4216-345-0x000001EE68190000-0x000001EE681F6000-memory.dmp

Download

memory/4520-263-0x00007FF653F10000-0x00007FF654059000-memory.dmp

Download

memory/4520-350-0x00007FF653F10000-0x00007FF654059000-memory.dmp

Download

memory/4520-266-0x0000027F2F730000-0x0000027F2F796000-memory.dmp

Download

memory/4520-265-0x0000027F2F730000-0x0000027F2F796000-memory.dmp

Download

memory/4644-243-0x00007FF7ED510000-0x00007FF7ED5D8000-memory.dmp

Download

memory/4644-329-0x00007FF7ED510000-0x00007FF7ED5D8000-memory.dmp

Download

memory/4644-245-0x00000208F0FD0000-0x00000208F1036000-memory.dmp

Download

memory/4644-244-0x00000208F0FD0000-0x00000208F1036000-memory.dmp

Download

memory/5128-34-0x00000210DED50000-0x00000210DEE2B000-memory.dmp

Download

memory/5128-36-0x00000210DEF50000-0x00000210DEFB6000-memory.dmp

Download

memory/5128-38-0x00000210DEF50000-0x00000210DEFB6000-memory.dmp

Download

memory/5128-35-0x00000210DEF50000-0x00000210DEFB6000-memory.dmp

Download

memory/5228-392-0x0000020B5A000000-0x0000020B5A066000-memory.dmp

Download

memory/5228-390-0x00007FF7A0740000-0x00007FF7A0A7E000-memory.dmp

Download

memory/5228-391-0x0000020B5A000000-0x0000020B5A066000-memory.dmp

Download

memory/5252-313-0x000002E2EEBA0000-0x000002E2EEC06000-memory.dmp

Download

memory/5252-312-0x000002E2EEBA0000-0x000002E2EEC06000-memory.dmp

Download

memory/5252-311-0x00007FF67FF90000-0x00007FF680043000-memory.dmp

Download

memory/5252-389-0x00007FF67FF90000-0x00007FF680043000-memory.dmp

Download

memory/5932-320-0x00007FF7ED510000-0x00007FF7ED5D8000-memory.dmp

Download

memory/5932-234-0x00007FF7ED510000-0x00007FF7ED5D8000-memory.dmp

Download

memory/5932-235-0x000001E313690000-0x000001E3136F6000-memory.dmp

Download

memory/5932-236-0x000001E313690000-0x000001E3136F6000-memory.dmp

Download