stealc | 67a71b540af16424f563dd5ca123e0805275347c08ae9c375f208eb691aa44f4

Analysis

max time kernel
88s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 4.4MB
Sample260925-rtlk4azz2p
SHA256 67a71b540af16424f563dd5ca123e0805275347c08ae9c375f208eb691aa44f4
MD5 157a3358658475359ce5685ec7d490d7
SHA1 d195f1ddd0713f8dd0e649fbfe22db9f0204d0ef
SHA512 9e04735bb6581d7c8595f9d3c056233a2b38edce1fe78893f8e391639a82695ed2e5ffe3dfa8845b831b67d153d59d224af57838175fd96d7a97fc01ab4962b3
SSDEEP 49152:xaAiL+4QDlxzUTSPfjznUD3Pqv48pBoSp6cT6vTHMU6eOTjNjeme30jaNf1TWbdz:W5kBLRemU023W
TLSH
T191267B1BE6B941F4C0BAD1798A979557FAB27819873297CB4390474A1F23BF09E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral1/memory/640-51-0x0000000140000000-0x0000000140475000-memory.dmp	family_stealc_v3

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Executes dropped EXE 9 IoCs

pid	Process
4616	alg.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
1548	elevation_service.exe
4792	fxssvc.exe
4276	elevation_service.exe
864	maintenanceservice.exe
4568	OSE.EXE
3620	msdtc.exe
3996	PerceptionSimulationService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a10b724fc665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Microsoft OneDrive\UpdaterService\logs	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe
4880	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	640	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
Token: SeAuditPrivilege	4792	fxssvc.exe
Token: SeDebugPrivilege	4880	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1548	elevation_service.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 3524	640	2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_157a3358658475359ce5685ec7d490d7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Checks system information in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\system32\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "640" "1248" "1148" "1252" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3524

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4908

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:864

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:3620

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:4804

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:1184

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3288

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3708

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:4160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:5004

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:4256

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2964

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:64

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4652

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4656

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:404

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:636
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5224
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 501690cc27f8969446d4de7d369d11c90afe0e9ffdea7b9f36dcbbb675b88987
MD5 660cbfef0b860c8b62c6749aef3c1bb3
SHA1 e3b36e22a2d17068fe33fc158205d6019e1a6702
SHA512 2f6d6f18edc440c83bf3337d58b7b3bd8bb02e44b87cb6840c8242343997f47f4663a292a4204ca19808631bc006ae12d8737bacedf00adb8d18c8da54e68b7b
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIe30jaNf1TWbdz:E3q6HjBFU023W
TLSH
T1B7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 5cef09b4c22b192d95c71cf674c7f8b77ecbdf7a0c2a968f45e0e3f2e84d9823
MD5 f7ca2969d33876e36eb618e17b0848f9
SHA1 101cbdc95e47e2f36dcd08e3b0add9b06321a965
SHA512 d2015884b62acf7ffbd9b147a22354bb5daddfdce74a557a844c82d5701e5ba0a01c2a593105fde1eae5870a496bfbac8f4f53ca2be7ff869647ffe979fa71bb
SSDEEP 24576:7XYfDtczAGgXe4i7ojhsP5Lgrk1TWb4AN5:etcae30jaNf1TWbdz
TLSH
T14A65F12877D409F9ED67827CC8E28611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 04dacfd156d6a43465a1ecf2b2449139acd2d073b3329083f82471399f557144
MD5 c72d97d70495c463cf32e06ee8898be0
SHA1 843a48ca86b9e9204292896eca120e0417c99b2d
SHA512 63fb32a8bc9051cecb8cd1f72812a39cabb0763dd8c9dcc4542f98689ef6d8a573c67529d6828b631afc97f9a413682addb5d1f360c4141bebab6f993f5dce85
SSDEEP 24576:j0Le5ji0hmxirMFgXe4i7ojhsP5Lgrk1TWb4AN5:jPji0Acve30jaNf1TWbdz
TLSH
T1D885AE26F6748775D073C0B9C5D2A78AED71308217308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 44d1a6e5bc847a0947be4def2d4325c7eb43d2cb7a42d4a26a055db46e53170b
MD5 0be7e97e0e50a908d23ee7e54322f1ba
SHA1 91d3188ab2fded5ea59a9d1a9bdeec6d28fb95ef
SHA512 38301a5d2aeda5912b9844f54950f0ac5f9e49a52c38ce5aed16b3e749979bd94d04747506e370cc3290d354f77ff884d9b27bf31eb55336c5975095f9401304
SSDEEP 24576:ka7/ezSC6vUyD/aqgrvWE6q8wyuzgXe4i7ojhsP5Lgrk1TWb4AN5:T/ezSC6vUzPvxHjyTe30jaNf1TWbdz
TLSH
T18A756D25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 30f2628fc5451318c973dec4a77ab9c0c9e6fabcc9d359ba1ee0d51c6954f1b9
MD5 8a93287d716858d059fe97dd8f922942
SHA1 447c0a094ea89506c39ad0916e76d218f482f64b
SHA512 a4efc2440f974c14cb37c3ed082b0fa085b70c9ebd45cf4ebd99a17391ee9c225c3eec6ae1f821bcd311ff37e82a036cac13025d86eee62ba65a01c1ee954320
SSDEEP 24576:3VbqPb88hv/l+6igXe4i7ojhsP5Lgrk1TWb4AN5:3VO88hXl+0e30jaNf1TWbdz
TLSH
T140559E66F5748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 278cdf4873e5b32a2cd836cae1f12874b0db05e602afc4574c809ec8526e49ba
MD5 47a01f0ddd99f0b3882cd1abc0750112
SHA1 72901f29f1553d2861b25e92e73d5e5a620cd9bc
SHA512 4c51137a30dc4e941dde7e7a6bb84b60b822f3ecdd78cbf94ed4d62dd33adbcba048f4d4e01894091c793324e9cb524772a6dc8e67dcb25949801758ef409222
SSDEEP 12288:XRQ0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XRxgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17C4523919F5409C6F38BC3F0A0F7CB91F9E11EC065448D6B47E0BE9358BC89ADAD8469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 84bfafca602eafb43f6b8ab96bfe27e64ee95048a05da66fa76bf1af77d55ef6
MD5 490615a592f7c62644ae7845b2ea898b
SHA1 b8b211f25517780c914dcbae031d3bdda0499065
SHA512 fbf82b0346563921ef243b3b916d04f3d9606600cf5af839b858fc37c6eb55d5e19ea7882f21caefedebc8f3e3467d0ba7a7ac036f70d1fc3de70f6f023ef08b
SSDEEP 12288:neBNUbTVO86Ut0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:nJIU6gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A165CF3BEE28ECD2C27E8DB85691C740E7B278704B5293CBD164820EDE235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ce7d100637c6162f4d62796b131a9e7ff81dbb2b2bd57a99e8a9f068dfecce0e
MD5 0322b34bc8a7df2bc19332da437c58f0
SHA1 b1c730f85c076dbbe6d34fbeea0a4bf145bcdd8d
SHA512 e1c2fe1af98b2fce8dff73760dbea32fec482f538967afcb52e2e563a39ddd5ac01225b632e5daa6ad834fe2e9fdaf7192675166d3208693a28e5120cc73125f
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THH:qQvGAdlCEL8c/yRNw5C6U023W
TLSH
T129267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 e307fc91f10c12f043a2367d95d7b72b716f37cdfc5229a740a9eed6e50f0e90
MD5 27a131b232d02ca772c9ec9512cfbec5
SHA1 15fefcf116b3d1a741e7f6a2d408254d45291442
SHA512 f3ba5e593254b7161998999518cf9f9663b6be77995c385be5e80f631427fdb3a0a584851f24facce4fcdd667cc95b20b10100a81a1860cbca5b6c6024701492
SSDEEP 24576:kdewsAjogXe4i7ojhsP5Lgrk1TWb4AN5:8ljfe30jaNf1TWbdz
TLSH
T13C75E031FE74D032C3BB0DB21B76C716686C7A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 13.5MB
SHA256 6198b42cc0697c407fb6cf089467df020ce0c85b5491e8ce88e4b814b79a3407
MD5 c44650a663e7f4c3edded74684709ef8
SHA1 075a9f88410f27183390aa63fffe42e9e01506ba
SHA512 cbb7dfc80746a7aaeb140856200592124e0aeab233bf3701096e4e005b36a5dce4b5e9df5fa0f34dc8a6a4af476d15e8830adb5e1bdb55cc7b5bc6ea4ffa78ad
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldK:mUEtQevvqc2W1cpV2EIC
TLSH
T11AE65A966BF802E5E077D978C6668573FFB178410A34976F02A2C71B1F3B6A09D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c708b4a94653a4c6c63c15f2a3223a402cf85ddf712fa8dbe851c995cea762b6
MD5 4db6fee1737ecb5af33c89a6f901b9d7
SHA1 9802cbbb048fd3064b190ad3635e4dc4a7a08013
SHA512 e6c791008b567ec07824bf03c01f657689f1a41c188d20059c38ef7cd742fea6ec436c1c7378a8d4677d9345d752482f267d1387230300a8bcc4c631e033cdc1
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/z/e30jaNf1TWbdz:uoq2VjnmeU023W
TLSH
T1CDD58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 48e3809c8f65b7876698b83fb2f776b08090dd9620054b8c04d31fdd2cd239fe
MD5 0605318bd7caedf1d10b8c468537e7bb
SHA1 bd3182efe06a6d2b8331fd692256738eab4e1ccd
SHA512 0ce57289066046f962482f4f86805aacc006cccce8d31af82b3d7abf225cf14efa061b9171aadce5c40f3695dfdd6361e140c0b9a1240a2537aff54db318177a
SSDEEP 24576:+AhGLJIFoiwtA5l7S533gXe4i7ojhsP5Lgrk1TWb4AN5:+AMyFoiq5Oe30jaNf1TWbdz
TLSH
T12C359D81EBF945D4F5B3AAB899B68571EA76BCA65E31C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 476cbc0adfa7d7261e1636198343b429a27a5dbc27d2ce09396cd64c6bf9bc3b
MD5 2be11a7e399da4dec206a59abcf458f5
SHA1 5f2ad849acc7c8f4c26cfcaf82e5b4974dacab2e
SHA512 87a15336c178a870bec8dcba0197b09f86a29f5291a3c873be9551fc3508b2122357500da51bd56320366b10305d1ff3ed498693695a1ea16afd34381933ecdf
SSDEEP 12288:0mw5HEjsChNVBFgl0WDm+C60DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:xwuoOWcgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F965F14676A40CF9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 1471e7a588fc76226460b0c4aff263f30d8dae87555d4b7626da5d71b57695cf
MD5 a180b77f245dc8956965a6817bd1785e
SHA1 f33a7bec790449b2c0d99461685824613e4afa5a
SHA512 4c2fbbee4c53ca6b3f2072cf77e8d6777ba71dfd4277dcef5e478d36b0dd465e2cb7016fa199e401d174fc0fe653492aa98f8542f472238fa26ef83ec854c06d
SSDEEP 12288:ZBZ1Iy70DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3ZudgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D755129637E424F9E29782B8D4F68741E7B13882233147CF02A096A71F76ED65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85bdea52bc21086527ae4ab1de9389d6e9af600011a8bb6ce5cf6a01e4fd7e0f
MD5 45c365d7ef537ae4a71bb273b54994b1
SHA1 70ba22199386118ab8820d89b030ed86f09fe613
SHA512 a020662dd8c48489cedd6ddf6f4963c93316cd5c34f3829877a2980c0e3d4360e4bcf74fe7800d9b9ca5ed22edb42eafc165ffa4b9bc0e174118533e4dd84f27
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:sQRQyi36YOcPQLvw2gAf+PN3RU023W
TLSH
T184667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 817fcb88ba46102359ca3ffc58efe1ef41bce2cb8d55d33bf4cb06bcd240a75a
MD5 4b11e1e25576b37dc99d69a7593eab83
SHA1 b3c64b85c1f71c1a54bcb6ad695c89e80a07a112
SHA512 0207c04a4534c517eec44b6693dbe2fd0670d837f79700c61d19c41ef9ab94e97f008aab07bac8a8a5233558066a58d0f7279e62b2e4ea01bab37dc6d278deab
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:cQRQyi36YOcPQLvw2gAf+PN3RU023W
TLSH
T14E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8e7d99422cc9cfe246f84fc7a587741581d66dfb992c069993522ac72aa86795
MD5 c407ff19c6b4c11d0d7c276d6f74b281
SHA1 445be63a9a8cd4102b746f708a47d6856ec45076
SHA512 c434021e1cdad865eb86f692167126113990617e3029a54c2bb497d0272db0efe39fd3342d2e7b54ff086fa93e833cbd7f4c8a9211a4a233a492fb2b6dcbead4
SSDEEP 49152:368Qg55nhheWu7PNU3/ve30jaNf1TWbdz:hthWRc/vU023W
TLSH
T19CB54933B2F60099C04DE1769F4A872196E27C758FE0E7DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f3cf82f63484e20d55531ce5706b19c26d60c8b20141558ad4e3f3386551797f
MD5 4f8b0eafcf5cccd024fd03e3fc156376
SHA1 335d33952016f32599c913525b87f3e07e680499
SHA512 8ea5fe12590f30939b9eac781eb28e736652f71801cecd8220d0afeae3e0fa6c1ec261a6ce81137984428e1a2d30a6a0e07eea77cf1de9f70f36bedb10b9da18
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Hy5112gYy5azzVvL69nLKnhZMU023W
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e144970b1e57de64fccd9790d7dcea045eaa69a03ba25f02a0d2421f770e81fd
MD5 a6884b365514ccfe8f5fa8e6a21926f9
SHA1 3289e35794b97ecb14921f758270b7592ea2966c
SHA512 ff3c998f7a5e68ef527eba7a333b0ce6d22ec4521093d408b9cb00534fa919fcb3c2c01ead2fe05a7a0f5a946c8fad88f0982a7891d68f91e6ca82d534e2f65d
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZe30jaNf1TWbdz:zu6JmVxd2dZU023W
TLSH
T11CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa535b869435a42947cd6b94ef47784ecee3081c319b6ce28b3ff75ae94cca20
MD5 7c559f9350121920aac79ce653eff2cd
SHA1 8adf5a57e24fe08f5042c1a1ff41a1f1224dfb28
SHA512 049293fbc3f50aebcd902842713d5395701dade0951518d190de0981904e90dae744d103035ec61880632956ce7e5742747e6c82f91dea325834e781d6699779
SSDEEP 49152:R1hpsNoJpF1A6UU44CwH7R4xde30jaNf1TWbdz:RmifPbReU023W
TLSH
T12CB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 527a74678c87a62951a3aa503aac5fa6cf8eeeb349439ef4baace719ad2af6df
MD5 ac850b4fcc680d3fd12b019cd89b7378
SHA1 544859882e4142b3563c349ce12b5dc0388c2149
SHA512 c1daf3741943da28392c3d3a2d5b657704e63fea023c64b345ee91d0dc19a27e2396fc82362ca097005a87eacc4140c31b77d565d711fa3634867a47a15516c5
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHq4e30jaNf1TWbdz:w5dKTi614U023W
TLSH
T18BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1b327da297240d22e9af098c5fcf0a91a003b90b77c401bb416dabdbe4c39f46
MD5 3885878680faedcb9a6b7a2a6a3699aa
SHA1 3835dd70d55debb02e35b009492b0a4723eb9ab0
SHA512 d6b2a3ee9e40d358479abd32a42d292ca5b80c9eb2bdad1efe21480209672e5e6d6382d8effa1ef09b26234a046b9349eea936bfcd3e68ae5e7047d294060526
SSDEEP 49152:8htSn8EApI0figngiDn0AP5wJe30jaNf1TWbdz:9X2iyphSU023W
TLSH
T1E895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0dbfefea82a9e7371efea46ff6e37fab4f70c96f8db3b22d8f824dd0f5ce7353
MD5 6411385b4b3238334d821ffbb9e07b6d
SHA1 4cbbcb13e36f5fc1521b6eed531e4dab015216e5
SHA512 18a88a36c78bda5e85dddf7e616c98426444c401ca003844f75197fb83b37803571f30188685876c92c181f1b81530547237ec2b907a85a9bc3fbfc2533bfca5
SSDEEP 12288:3o0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3JgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T166452391AE5509CAE34BC3F0D0F787D1F9E01EC2724449AB13E0B5535DBCDDA6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 920f4ddb81591dd1167a073b9d9b5e6681f9c1b01165a15ce82bc36575f01200
MD5 e04b91558a8dc382a3095454ced1fee2
SHA1 c8cdabf182f537d156d3347cc06d6b0eeb71aaa1
SHA512 e58d33448c3b6d73ca3895f4d285e5fc4e371094553d06d300a10a7be210408bdc95893b5d9a10f4cbdc14e35698e6a4265c30c389831c89b198386df173c425
SSDEEP 12288:2X0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:2EgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T154452391AE5509C6E34BC3F0D0F7C7D1F9A01FC272404DAB57E0B95359BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 26c2a822932ead86c104426bb43973977fdbc8c70c7a534966110c2b818c66ba
MD5 51798d61407b6a1cd8b1d3e747ce8251
SHA1 138b9c06bfbd81db69537f7c782100f625da6f79
SHA512 543e46151cf10d4d9811103550b8118da557c9f98d777ff0fd459e9b906ce33b621db1108a920535862eadfd333f7a59a611243fac7a5d2eb1b8535c455a859f
SSDEEP 12288:Tl0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TSgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T166452391AE5509C6E34BC3F0D0F787D1F8E01EC272404DAB57E0B9535DBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 62d7b6e8766b76fab105fde837cb2a6404c579955a5fe89dcc2f6e9f03c9218d
MD5 b2d1af017c2410e4eceb8f09b44cfd8c
SHA1 b9d96b9fe3c9d4c9ab55004ace9cf8156573ff17
SHA512 a78068d8216bf2b8a412236e3963b9af804439090a35c107e73b8a9ad324dc6c0260563be35481012681071a980e1169e060526db2f275046cd6c355ce9f27a0
SSDEEP 12288:SVe0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:8gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1714523526F5505C6E287C3F4C0F38791F6F13DC173118AAF47D069530EB4AD9AEA8A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4813374cd5e1a13b0a6a1765053952d7cdde54d36998f87ed7b826b090f7c8d4
MD5 f38880db8d988a47bfc29b0bbbb0ce2d
SHA1 f4ec410f40a69904b51b03bbb13555468c27a3af
SHA512 0177308e14a4ca68da9c0555ee3a018ab27891ae7a5480f5487661a9b464c105fd8bf68d166eded26d90e47ea77968dd112a6a13293e1eac1aa7a7eb81ab8318
SSDEEP 12288:Em0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:E/gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T187452391AE5509C6E34BC3F0D0F787D1F8E01EC272404DAB57E0B9535DBCD9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0bf22953c94360523ca14a6a5c1c3e31bc1d83e2f9c18c57a6b66ee130421ba1
MD5 19a51df1f3744755fe812ca6c4494312
SHA1 243e8661e1c644924af324d3576ac014674e86ab
SHA512 030981a4ec4b18d19751d8b968b4ab3c26f9f53ba47897cd0667a82abd63ec6dc9aacd122de2f8516238e45573406829cf6181f357e864d8563b2767b680f3e1
SSDEEP 12288:HD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:HggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17B452391AE5509C6E34BC3F0D0F787D1F9A01FC27244496F17E0F55359BCD9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0ce1ed46acd296d643fc2602d192c20d54c78318b332ed2ffce0d5cf5bef54b1
MD5 4d06503e07eec7127e827f06ddf3da9e
SHA1 ff6638f73801b6768e55b0f69d72a28dd5c2b722
SHA512 81fc134d0602cb9212f58399bf94bb078f277bd9584c5b4ed224df6a0a20d8d2f266735f8f7fb866e97b2bd0a3f2ba7f4406190d22a096573da729c15e863c6e
SSDEEP 12288:5f0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:5MgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T186452391AD5509C6E34BC3F0D0E7C7D1F9E01FC272444A6B57E0F95359BCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 0ff901b88276d2aeb72c258bca40d7b89064617f0b601d9a4d3ae7716d5f7b1d
MD5 608bc8027e03f1c2e85f00e9341609ef
SHA1 13dba8de3ff5df9dbef6415875c04b70bb42d390
SHA512 a11169b92973cbc890ae43fc52f89dd51efb5900f24bc67db1f133b52a36303241798b748c785b29a6b0ce435ccb6222258aece82c96cd44343e525c0b8dc8cc
SSDEEP 24576:3ZMSzFVSOkgXe4i7ojhsP5Lgrk1TWb4AN5:3ZMSzfXe30jaNf1TWbdz
TLSH
T1ED650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436675F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 10755a47fa030c3786c8527e4274cc8b268a253fd476c3dc2921fc77013472f8
MD5 98380b690c690574e91b9840c7641ac0
SHA1 9660abe5a01f69913b0af421a6017cbecf738b3b
SHA512 ba8ed8bc57f73aa47a37c65e3423619721c0bbdd08402886a305e3f8aaa604fc32c602b038366e4202123dfab5b381eed69a7f853223f8a446b478851674913d
SSDEEP 12288:rM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:rtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1EB452395AE5509C6E34BC3F0D0E787D1F9E01FC672404DAB47E0B9535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e9cc061b0c8ca05783c262f74239ca713eb4d117a3cbd99e4c29e4d3a5cb19f8
MD5 7f8baa44f790a2ade250209a181bbcda
SHA1 3eee541ed5186129cf18050df16f05b0ec4c1a4a
SHA512 58b4c586f0fa5d6df3ad04314801e952f12d051ec323b6c321a5abf3db2bf9e7338a2100e0fca13ece03e987ed1cc4df9d2b6f98d0e226d90855c8af9f42045a
SSDEEP 12288:0A0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:0BgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T163452391AD5509C6E34BC3F0D0E7C7D1F9E01FC272404AAB57E0F95359BCD9A6A8C868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 7e72d7da18a62d7ac874777c3d44f4b1d04500b847b6a348cff9b1fd3c6a387f
MD5 7c69e967b55240c3c217d2486787cdf0
SHA1 d5aa9ed9a990a3a3aaadec55c89536145ca6e5ed
SHA512 f58d5572c882f78ea5caf2ea4559f8ee631a5ff3b00228f3ced436ffb8faf568605d9f4d211d2b61860a10380daa9167e05b4ad7eba7a16b0de636aa93da1683
SSDEEP 12288:HyPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:qzy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15355015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 215833927049820bc102d894fd836cf2f99ab3f164e1765a9c929c6894e13e3d
MD5 ab08d7b72a750bb592f59490280d9c91
SHA1 ec42d2b10d8b754803768106c808acb6e982af5b
SHA512 eef7f3a1f7f6fbabf12ed80d67a38faca4ac9d285bc8192bb240a86d211a1a25003c29645447097fdc20109abf4bfb96f9e479aba422083952789213336ae656
SSDEEP 12288:CM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:CtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E5452395AD5509C6E34BC3F4D0E787D1F9E01FC272404EAB47E0B9535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1343681ee756ea98dc0ce0a625083068fa465d8600a0d1acf58e2dae23000c0b
MD5 3cf232fbc70e322e0ff6dee0b32cd37a
SHA1 ed11495b59a371cf8be385273d5e3938b034f8c9
SHA512 c0405a9b2a599f938f626107e87add75bf018e6b04edc2e9a3b1e54b7c859d855b085e4b47192d420de7c9c62512fb0e5b2bcce1a4379dd5b9478873b19096aa
SSDEEP 12288:NM0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:NtgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A6452395AD5509C6E34BC3F4D0E787D1F9E01FC272404EAB47E0B9535DBCC9A6A8C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 31b2060c7d7ed8304583ca64247c5d0ae88c486ba9c7682de4fcfef6e32adf19
MD5 2064b97bb1af16c105826d944ef38f94
SHA1 ed8f309947e185b176a6bb4e54793dcb640b3ed1
SHA512 14d16d80555406e4ab543715c0a6ebcee9c3677bce5258825c01825331e60132d6f46958cd39d76e9221e96e48d96564dac328ea2933ea4f84d79586aab47354
SSDEEP 12288:3yPz5L870DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:6zy4gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E255015777A120E9D1678278C4E24B42F7B1787217208EAF13A057732E376E19E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3202e0cd8172b754ac9fa9e6481399576092506934af5b4626bfdd05c6f7a69a
MD5 9f56f9a51ba7da34501e6caee54d88d3
SHA1 b80ae05039cc1fd40cad0c44f895ad1ef784d4c7
SHA512 e37067ac1791c24768b866d7b44f01e4ebf8d82957cee8391a4c6b9c3eddd14cbd943af1f83d1545bbc16d9276adfeb1c3d98addd5e7cbc55fc6464d0bea02f1
SSDEEP 24576:nTHaLl3z0zDCgXe4i7ojhsP5Lgrk1TWb4AN5:nT6LljKe30jaNf1TWbdz
TLSH
T17A6502A5B3500CF8ED67827EC8A68A02D6F27C560760CA1F03E436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 af6b81b37cac4726005cbb2416d8ffa9b4caa94a770d76630961f199d9e8c931
MD5 d9216382b9a5e1abb8f14e521053eab8
SHA1 130e89db6b569970b5b51b85a4293be453fcd6d6
SHA512 c4dc47179df19fb80e45473b5fcd38f6c0e69ea591ecdad974f1e4a21a983e270b4c2d75e3176e9d019f9bc41c3cac74d1ed2fb3e24bdc21ea64984dd36e17e5
SSDEEP 24576:937d9CHKy7GZegXe4i7ojhsP5Lgrk1TWb4AN5:d7d9CHKyaXe30jaNf1TWbdz
TLSH
T1C875CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 27ab4ed0575176abc4428fe496b853d8d96b4d9950730cca44b9ed5306817066
MD5 446caa5598983a89e76dd09e8d19ab41
SHA1 0a3ca871f26ae8fc607c11ef377fb28740ef4f38
SHA512 080c147c840c0ae25f9309e2ae385e2193c429344be7053625a49ada32d471ffcabf7f1656ffd53386a43421af86fc3c8d931a52c3534846589f88ee3f8fff08
SSDEEP 12288:vF0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vygXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14E452391AE5509C6E34BC3F0D0F787D1F9E01EC272404DAB57E0B9535DBCC9A6A9C8A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Install_2026-09-25_142916_640-4312.log

Path C:\Program Files\Microsoft OneDrive\setup\logs\Install_2026-09-25_142916_640-4312.log
Size 1KB
SHA256 c2ad4b933a0816809bb7053b212abbb8c4e49c431e28e9ff4c094fb47712c4f3
MD5 17a4f41d5a2f12e76598d7acbd275493
SHA1 1fff34b9cec4e46726173f1488340ab74ee82ba4
SHA512 ff07cf6489bb4c75fe28afdf2733de3be28101fa891c245d61dabfbc56373a9b46e01d27d652b921c1f6c5b718fcf7621831ed4ddda04182ca242509b3d1f9e1
TLSH
T12F21840A2FD40A15FBFBDDC194FB15539E3539926835C90D10A6434D1971F44ED7435B
MD5 SHA1 SHA512 TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 90a409654bceba1ac0effcc4e3b04ff79eda5a8b73e990cc37f3c2c059751151
MD5 176ca827a96f529db923a7aa6ede8483
SHA1 45664fe50f787c5a4be64a67758392556166c0b2
SHA512 4b43d4feb277695cafbfe03e2e339c722cf94d7b744894985c983c5c1c564c1cb47e7e4f0f36c8049f1fd34b0f988a1e33888ecf9534c6c6bcb5b052420cbe30
SSDEEP 12288:ANsfc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:hdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B855F05AD29802D8C15E92B4C3968A41F3733C9193E1C7CB13D0F93E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1cb25193857ab63214f8798b19a771ece654402811322ed3d4d628345aca0ddb
MD5 8506097036477d28e97a0a450213ac87
SHA1 c2359242857c6a47b52b5e28366ed177a30069f2
SHA512 762f3cbb664930d3a295178da0bae28460d2f5ab86291f7d97f5e43d7b4d3f94f38c6ec54377f3a41e7300a4c5ea9cb3b4d4f86e415a7f5923a27877159efe34
SSDEEP 12288:B20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1674523629B5809C6F29BC3F090F7C760F5653FC12B008D9F56D0B65319B8CD6AEA8929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 a56a627cd29b6799579b7132dbef1ef79e9d5d2bb3b5110d4418a9a84d65c64e
MD5 7acbb471d2f481436e51415aa628c89e
SHA1 18a879d1bb5b71b28a2d95916795521d3355d59d
SHA512 2cba3b5ed80c62d63659c2677f2bd3ce8c1ba65ad9b0327fbffc14aa86b0fb2d9edd998ccc26992fd04fb163b838dd7498fbc27ec010b123a811b11a85736c4a
SSDEEP 49152:ea0h2GEkuAe73q3pp46zwwQ8e30jaNf1TWbdz:ea0hNYG4JwtU023W
TLSH
T1D2859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1190853D3F37DE44E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 a878e2c9bf59fd3acd240637cc718efaf6a87c01ec77ccc964d1fc07bcc75e0e
MD5 cf899a1c8873f53e3e20b0e882f947ab
SHA1 9acb069f253c64bd6bc5b9b46ed36b961eeb2d98
SHA512 e8c73110f026e09cec8e6acab2af0586831edda1452364b5dc290dbd4b4f2553125d220ade1f0fc52428182a9a7e8489f7e0e92aeb010b2b21ec775585ea9c2e
SSDEEP 12288:dhbHjfXS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dhbHjPLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13C55127E2AAC10C9F276D2BC91E28646D371BC51271187EF13D1927A0F3AEE85D38E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 200a5970533ff1a2f666f53b5c29641013525b91c19bf7607840e8f066928919
MD5 cc58c4885658b6b819c0d8972c608133
SHA1 882ef2a813a7fb877773511e7a414435caabc687
SHA512 9d2225709ccc07c86cf99e4df5897b835476ec17c15dd6e066466fcd16cb96f9a3eebe34a263d03a46944c21b91359691acc01411b7088be438ff702a645877b
SSDEEP 24576:f3YgnJcRTk4yti+R5dBR/TgXe4i7ojhsP5Lgrk1TWb4AN5:fIgnaTk46pBR/qe30jaNf1TWbdz
TLSH
T12245BF2DF2B910B9D4AAD236414147B5FB71782D1F209ACB01B0C538AF1AEE85E39F5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 5681609f266d1e01967143a2b5aaf030c8c43c090086409fddb70023ed355f23
MD5 9eb318d6003df7b15730302f95618b5b
SHA1 04978b25415f78eeaa86a448848b29405ed92d30
SHA512 7dc879b00f62d0cfe57de94199cdcbc39c58b72d237b124fcc4cdd4ba9adab38697d31c0dceb5ae013693ee064e1564479d439f29cdbcc8f4686fa6b7aa39289
SSDEEP 12288:BS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1404523959E5509C6E24BC3F490E7C791F5A02FC133004EEB56E0F9531ABCDDA6EB8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.5MB
SHA256 a49a5c1676b4c2ecc9d2c5ef8d98a7e07f85ee98d6978019bfce55c0ffc92821
MD5 cd68913059f051a4d8f9461520383188
SHA1 156269b5f70d8d44cab5d2243787e49bae93af50
SHA512 abde7cb0e653242c3e989bc3ce0a04d54417750745c6d8065471194af94571c8397c21977abbfa06d89f2d2c7c14e5117df541534aed9cc6b694a62d05952b93
SSDEEP 12288:oOb9A4LWOsvAYFTL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAf:FpL3UTogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T11275F155F79400F9E96BC17CC4A28A12E2B2789D1364E7DF03A84B661F637E54E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 7a8051701e3fda0244a9b8df3a603f6a8fb256822aeaedc1c750baa3c98f3c3e
MD5 8597450bce7cd2020f27c851ea79aac9
SHA1 edc4bd70c56013d672305d00b75c026496532064
SHA512 a1e032a59465ea5015c9af1172f8f66b51dffb85cbe92cf32ba5e488d7c5230e4e7e692e0f9c7c203cd3b39b0a6638a5c17ef0c8a70ff1f848d174d7c81f1d96
SSDEEP 12288:/pFtpOH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:TOUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T10155026A37EC10D5E16AD27C85D38349E3B17892171147EF02E081BA1FB7EF86C79A61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0c18c8dc3ec128c057d37abec5471b2d44e7409ff75538e9e53f009f7a739ea6
MD5 d30308e8cecff9258c27e28cd08abfcc
SHA1 47344386fd4da9b24b2dda80e3db1837e7421c57
SHA512 1e3f35e34a8b23e3e0319b40070d74dc7cb9e2bfc341a92d330bd1f3e26f966969a7a6feae08cd742c219931e8d99bdfe64af75290ddbce2aff0021459c4428a
SSDEEP 24576:O7NM9YqZqmWMUkPjZM48Mv6bEhsfgXe4i7ojhsP5Lgrk1TWb4AN5:O7cBWMpPjN8DbEhJe30jaNf1TWbdz
TLSH
T13C659E2E6BAC81D5D577D13DC9E28205F6B2B4611B318ACF1162833E6F37AE44E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 1d91dd55453320d2b578ce93613c74ca7af8d00174c2b658cb79910f168a74d0
MD5 508b8456a017b232eb9b86f683c52be6
SHA1 81804fde003ac7e6dd1081d7bdfbe762ea2005b7
SHA512 646a35884bf133716428d88a085006cdff58359c0d1dc26f42d81122677797e6ea66c458a4662d13f355896251f6231625843fc71ba326256476ec4b9e61844f
SSDEEP 49152:0F2YuHNETovAvNYf8kmWe30jaNf1TWbdz:B6BCf8kbU023W
TLSH
T184857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 f542c914763bb84bc155201156a44a843cf20d864ea81e1dfa8779671bb3f39e
MD5 574ae557b142c4e7d9b534f519c22314
SHA1 a79497508e108fa36a798a4fd13f3a4db23462e0
SHA512 cd5e4f0b2dda2c3480dfd8231494b13ef32a3e33f06e71e87636edfa63f193bc05581b23bc03ef3c9745cbf8a9b2cd20cc902591f80fd6049fe2aebe4960d771
SSDEEP 24576:wAFs06+Omlf3NXEbTowgXe4i7ojhsP5Lgrk1TWb4AN5:FFs060lVXuce30jaNf1TWbdz
TLSH
T13365BF2F66AC00D5D07ED17D8A97C91AF6B1746307255ACB0260C63E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3bdfc60ee54247874ee180f751bc1f532c544765e6946a6034be5faadbae8ea4
MD5 7c6b4b8ac90cc80981bcb85f68b0341a
SHA1 ec033553aecda34f02f4225dfab8e57485bef0dc
SHA512 ade85d8146c52f07a80d668f820f009acde16178bf48199b0cbd36a52f68ab74069c1417339c4d70ef3a78583e1383c05b7910535e018111693c7f9dfd736919
SSDEEP 24576:xJnJ5D3WXhgXe4i7ojhsP5Lgrk1TWb4AN5:xJnJ5DGXce30jaNf1TWbdz
TLSH
T13F75D02DD2A810E8D0B7C3B4819A5795FE72386D2F226ECB14B4D5353F12EE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 13740d58a6dca78454fb250f9d3dd72bf9bcd26e07bf207d49bb561ea4096675
MD5 1fa626aa2f9dc5e7a943f5e32a8fcac4
SHA1 90627f727508d647a025150a2876eeef6dc1e4cd
SHA512 44e27003f9dab534dadd818608d31cc3b921466bf009beaf3c5e5f7a8e8fac3a9567d89c0e9157b9894e1521763fbde4b4faea4480b66baac2bd708ee7d97f79
SSDEEP 49152:Ig06DIKdwc+eQnSt65aVqe30jaNf1TWbdz:JwU023W
TLSH
T1BD955C16BBEA5294E8B3CAB1C96295169B327C509B34F7DF0AC0C92E1D33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 87642bd9c85d1b8a4ab7d65d98020c62099528a12817c024c1c20536338a0e9e
MD5 0b14fcc41829e90c313e392fe959e4ff
SHA1 f6cc09805c1f80446e7b5362d76fa2f685b0e802
SHA512 ac4a10c76c2d9e4bd9fc4bc0f94810c4b02521b226bbb9caeb1e59c53a69999cb17f82a22b5ecfa1741b5f7e12dd8c6951147c2e192fd0f16a67f1d887d8de2a
SSDEEP 12288:VEP3RnT0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:WnQgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F655126D6B9C60D9D16BD17C91E28741E3B2F4A027411BEF02E0D27E4E779E96E3CA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.3MB
SHA256 4b24184e7fd45ffc0c3c3eef2b5d2013c8a22d29e8c676294361b54415401390
MD5 6e1471fba55236225eb67a0045a58e55
SHA1 d5973bae3030916b0746be3b004634e74fc60200
SHA512 24e5af367618d5b46d353d8709abc5873848ac97699e8e57a2f818336147a546534cf0ea94645a2e954b325508c1f904cba62d7d5e8b149fa1b1c58ee1ec781a
SSDEEP 12288:Zjkyp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ZIy2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T183551204679414C5E2AA82B8D5F38390EA707C606B1087EF51D0FA3F6F7ABD4AD78B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 a0012c7a3b45fb17f8d0f9e5f27ce76f857ff4d60d6ecde90a25bb419a3e0cc7
MD5 df51747e7b81ad85855b6d2abb438ae9
SHA1 d3c8532962eb6a277cd2788b6ddf9c4fbfcf635a
SHA512 c0a8f447149b0d9abf9899d54d5b6a713c79e8e2f1a1341d6ea02c531795c3da9b17bbaaa0dbe6ae9bc571e23e464ed0e669c61664917f6920001df4b6b6ebc3
SSDEEP 12288:9y30DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ckgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1374523596A5519CAE24BC3F490F78B91E5B03ED1370049FF02E0F6734EB89DA6AB8C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 0acb41cc99032a181c96eb58855f798b2fbe848618a66c0db717e7ed7fc37769
MD5 2227b14d87c1602e4a1afba590fcaeff
SHA1 5c3f0d20057fd870f5e77f4d63ca05b2d8219a43
SHA512 f180d1f3d9e2e74cf6dfd443cdbbf8d1bab401dd89b70dd4d1cb8b928553894ff48e1ad0f1521874026c6cfe59d1882fd635ac86712e7455f3fa5605fc6db558
SSDEEP 24576:HQ9MxZKdcz9dw3ngXe4i7ojhsP5Lgrk1TWb4AN5:HVKZOe30jaNf1TWbdz
TLSH
T18F557C2DABE909CAE177D27595A240C3A673B4311B31D6CF2448D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 ab138f393827e6bd9ba36307ad16e2fb387e6ac11ca37ae312ed6bd0d26b33a7
MD5 18280b14e0b504950d0f74ffb91f3d4f
SHA1 5e17282d827358a0baadf4751a6767ef696d135a
SHA512 41344ada01d7f5350b2608d636132e526f4ba7386c965576c117253ad0b19b9d4461368f32bb01af476c64c8f76db0087a86fff52ec26235a35e03b703bae974
SSDEEP 24576:4yocDApygXe4i7ojhsP5Lgrk1TWb4AN5:VocDAple30jaNf1TWbdz
TLSH
T1D265E01FBB6900D2E166823C88868741E7B3B4702B5257DB56D1C33E4E77AE9BD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 a6eaf923a8a7393b1954d4f0210e3bf3e713ca5f9d29aff5a28965c6f7b756cd
MD5 eeec8b698845290f9a942688946969df
SHA1 1741411d6e208339aa33ba7adcca96b809e136ec
SHA512 1ddfb3048583548660e3a9611ad6dd2a96668e0f7c3fb672a9a3f45f9e9e2efe7c07b102bac86087214688feb84a6e1a461ed03d90d0f65b1d8991adfa3b696e
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKle30jaNf1TWbdz:60zuNIfU023W
TLSH
T15FA57C3DA2BC00A9D9AAC375C14513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 503842ae644df1e899575a47852b00ca793d36f4fe5de9bf1b30577d558e469e
MD5 2093c632a5ac7c2c082d2ec1c0a63a1c
SHA1 864a1d3c9016a460ec042a2fac2e23d4ec0ab93c
SHA512 d52bb5ff801d424ccf0cd7085bff6787b04f626e9fbce575e3d731065d2f8ac9cb7948a58a65b5afa1c55270031bc3c57eec5fb969032c3acf9eb5bf0c954868
SSDEEP 24576:E1QT7EcpfxR+N5AWAz3ooiYtjMqbQgXe4i7ojhsP5Lgrk1TWb4AN5:5TDxR+N5YzTfjM0e30jaNf1TWbdz
TLSH
T14F55B02EA7F815E9D1BEC5789A23C512FA727851033193CB42A0C17E1E7B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-484-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/64-322-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/404-490-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/404-334-0x0000000140000000-0x0000000140205000-memory.dmp

Download

memory/636-414-0x000000000CDE0000-0x000000000CDE8000-memory.dmp

Download

memory/636-392-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/636-339-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-494-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/636-434-0x000000000D6F0000-0x000000000D6F8000-memory.dmp

Download

memory/636-435-0x000000000D6F0000-0x000000000D6F8000-memory.dmp

Download

memory/636-376-0x0000000001780000-0x0000000001790000-memory.dmp

Download

memory/636-408-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/640-51-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/640-31-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/640-6-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/640-0-0x0000000000440000-0x00000000004A0000-memory.dmp

Download

memory/640-8-0x0000000140000000-0x0000000140475000-memory.dmp

Download

memory/864-89-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/864-67-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/864-73-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/864-75-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/864-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1184-281-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1184-333-0x0000000140000000-0x00000001401D4000-memory.dmp

Download

memory/1548-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1548-243-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1548-40-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1548-46-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/1612-416-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1612-304-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/1612-303-0x0000000140000000-0x0000000140241000-memory.dmp

Download

memory/1612-310-0x0000000000520000-0x0000000000580000-memory.dmp

Download

memory/2964-319-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/2964-317-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3288-284-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3288-489-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3288-338-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3620-321-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3620-253-0x0000000140000000-0x00000001401F8000-memory.dmp

Download

memory/3708-288-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3708-410-0x0000000140000000-0x00000001401D5000-memory.dmp

Download

memory/3996-264-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3996-257-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3996-325-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/3996-258-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4160-298-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4160-413-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4160-291-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4160-292-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4256-421-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4256-314-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4276-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4276-244-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4276-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4276-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4568-245-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4568-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4568-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4568-90-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4616-227-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4616-12-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4652-485-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4652-326-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4656-330-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4656-486-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4792-91-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4792-53-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4804-277-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/4804-271-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4804-329-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4804-272-0x0000000000660000-0x00000000006C7000-memory.dmp

Download

memory/4880-228-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4880-16-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4880-24-0x0000000140000000-0x00000001401E8000-memory.dmp

Download

memory/4880-25-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5248-451-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-446-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-430-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-429-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-428-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-427-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-426-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-425-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-424-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-449-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-456-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-455-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-454-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-453-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-452-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-422-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-450-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-448-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-447-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-418-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-445-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-444-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-443-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-442-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-441-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-440-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-439-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-438-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-437-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-436-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-417-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-431-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-432-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-433-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-420-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-419-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download

memory/5248-423-0x0000023C2DFD0000-0x0000023C2DFE0000-memory.dmp

Download