c67af534a4ca29ad7daab8667da45ef0f44155f595e006ea8f56fb79c6bca820

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260704-xp8sqact6s
SHA256 c67af534a4ca29ad7daab8667da45ef0f44155f595e006ea8f56fb79c6bca820
MD5 46591fd8b5be6b650bd1b584ec89c04d
SHA1 fa27f78aa72761197c2311eba6c619da85ef55b4
SHA512 65dd9016381faed682bd0df80e3a2677e484f9b9ae02198c1490a7e9fb222f1be8bca0df27da821ec0f556924b3cbe20b4d45c9be600e15f7620a9dd12080e32
SSDEEP 24576:ivrHWdZcy2TbqWNzCQHzWRTMV87BbkjCMvGdLtC8nYHR4wVhOLRQg1pBeNL:2s/EmQTOTb7mGVtCGIR4wMRQg0L
TLSH
T1D475AD2237E58035F2B36731993A931459BABCB29839840E73DC666D2F70691CE74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5796	alg.exe
1112	GameInputSvc.exe
1284	GameInputSvc.exe
1356	elevation_service.exe
4068	elevation_service.exe
5380	maintenanceservice.exe
4592	msdtc.exe
6760	OSE.EXE
1904	PerceptionSimulationService.exe
1868	perfhost.exe
6552	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f8987db18ee34577.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_125484\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1284	GameInputSvc.exe
1284	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6396	2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	1112	GameInputSvc.exe
Token: SeBackupPrivilege	6552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6552	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5796	alg.exe
Token: SeDebugPrivilege	5796	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1284	1112	GameInputSvc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_46591fd8b5be6b650bd1b584ec89c04d_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6396

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5796

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5380

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4592

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1904

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6dc5d775fbceadc594f9f3460ea25f7cb38cff4d606ad531be4069760d4d3de2
MD5 864aeeefdd706231726d0ba9a07dcba7
SHA1 12c1d120e9df86db535d4f6830646e744d397373
SHA512 e1e1968842d5aa3a2d035ace855d3e0ab9cd5fc9d66760ec5662f6762df2b725c9a57159398c741fb76b5ffda44c056399950452bc5e3803e566763b4e477f6d
SSDEEP 49152:/b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnTIR4wMRQg0L:93q6gjByIR4wMR
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 1a728f9818c6e9454ef98984e774550c2bef33c754038517be27de53da33706c
MD5 dfd25b29156afe602c448a3a00c2725e
SHA1 71501cecee908ed7a5d0e2b22c0d8204499a66c5
SHA512 328970c284e0ae761136187719b4afc86d65c98856c14a64ff3f02b149ae8c130151e4698599ba34b2f2780cf2e15cd0c89cd04b57cf81bfdd76989cc9380693
SSDEEP 12288:g1XLsMy6Yxm2lRq2czAdZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:2XYxXBczAdnYHR4wVhOLRQg1pBeNL
TLSH
T13005026877D509F9EDA3813CCDA28511E633B81143A4E79F03E099761F233985E7EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c46e8f5a203298f8d85ede9a654f91d101408a0352e914480b47d9becab77c26
MD5 8c6e24e2ebbf72a11a15b93c27128af4
SHA1 77ed9cb78ff550a5b3f85ad10a580fec037c0fce
SHA512 12ec1ad64d6e7eb769207dc390e5fc4ca44bed3c6b05aaee1bc8ae1519541a83bf170adc52892f452968407adac63e1747c8ac3f0ba3188dbba7b1034307475e
SSDEEP 24576:c00eY070pgxOrM2nYHR4wVhOLRQg1pBeNL:cD070SoHIR4wMRQg0L
TLSH
T1F835AE65F5748331D073C0B9C5D2A69AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2c6f716bd27ae2262c99b632bcace47edcd67c3399740a3f66c9c6718aebed35
MD5 18978ac44383e99080159837aeb372ac
SHA1 4b506adf7bb22cdd40337dcb2092005c3a602b0d
SHA512 d192112817067609be010d966385a2326f37a631681e3ef23df890bd0acf27bf33249872e754e921d9f3659ca1dac9afc8a6ccb2704108fef23ad928868cbde5
SSDEEP 24576:B6M/ezSC6vUyD/aqgrvW/6q8wyuwnYHR4wVhOLRQg1pBeNL:z/ezSC6vUzPvuHjyrIR4wMRQg0L
TLSH
T16A756D15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8da48665131ec8f07b8f2c009399b894f514ffa2d89a855aeff88ce62caf1d08
MD5 efc1e845c73f5dfef85ae0a8dd775c80
SHA1 283630007c727b851bbbfc4c90ef2b67ce55c7d9
SHA512 f141e1cbba55790b1351e86492c824abf79af97fed92b079b0a5014db17a692adb2bb2c5c379bbed1698001b9ec7bb358878a15a17d06ae39fb3f0e0b23bc056
SSDEEP 24576:oab6Pg5EKv/l+dXnYHR4wVhOLRQg1pBeNL:oap5EKXl+ZIR4wMRQg0L
TLSH
T148559E66F5748331D073C0BAC5D3AA9AEE3230425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 2524531a1b43fd233d30e658b3b169050a9c069ea1720b7f54e6106ff92046de
MD5 c8f8eba869e0866e6bd1cc4799392cd7
SHA1 7b5485ae87f419ae15d65454ec3cf92263d5c7aa
SHA512 9ecefcc37d3d2a80adbb12ff990622af3e9118c696b60c308ba48a55beec01aadf7a305c3a41634c50a3ad3fc09d1a4f7ef653d8b85f9576a7b46328ec031c3a
SSDEEP 12288:QB6eZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:QBhnYHR4wVhOLRQg1pBeNL
TLSH
T1B7D423DC584B83C1F3F244385EA7A9A2361AF41275DCCE1DA0917AFB4931319DAE63B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 514fb5e6873115b1b1aa2bce7bd4ebe2f7a6b8dfd98708a22174e201cfc339e2
MD5 1b492745e2693bca8e24e574d51a8923
SHA1 285a65b6a6db7f25711bff6cf7efc89cd101bb69
SHA512 934e13f89fd686a519c212d8811d4600a4532421b76e194e96600b37459e917d1333fdc51661d1505fadaeddd41b6c7e92ca891b338524e58504dde52e3f65e5
SSDEEP 12288:qeBNUbTVO86UIcZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:qJIUxnYHR4wVhOLRQg1pBeNL
TLSH
T15215D07BEE28FCD2C27A8CB85B91C600A77274314B6193CBD165830EDE236E45E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 e1d4c8719c446f6c9d26a6d77336505ccdd96196bb003a2b4dfbb9908e9d9c07
MD5 aa163f428580740db172103c131c8d5b
SHA1 7e06803002d5ea02a80cc1cb209a32700ab0d9cf
SHA512 7072e4cb93106930cf7d843cfa014da361e276af96bdc26e994513fef986c2cc8955be380ade3c1a6536146617645ab4b02658deb0e1d14ae68d2d970a9be3cd
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJA9DN5JRNRV3THb:XQvGAdlCEL8c/ARN15CRIR4wMR
TLSH
T188367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 99aac0000248f699e33d67142a389db7c392e28f573ec7ca01026a8d5363b05a
MD5 87685bf1a3d2c18797833dda8694eecf
SHA1 642988a8a0192f5cc583d5a27b8072bcf3e84f20
SHA512 d3fa7a09e74f1da29ce064c93336f604b65cd8cc71088c2a6253ec794e807272d4255bbbb552f6b9c66f2d4635f01591cf63c941b24f96561bc7d48f4ec0204a
SSDEEP 12288:y7wSfxL/2Dc3bDLLmt0LDQewsAjPaZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyu:smewsAjSnYHR4wVhOLRQg1pBeNL
TLSH
T15E15E070FE75D036C3BB0CB61B26C716242DB9204B951AC7E3E85E9E59302D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8f81f5a34e82d517c18ef2ceb4019dfc84014f165db2a1bffe706eff3703740e
MD5 777c77b2b686ad2d637403ac78e585bc
SHA1 faade46b7b0fb32972a6097eaef63b8d53ae38f0
SHA512 04f72b4467504490dafec74c18cfa9c0643778855868489ddf1cd5342c0bec9ce78477878a4c9c38586367ad5f5b3c37934f321fa8b435e5c450df7bb7572e1d
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrJdPlbuJHcIR/M:xUEtQevvqc2W1cpV2Xrz2c8/
TLSH
T113474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0ac20b866cd11f35d25a6d93d55f5886e7700eca8e5113e9fc89215c88b78971
MD5 b9ad1f124e4e81d855596e777078fd44
SHA1 81fb0b2a451ab937c01bde609d833a9b90271b21
SHA512 ab4f56ff73af5b225fda927044a0e3427f823c482e40a8787668a3e973b7e103a92e43928b312c6a93ec002c33cf2f8ce785b4016b2e709d3ba28cce488b2405
SSDEEP 49152:zFbRquA/m2yL5zMfFiV+XenmE3/zVIR4wMRQg0L:xoq1VjnmoIR4wMR
TLSH
T167D58D0976B8C2E4D1F6C77886A2C647F37178154B349BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 69f8a949d46cd8a144642ae956f64a2a150dcbddc9600f4be8f976b626542bb4
MD5 af5e84d4050bd1aced5191038754a90c
SHA1 8ec4e75e984248493aa28acf648cdabf45c3990e
SHA512 9ca64b79c8967eb10e0bc575ae479e179736d188716b0be8e952ecc5113dfb2161e44ec3658294c6f63e514a2e22455221956942b6b2be8a4319e1d3080c04f9
SSDEEP 24576:BAhGLvZFoiwtA5l7S53BnYHR4wVhOLRQg1pBeNL:BAM9Foiq5xIR4wMRQg0L
TLSH
T107459D80EBF945D4F5F3AAB899B69571AA76BCA65E30C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 2137f3e012a97df85a0c0acc8d941dfa8f8022fa5e8b94fb333ecc407c4e7240
MD5 ece8802256b72eb8e6090221ad8d1bcb
SHA1 ba636e2b7f5e6b06c5bcf4d6b3fbc2c55b7cfbc2
SHA512 924560c829a03cc13122f893f5b870fb8370ce443f7b377527c25f1bdf49420bb75fba46459fb24c796f2b28d1533d7e73007d61e8dea2f0097184419082a691
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C/Z7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:Owu+OWknYHR4wVhOLRQg1pBeNL
TLSH
T15005F18976950CF9E6A381388997C532F7B3B8123A64CB1F5760C66B5F33321AD29770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 354ecf33e6efff30eed4fcf14753aab70947b85cfda4be4036837ae0c0d1386a
MD5 2fff556656357f1fdcef7c7c2da452b2
SHA1 f91ddecd4ae2746d5e31f31943cbb95d7bb2a1a9
SHA512 74a7125c58e8e52930fbd32d4af90e314f75f55e072119862f51ccf279fdc401d3f697485cab8939a3809f19fa7a9bdd5a07a290a8ccf3c58ce445626197655c
SSDEEP 12288:zrB1I7TfkZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:vBufknYHR4wVhOLRQg1pBeNL
TLSH
T1CDE412DC26C561F5E2E3813C8DE79A41A732B02273B887CF116046AA1F23BD55E79772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3cc6137bfce6cb2cf30d78e2036bedbb41072d5a666dbb56622e8de9d3250b00
MD5 4288a2d794129da663822b52c0986d7e
SHA1 2162687c3602cc24d1d89a78de736846985d1d25
SHA512 dbd96a278cd74893c6a5d1e53749880ad26ba813b2c2e39099e3715b7d3045844fa17faebdd28c7ef25ff040762e6eeb631b6e89897d9ad9f8c12da47d8abecd
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UI:hQRQyi36YOcP8Lvw2gAf+PN3BEgsQC/
TLSH
T1E1667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 955ff490707bb8e612cc8326c2437170a7156d79e8f622c98c708d06f1c854fc
MD5 1d1746338872a684fa7e415a0869c55a
SHA1 1addb166264ae2f743228b69483190cc317fd0dc
SHA512 e20a074fd9d6cc84cc8b646e1eb4deceed7828cf5c098be2c125ddbf1d892de47a5702bc3a4f0fc96cdb3bfd8226b041e8b32e80628873feac2fdb9238feb501
SSDEEP 49152:Cj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ui:hQRQyi36YOcP8Lvw2gAf+PN3rEgsQC/
TLSH
T15E667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7455e8326d11ccf8b30130e21bd5476ddd58f6dc602f3d0b2b9cc2921c2df6b9
MD5 6bea36cdfda17784fe41e707a357e416
SHA1 d4d1c8e335ca73d86ad0d01d294bcbad717fd5e8
SHA512 52ab4336c8412ba367b456362b63e3e9e4e943cb6e5cc3d76f8e0c7dce33137400a9de203ca2919b8c2443194f4c9c38f733bb7f89b1cea63b0009cd36eae06a
SSDEEP 24576:KwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0zKqWwhdf27t1AQ8:k68Qg55nhMeWu7PNU3/2wCdf27sQCKc
TLSH
T129B55933B2F200A9C44DE1769F46973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a3ceac546a30f0b65cf07d07db0fd6b6b76c2a749158b1b2702aa47ace3ea88e
MD5 d889eec64aab26fbf250d9d8db9eb3d9
SHA1 50ccaf768099d80178f013b306a838cfd2cd1022
SHA512 984f3f41531b47a1a10098e4601de0022fae9c488b7eb2ae2437fac52f7e1a3af1cec567e94efaddef6a745e9bd5ab1f301db3de62ec454724894a4e49850c29
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99q:Ay5112gYy5azzVv569nLKnhZ2EgsQC/
TLSH
T1BE167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5feaae8e02b02e735d2393866d05cef376100c2f68bdb3a049e6ac7a452edceb
MD5 aed765a1e9bae9bda9d29ea2b15d1df9
SHA1 ff0e0b931e94d9d1ccb066e3ac22ccd42c414d3d
SHA512 1b6b01b2f34943c846f6e2702fcf41da7cf3e1bf3d628bc7d6198f62923bf384eb2f388b61fe7ba461fd9a6dde940d8bb1273d0c9807a0d1bf5fcddad20525ff
SSDEEP 49152:NB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glKIR4wMRQg0L:Tu6JmTxd2dKIR4wMR
TLSH
T1ABD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 be76601a9856c401df4a8d423ff56b93cc5ca20b7d012cda3e8dcd58f4e361f3
MD5 8b2bf3a21bd891524aa98d6745e937d0
SHA1 778f008691afc942584cd8c74361ab6748d20558
SHA512 4df8f64acb9634640de13e9fc815d4cca68713570a39b2b7cbb112a1fb189571da01c406031ee45cade7e03680d9c58a364ac604aa56246388c6a3aa456904c2
SSDEEP 49152:+1hpsNoJpF1A6UU44CwH7R4x4wCdf27sQCKc:+mifPbRWEgsQC/
TLSH
T109B5BE13F2D801E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0353ef2f973fa71bcfb54b22a7129bbd10a59065ce2f1a1dedeeb490d2643d0c
MD5 30e37d9837dcded23895de454ab09040
SHA1 185fabb6df04ef3e063ba31621e4b8b53bd6bef3
SHA512 121d75af7c56056cab50c2364431d390d8d276d7339d8b08083892f7ac7bc16f4516716b2b925acbd25dedf894bc7fce647de041306035558782aafc8ba81c0c
SSDEEP 49152:4SuZQIY0Be2K6RVtOnks6NMHqdwCdf27sQCKc:i5dKoi61GEgsQC/
TLSH
T1ADC5BF03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e7bef37862c233e68232938cfa5486f4bc820877b9f9c698dcedceaaf31fa8bc
MD5 6ec6ddb1e1a234881e1ecf8601618362
SHA1 d32877f5df1e57c2c428a745967fd6a3b2116aa7
SHA512 cd53ba7f9ada548802edf78af77c2157d5ea464ddfbe2cf01b5e6d50cba9259d1ec012d4359b0f82dbf9fc14259102f50a380b6201daf4b3902f6466f970b113
SSDEEP 49152:QhtSn8EApI0figTgiDn0AP5w2wCdf27sQCKc:BX2iyphcEgsQC/
TLSH
T19AA5BE13F2D901E8D06ED178C7468632E962BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 ef1236ce63191bd4832fc398b84636847f079ab757680ab817ebc7bed9b15fa1
MD5 6c512bc17d04a17e3925091e0e2a428d
SHA1 bf684e2f75b30610abcea194c5f2434a04f58249
SHA512 1b70a69e7f4f483bce9983deab9769acf4d636a6f14869e2e56a2be0b784e4d10ca59238a94f1c7c5334f7fdc30fe9cb40391357c89aad7f7f14c5c916064fa4
SSDEEP 12288:UEEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:UoKqWwhdf27t1AQCHq/3IPn3nN
TLSH
T1FDD423C7278063E6DBB5CB3509403E8FA4C87A27BB81DE9B61161DFF7AA03C31650695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 7d3b199e1749ea43ebeb70a008b68d30b4921c212592d21fe9262e79a49b46cb
MD5 b4f65fc0e60e2317376b7ff37c4d448d
SHA1 1b8983cd23bbd0eb34b151a3077645741225cde5
SHA512 f80813778c8e33471251fea2d2f3fc883551767722799694b6e9134149f0cff85acbafec28c84eebc9762aab1d817fd97c0d4a028dca5fe008adc5cac3997e94
SSDEEP 12288:6QEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:60KqWwhdf27t1AQCHq/3IPn3nN
TLSH
T122D423C7278063E7DBB5CA3409403E8FA4C86A27BB81DA9B21164DFF7AE43C31644695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 740088cf101c21d10613d6271fe65ab864e94445846a24a65b39d61e6f811a5b
MD5 bc1bba7edc5cb457675a1984a7dc76a5
SHA1 13acaf07449de5c8c58e992fed5083f0a2bd6954
SHA512 26b5e3bc09d3f158851ca0fec34c1eb1fa6c251ce7688f165b6e044813bc343aee1bf529fc1e569275b481fc37397d6b77d24fed096fb929ebe90a49f42448c3
SSDEEP 12288:MnEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:MpKqWwhdf27t1AQCHq/3IPn3nN
TLSH
T122D423C7278063F6DBF5CA3409403A8EA4C87A2BBB81D99B61161DFF7AA03C31754695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 6fa9ab9a222d2d56d4ee2442bf934505230272e0b4290a9773e9a425cc504099
MD5 60d1d3d725fb99a6d2dca4711783a33f
SHA1 99801244610b00007bbc91312ba7772af471712f
SHA512 6d41bd2fb36e51e6240d002be7beede4d8372abccf2c0a3bf3d290158d0cfa81dfe3482e7df307cfb35becfea7f2762a25f87a6e19f7c79a67d04dba20d4dc63
SSDEEP 12288:klxEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:uKqWwhdf27t1AQCHq/3IPn3nN
TLSH
T1E2D42387278452E2D9F6C7348941394EE1E4BD67BB61DB9F52110DEF2EB03C31A20B95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 76214c42a14b57093c6bf9defb711fe7eb27712cda263afb3dc1f98c2973c776
MD5 c3ce371c79ec25fe3858e72f817ca96a
SHA1 78b018cec04cc2abfad2210141ff6c706991eae3
SHA512 5bad5717d7cbae349a1f9783e4c441f3460042999be683335aec966cf2080f401f8b4c587f9b6a5b380ad198dc053e7f6ab5e270c6097f1ac94f33513579a697
SSDEEP 12288:LbEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:L9KqWwhdf27t1AQCHq/3IPn3nN
TLSH
T108D423D7278063E7DBF58A3409403E8FA4C87A27BB81DA9B21160DFF7AE03C31254695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 1c34ff2e63d6bc4ac9cbc08e7218cdaa4691092fa5c1fb694076328ed43608d2
MD5 40eca1ee63b5194a998afb88314c0637
SHA1 1e06267fa1f3a242f5d7db45ab5360989eab4f7d
SHA512 ac88563de568f3285a5dbbb173032c7e630d82ae0179e19abb351963367f32f2191f2ddb334a43a25f9c99ad4d1bcfc95a4404516bfcd62356e9dcc54df84d18
SSDEEP 12288:AmEOPrKcyc5Wwa8IlMdV927G1eDYIAQCTzPKbKYbyie4IteGn6on7Bz1:AaKqWwhdf27t1AQCHq/3IPn3nN
TLSH
T142D423D7278053E7DBB5CA3409403E8F94C87A27BB81DA9B21164DFFBAE03C31654695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 3b4e59d0a88b25a8c4aae7021dfeb3bb71bbf456ca2041bb664a449d964b4227
MD5 d491a6d2d4d4843dc6094b8ae7fcc845
SHA1 d7d9f9183b85e88a2fe8264b6d9d2280de053ccc
SHA512 99cd1f03ecb8924643f6f29f9ce5f648b60f4a7679bc07886f61f5f425d0241689b0bb58aa807602c8a327be431f4a7ed9ce095557e457694a2a693b83d98f63
SSDEEP 12288:9YgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:9YBJh/VO0buBuT3yx4sfIO1c
TLSH
T10FD423876007C837D54C07B669362EDF18CC2531EA27B7DF56CE10993F26A01A156BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 15486a90cabc3bb45cea4bca77e11a5c8b0f99f7d9858edee4de427aca4f3099
MD5 37d7b913443394a2c0720a4754f876d8
SHA1 bf071adfc8d6d873788abcf1ce4b4013c95d1449
SHA512 e120cb00af485ac3fdc2b1a8451f4384ea3c2fab664c77e32c0df9951643b538b95de743d56b8d16b68c949ea3094b36cfbcd1dbbec32fb937b3396a7e3f3c4e
SSDEEP 24576:BZMQzF1SDzBJh/VO0buBuT3yx4sfIO1c:BZMQzPyJZdbusu
TLSH
T1EA150195B35058F5EC67823EC9264946D5F27C2A4B70C61F03E8366A2F333511D2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 e2d1250d311640f1f1f79b2d2cdcae8a49498a1c92f562217b8053d60664931d
MD5 ae5007c55eab1e0234366b9cc5d7e96f
SHA1 ce77811a1e26f8a4abde1088c76afa833505bd4c
SHA512 e4ec18eb382ab89fb156ab35e2d96ccc4a489207c3994951a4157fcec7224d6475fdb3a38aaeba8e737c41c1bf93a1e0ed6ad26d684ed10972128eb8cf73e904
SSDEEP 12288:0EgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:0EBJh/VO0buBuT3yx4sfIO1c
TLSH
T1C8D423876017C837D64C07B669371EDF18CC2532EA27B6DF56CE10993F22A015216BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 48120a0e532075450eef28388b141e6d9df854c2ef8664f4fff188fc8d4d5eea
MD5 df952d9662dc0802328b2b793fd9213e
SHA1 608a9e99956b3eff7b5cb612f0444f01a43a7f38
SHA512 f4407c4ac4bdf4341de8dabc135527dfdba84bc99ad5cdf6a50d4f920cd339ec59ed0a6e9353ea0d1116670b33819e04193fdb6af15d805a752b4b67ac464c56
SSDEEP 12288:qXgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:qXBJh/VO0buBuT3yx4sfIO1c
TLSH
T1BBD423876017C837D54C07B669372EDF18CC2532EA27B6EF56CE109A3F22A015156BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 5420fc1258c7fa145bb09228ee92225792047496e172e3d42ea207a7c3842cb4
MD5 c3a3058acf9e21ae72ae08a3033220b4
SHA1 62ea5338d466653fd46ca9b017050fba0185a25b
SHA512 a29ade42ba222ab26a54ff30542ea82f808274acf726a37d58b3a4eac940018595543a76b9521c4646c60c7a087ff39fc14b5c984312f41e48855742006f4842
SSDEEP 12288:kFP9nLSVgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:C92VBJh/VO0buBuT3yx4sfIO1c
TLSH
T1F1F41247726270F9D16A433588721E46F7B978324721DBAF1798067A2F237809E3BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 e7f15d96e19515dc6d49dbdb8668243452cf06ceebdd1285e8efd61dc30d1bfb
MD5 f6c9a02789c3d41bf02e3636752c7fb8
SHA1 5de4d2457228013dbdd2abf22640d6db17d82481
SHA512 77a35d16814be664045c1973bd923ede0bd807b6402ad0d6d379217b6b9b99ce746fd8a845675c1ebcb16d027c12478b918ae45e1fb331bd33fc8245fe63122d
SSDEEP 12288:A/gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:A/BJh/VO0buBuT3yx4sfIO1c
TLSH
T146D423876017C837D54C07B669372EDE18CC2532EA27B6DF96CE10993F26B015116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 7bd785cb33b97e3ce0d3dcb001111ca5703181a843b7b2d3b14cbce79db3e057
MD5 22565cd221125c1a4d35495039011bdf
SHA1 60c1a9097f2d05a72d30879f5e1ba3e32a266ae8
SHA512 80ca9b958f5379b8a72bcd059c138e17bc1467e9bfdb448510cb7e95f7435c505dae01abd945efa7be32e214edc24624c1abbafaa5b9dc44fb3e8052b3c7f16e
SSDEEP 12288:U5gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:U5BJh/VO0buBuT3yx4sfIO1c
TLSH
T153D423876017C837E54C07B669372EDE18CC2532EA27B6EF56CE10993F26B015116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 e3da3817a6b60c4e93034076cd9e77442050f9ee7667677b8b1690ff0d3a7138
MD5 f92e22d10e03949f62a2242f313fa0a9
SHA1 dbba52e53649c945e97106dfafeadafc1b88639e
SHA512 ea7df2a7ebdf5257e49357af16662790b981ec0a05dfee183fc5bcc70563e388932ef692690b67f44b19ef7bc109d662a107972238b3422393ce19be25d86e82
SSDEEP 12288:hFP9nLS1gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:T921BJh/VO0buBuT3yx4sfIO1c
TLSH
T1F9F41247726270F9D16A433988721E46F7B9783247259BAF1398077A2F237409E3BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 a41f4cf99ab9b33123e0f67817be597a8201a5db3469c32045ef07554152ca5b
MD5 15e76708c52fb796ceb82b1de073b3dd
SHA1 cd7cfe94a6202c6cd50b420a8b0e976ae1262ae9
SHA512 fca205e0b0fa4353d643c902f4f8a878f5b28ec3e9579cd85656fb64f771fba5bf67eabfcf4ef4de31089d8cccba478ba798915bff21b93202f80eafb73f1b85
SSDEEP 24576:cTaaLl3z0zBDBJh/VO0buBuT3yx4sfIO1c:cTBLljeJZdbusu
TLSH
T10E150195B35058F9EC67823ECD264906D5F27C2A4B70C65F03E8366A1F333511D2EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 79683da42a6376e2270481966062368f848ac8be3fc416f0c175cab18ec889d4
MD5 1c40b1cc747554507010cd4ec3f5082c
SHA1 082d6f539afba903ea4a27931b8d06d16917fcad
SHA512 d3183504eca7e0d23f9ed908357f07ddb29011a6abad4be8b3fb87399c8ad780921349390303035f2b0e084eebd6c54b202d3457f5d6ea93eb15320b07b6320c
SSDEEP 24576:O3pdsCHly7y3TBJh/VO0buBuT3yx4sfIO1c:QpdsCHly21JZdbusu
TLSH
T1FB35CF90F3E414E4F0B78A3589764512D9BA7C6A5B31DA8F03A8255A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 f150534d911adb5f8bce237917028ac23fde4cd3aa217cf1ae44912dcf46ccbc
MD5 e488a01badf8c83431ca5c619f858bf9
SHA1 ca8173a6893858e2f1d24527869badee0456472f
SHA512 4f4d5e3405d044d836363ad33943f61bdb9afc36220b6ebc176604f4f8630e57d940f51bbe27f662b994a752e39df12b5a2782c43ec9ed4beb5601f141310b0f
SSDEEP 12288:oGgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:oGBJh/VO0buBuT3yx4sfIO1c
TLSH
T199D423876007C837D54C07B669372EDF18CC2532EA27B6DF96CE10993B22A015656BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 23d921b6b395eb73e86fde48471873d8e4a445d7ded11cd2a6372923486fefbe
MD5 4ecec565bcf7928bace89ef555274eae
SHA1 4c8be16533282fae23e4f7b18e62cb0103be7fde
SHA512 085ea0c65855fbfb9e21fdc9b635d213e369dd1c4807efdf3eec6e2e168fb597987fef2b2bcdd8337c900c3db0222cf94d6fe86ec4cd8e5136ae1edc2cebb907
SSDEEP 12288:8tgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:8tBJh/VO0buBuT3yx4sfIO1c
TLSH
T1E5D423876007C837D55C07B669372EDF18CC2631EA27B7DF56CE10993B26A019612BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 e4093e2afec4b22ca033763d350610cf4e6d096d62a0f75f908e621fd0d5e5c6
MD5 114d6a9f52fc0af00b759064a8f0e5bc
SHA1 009a699afa747661be40b88a30dcdc37d3a4c119
SHA512 86290677ada2f0d1ffb8a84eb2886f684c756745827d086d024d83d09e6c33267bc4ed920667eec4bfa71380927c5722025d614f09d3a52005dcfdedfa32c310
SSDEEP 12288:ZEgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:ZEBJh/VO0buBuT3yx4sfIO1c
TLSH
T1EDD423876017C833D54C07B669372EDF18CC6536EA27B6DF96CE10993F16A015222BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 6feeeca1ff18106c8f50a49e678e361288c5149cf0d4bd3b5257ef77ce2de212
MD5 82abc2da12ee9bed6c993202d2893636
SHA1 de972cf011882279198bbd7fefe6602b5e7093ca
SHA512 5fcba1205688e26190324090cb87364dd64602be119061067a47e75cd7246d8c302c1ca5b1453cbede91d291a8c2c80083dde9ef933733f18305f085ab089eb7
SSDEEP 12288:S0gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:S0BJh/VO0buBuT3yx4sfIO1c
TLSH
T19FD423876017C837E54C07B669372EDF18CC2536EA27B6DF96CE10593F22A015216BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 8dd4374ad51674f039bd6046843cea8459633ffb16b94e91f932c951d3e666a7
MD5 f1bf31886aa58a2b5b8dcb39ae304ff9
SHA1 84c9c2160d99a15877bb2f7e726ebd63614d4da4
SHA512 8e171a00d2d326bf1bf66a03cfcc2053593449a42ce274dfbfc1509162363b20a8ae6828e9c25349a415e89650e047270dbe1bf02b9aee8eff5a5f362a08f536
SSDEEP 12288:e/gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:e/BJh/VO0buBuT3yx4sfIO1c
TLSH
T1C5D423876017C837D54C07B669372EDF18CC1536EA27B6EF96CE10593F22A016216BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 03248653d6fa3cbd87a80aaa7236cf9f4af296e7e833d4ad4e55aab04e922e56
MD5 c55ab344475551d07c0fb4d2a0676db9
SHA1 ea6927f00eedcca8df24fd9c5c4034787a58e7e0
SHA512 d1f51bcc988b15a6c19cd1c705f42eaa75d35994a47efb0818ecf8d0b19202e8fd8b359491791d9daaccf2a867b2500e78a2a0d0d85da835a712a5c5d242c125
SSDEEP 12288:nvgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:nvBJh/VO0buBuT3yx4sfIO1c
TLSH
T1AAD423476417C837D54C07B669371EDE18CC2631EA27B7EF9ACE10993F22A016116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 52bd260791f7ffd9ed9beddc9cfaa24a8881151838cdcd68ec29c2f0bdc6759e
MD5 c59b372a3247b1fba73cea0db2efad16
SHA1 ac7545930f7b0461a421e29bc6007bd543cfc0c3
SHA512 36fe15c3424f19c0022874ff1c6ea0591ce48fd5592b3f47abfa551f5820a3b29ceddc4e0717ae29b30c6c5180525e32ad88983f69c297e5aed3adac16715e85
SSDEEP 12288:kSgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:kSBJh/VO0buBuT3yx4sfIO1c
TLSH
T11DD423476417C837D54C077669371EDE18CC2532EA2BB7EF9ACE10993F22A016116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 584968d85dbf38403a961eb3d79c4a7a7d0fc891af552d00ba25af80e3ef9c71
MD5 c6f376f250dc71534d9c60617307a1cd
SHA1 4973f7a9feaea53babeba4c42f0a268c643a74aa
SHA512 9b8167b548935b250768c97230676d8f6f153dc99bc0ea69ea4ce2075baae1700857c87e1328562e8f868c532cb3082490c4f6bab0c3996756b1f6e307f1fc9c
SSDEEP 12288:TBgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:TBBJh/VO0buBuT3yx4sfIO1c
TLSH
T1BDD423866017C837D54C47B669361EDF18CC2632E627B7DF5ACE10993F22A019217BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 598KB
SHA256 ca622e893502dc03659361617064eda4943fe161c1af1f891b1a9488438cc2cf
MD5 904d063667e4e841d57d7d22bbf41599
SHA1 d22190642de0be30795a357e2976b22d47e05ef0
SHA512 c12d0e3c2c7cd04be078fa01bedebb88d41acbe1a8edc6e606926cd293d173cc8d20bb711c3c30a592c72d68ca9494c6076d0666afbdb8d408189f67ab0464bb
SSDEEP 12288:d1gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:d1BJh/VO0buBuT3yx4sfIO1c
TLSH
T1F4D423866407C837D54C07B669371EDF18CC2532EA27B6DF56CE10993F26B019226BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 598KB
SHA256 d6eafbd45470cc47ca13937337d9b946d95912fc33863645b1a994a8290c91cc
MD5 b65561e3bc24d31e1abe611241fbf4bc
SHA1 7d4823fd720480c3265e9cc26a8fca11b58f8687
SHA512 7789a7449caf42637a968b16884f7ac6849313d4d9c3899a2d3261cfd7079ffc81c382291f3af8ce84541cbaf0529f27397c245ac1a81db50d8cbbb49d6d0559
SSDEEP 12288:9HgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:9HBJh/VO0buBuT3yx4sfIO1c
TLSH
T108D423466407C837E54C07B669372EDF18CC2532EA27B6DF56CE10993F26B019126BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 598KB
SHA256 a78e277357c3982aeb00aef7788adb26da7ebffdaf07668ea5f567c03c531cd3
MD5 36eae7abf0e33a83df1dbd08cfcccfad
SHA1 694fc54f98f5b6a67eb33a990967e85abccd50aa
SHA512 fe29c2622dbd13995cab6328098f593e4c3ce2137d962829b49d7e33636618e3e8e9fad8e98f8cd8343084b08dcdd74235dcc919c17a0990b087f48b558ff657
SSDEEP 12288:VTgphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:VTBJh/VO0buBuT3yx4sfIO1c
TLSH
T11FD423876007C833D55C07B669371EDE18CC2632EA27B7DF56CE109A3F26A019116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 598KB
SHA256 cf102c29f77f0d65a2cf282f66eaaed3779189c318ce62bd3aa765c02a5fd500
MD5 d1f9b06e966f158a1167628e318e5449
SHA1 f6868fd4622add511ca41956d534831d679e3e83
SHA512 64c45bd469289f3861a2b90f1f9ca1e1c9ecda108e664e38f4a655cc5de2695e440b4b88530c268ec5fb2b2d60d0e67266c99abff247223512e886e59bc697f0
SSDEEP 12288:G8gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:G8BJh/VO0buBuT3yx4sfIO1c
TLSH
T1DDD423866407C837E55C07B669371EDE1CCC2631EA27B7DF56CE10993F22A01A116BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 598KB
SHA256 8e96e409973888aab2c06f2c17908fb8cc72b875a972ce3ed13fee1621970269
MD5 37c5096b9b72e5f5bbb6427b0b10adc4
SHA1 f5b50562a6f4caf77eece7b07637843c5a3d934a
SHA512 3671cc9fa0a43e6b383a3165aadbcda23e898e428cc75e132a9e51f2d0d3d5a984806061bdb06fa2516c6c0d9bce3934c186f3010cd804dbe48e8ecd43d40de6
SSDEEP 12288:rJ22gphubLUUh/Vo90buBnuT7lhf8DxEimsfI13o16+nW:rJ22BJh/VO0buBuT3yx4sfIO1c
TLSH
T1FCD423476017C837D54C07B669372EDE18CC2532EA2BB6DF56CE10993F22B019256BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 cd2f6ca2f8a6ab92533e7ddd5fb873e536f8c569aed35aae7c7cf6051fcfe550
MD5 5f504ca3605f0d0767ed6a02b2b9b352
SHA1 311e3a0697737eddf0513a8d4871ed4427bf0ec0
SHA512 73779c85086509d60a9e05e166f23e300afa229434eb5ac61a8b55fb2d8c4bb28e85ef541cd26c87157b239d1301c684cc3a4ff8d775e228ee668646f796b582
SSDEEP 12288:vssfgTSZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:DoSnYHR4wVhOLRQg1pBeNL
TLSH
T125F40198D28942D8D1AE5179CB564A41B3337C26A3E4C3CF62C0F57E0F326945EEA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 04cee6c1beda584c5ee4894cf9125e6e3fae90674102864f1873724dc8a97cf5
MD5 7bc74ef03b32ff884be05695d05d99c7
SHA1 5c8bed817b28d9e2c2d03ce3bc90c15fb32001a2
SHA512 f5f9080eff1ee47091ff36c040cebf61b3113c32467ff9493662de7c6fd9ffec5d956e7697fd1b1cd20ceb59bc8665b9ae74d3ca36f6b56e13101542c2a295a6
SSDEEP 3072:uk8Rv2TO208tg3yFUupBYbwamq0LLleTMvj1/ciA3GURusV:wIjUR/
TLSH
T1F9F31387851D52BA24170BD7C7B96C545A6B218D43AF0E2C21CFA3DE6941B03CF2E4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 4c2e8f98ca3646c6fec56cc4eb73694ee1852a6da822f9050e50e827596d6d9b
MD5 e433e513d36a569607693ad5bc0df528
SHA1 d67b4e195002f574278fb1e95b956e66848b2b3e
SHA512 1c0d364f939681f5e0c2e7fdf39aa90c9aaa4f5b7c735970f1acadce352c01a2a9c6d321299f440dfd1a4049a9b2afa5077f22b64c165c75275e3d6c2312dd9e
SSDEEP 12288:BX7AZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:xAnYHR4wVhOLRQg1pBeNL
TLSH
T122D423E8548A87C5F2F140781EAB9531361EF0267BCCCAAFF04066EA59317585EF13B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 3659c40dd80569d3de55749549cb7c4e1c98a4ada0790e3e26c94fa03eef2022
MD5 44da42f761e31867bd8fb31f1a1d97ea
SHA1 674a90696cf0f7d9a7d771d309debcfd923da34b
SHA512 c9b3bad663ae5be553c2bd9a5314e27a275f9cd54968d3918ae5bdcf523d1c2dc3b74a8544d1a94fb0d543915a69bbaf6e431218a498e1e54325cb91ec8fe6d7
SSDEEP 12288:yqGAZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:dGAnYHR4wVhOLRQg1pBeNL
TLSH
T17AE423AC34D762C4D2B2C17C4D7794623932B02177984AFF54D0A5BA8F217E46AB9FB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 cb9a014905e9527e5629d5b32e608d7c0a371f556e9b04482a00014d16a56eef
MD5 03de644eaded9a6ddc13502837f81675
SHA1 1c1970f7b6cbaeb0a05f6b1d403aee17a25b98ac
SHA512 cdc498e29996c977699656d86810ed6fa1034944e568f6dc4fbb046b3f6e7ddaa1c6b0c160ece73d5cb38b74d82be4119d90910e94b24af35663641d2f78a9e3
SSDEEP 12288:VHvUrBFrEjwaQiZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:VPUr+NQinYHR4wVhOLRQg1pBeNL
TLSH
T16B05E16E259D18E5F6B6E17C89838619F772B4621351D6CF02D0817E4F23EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 61b4df0a7c5827719ed4a0e2dd1d3b262270935d7c703535701a978dca10bdf9
MD5 d622d7a7375e27eb7a5f2cd3786db453
SHA1 166022daa1d667ff43096eb093365f4452c15ee9
SHA512 877330646ae1132f6a4d4088f301d169297088a139d25313078f03a913593b542667bcd875c654a14333e62c99f793dbdda8ee42e4438939338955d3270c3c61
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTIR4wMRQg0L:dG05lO43b4IR4wMR
TLSH
T153D5CF6E62EC11F9D1BBD07CDAC64A0BEBB23415032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 efd80ce45008a2114a904164a110d53076ed1c7ce9efcf087b961a775a8dc3cd
MD5 1a3c22fd74ba31d288146e434fa2fba3
SHA1 90a85bb2e2c7c313d5fc8843216ec5926543dc48
SHA512 1791b4da9a47b5b6573c3571bedc918c9051258fa89347a7fb660cdff81dfc43d9be15ed2ccbbea3ad4f1bc47d4812555cff808f2322d4adee5e3c2b30e43d95
SSDEEP 12288:/1Hck6j5ZI7LyZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:b6DIqnYHR4wVhOLRQg1pBeNL
TLSH
T123F4019C226B01F5E1B7D03D86830512E2B2B07193655ADF46D4C5BE4FA3EDCB938EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 8910a975a12e94e7cf9ad1362018e535d564f0f6d741bd0dceff5522ec41dc69
MD5 983a73bbc4e122612497db71f2f9ed63
SHA1 f0c867b06fb4cf6b5134a8cc05be6022b67b591e
SHA512 6e38d49d2348152c33feeebb8cd544b28080342b02dc621959c7d229f23150a7e506f767df2388be35c5c0327796ed1d5560cc9b900d26f57d020b78ed1215aa
SSDEEP 12288:4G6kywZ7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:ZtywnYHR4wVhOLRQg1pBeNL
TLSH
T17FF41288628951C4F2F241789E7381A12B36BC216B6487EF60D0E67F1F327D4ADB1B71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a518572bda98980015b3225ad36086b489ba983562379fe98da774751f96b926
MD5 8047af8764dd40f5786a964760f825c3
SHA1 e3e76fdc0da3ec6e565a61739162cc10df58f785
SHA512 17a6b1a7d71264ebaff40044105fe22c509067fea10ec002543bd6c42ab7080803fb13873dff48cec8afc68e2ee754df66147bea06e7b3d3d3e0684432f2dc71
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmunYHR4wVhOLRQg1pBeNL:QTMwBtOm4IR4wMRQg0L
TLSH
T14B55AF6EBAA846E4D1FAC6B4CD238512F6727461173293CF5290C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 af5dc126166f09c955d01b752c51e0ff6f9a195495a972c7f48885228e0467c2
MD5 8bd13631384705e60f36fa2233c9f801
SHA1 857a2caf792d4431d79202ca1075549f44870449
SHA512 6256500ac0582cb50a83c27e48c8527edb8c7daa14eaa8a6a2db607b59a5e21077b3d837156f7a46dcaa6e9425d8cdcc8d0af2d8ff306a1911489110235b5e1a
SSDEEP 12288:byS6b3IkxjbBz4Z7tdIl1zkR0RXlWwVhOLRQgqjYpBTJhXOyiUDqvj:p6Uqjp4nYHR4wVhOLRQg1pBeNL
TLSH
T194F4129C25C555E4F1B54138D96781321136B83223B88AEF70C496BF8F32BD89A7AF31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-118-0x00007FF6880F0000-0x00007FF6881B8000-memory.dmp

Download

memory/1112-26-0x00007FF6880F0000-0x00007FF6881B8000-memory.dmp

Download

memory/1112-28-0x000001F7DDE20000-0x000001F7DDE86000-memory.dmp

Download

memory/1112-29-0x000001F7DDE20000-0x000001F7DDE86000-memory.dmp

Download

memory/1112-27-0x000001F7DDE20000-0x000001F7DDE86000-memory.dmp

Download

memory/1284-138-0x00007FF6880F0000-0x00007FF6881B8000-memory.dmp

Download

memory/1284-38-0x000002AC9CE00000-0x000002AC9CE66000-memory.dmp

Download

memory/1284-36-0x000002AC9CE00000-0x000002AC9CE66000-memory.dmp

Download

memory/1284-37-0x000002AC9CE00000-0x000002AC9CE66000-memory.dmp

Download

memory/1284-35-0x00007FF6880F0000-0x00007FF6881B8000-memory.dmp

Download

memory/1356-62-0x0000016288F50000-0x0000016288FB6000-memory.dmp

Download

memory/1356-61-0x0000016288F50000-0x0000016288FB6000-memory.dmp

Download

memory/1356-60-0x0000016288D90000-0x0000016288E6B000-memory.dmp

Download

memory/1868-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1868-125-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1868-120-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1868-119-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1904-109-0x00007FF616570000-0x00007FF6166B9000-memory.dmp

Download

memory/1904-111-0x0000013721550000-0x00000137215B6000-memory.dmp

Download

memory/1904-112-0x0000013721550000-0x00000137215B6000-memory.dmp

Download

memory/1904-154-0x00007FF616570000-0x00007FF6166B9000-memory.dmp

Download

memory/4068-69-0x00000243C4BA0000-0x00000243C4C06000-memory.dmp

Download

memory/4068-70-0x00000243C4BA0000-0x00000243C4C06000-memory.dmp

Download

memory/4068-68-0x00000243C49A0000-0x00000243C4A7B000-memory.dmp

Download

memory/4592-91-0x000001990BEA0000-0x000001990BF06000-memory.dmp

Download

memory/4592-90-0x000001990BEA0000-0x000001990BF06000-memory.dmp

Download

memory/4592-89-0x00007FF62B830000-0x00007FF62B949000-memory.dmp

Download

memory/4592-153-0x00007FF62B830000-0x00007FF62B949000-memory.dmp

Download

memory/5380-76-0x00007FF7F7FB0000-0x00007FF7F8117000-memory.dmp

Download

memory/5380-85-0x00007FF7F7FB0000-0x00007FF7F8117000-memory.dmp

Download

memory/5380-77-0x0000021438960000-0x00000214389C6000-memory.dmp

Download

memory/5380-78-0x0000021438960000-0x00000214389C6000-memory.dmp

Download

memory/5380-83-0x0000021438960000-0x00000214389C6000-memory.dmp

Download

memory/5796-16-0x00000215488A0000-0x0000021548906000-memory.dmp

Download

memory/5796-17-0x00000215488A0000-0x0000021548906000-memory.dmp

Download

memory/5796-15-0x00007FF60CA90000-0x00007FF60CBB2000-memory.dmp

Download

memory/5796-18-0x00000215488A0000-0x0000021548906000-memory.dmp

Download

memory/5796-88-0x00007FF60CA90000-0x00007FF60CBB2000-memory.dmp

Download

memory/6396-0-0x0000000003150000-0x0000000003271000-memory.dmp

Download

memory/6396-2-0x00000000030D0000-0x0000000003139000-memory.dmp

Download

memory/6396-6-0x00000000030D0000-0x0000000003139000-memory.dmp

Download

memory/6396-7-0x00000000030D0000-0x0000000003139000-memory.dmp

Download

memory/6552-261-0x00007FF6549B0000-0x00007FF6550F3000-memory.dmp

Download

memory/6552-259-0x0000019567500000-0x0000019567566000-memory.dmp

Download

memory/6552-139-0x0000019567500000-0x0000019567566000-memory.dmp

Download

memory/6552-156-0x00007FF6549B0000-0x00007FF6550F3000-memory.dmp

Download

memory/6552-140-0x00007FF6549B0000-0x00007FF6550F3000-memory.dmp

Download

memory/6552-141-0x0000019567500000-0x0000019567566000-memory.dmp

Download

memory/6760-102-0x0000019C2C230000-0x0000019C2C296000-memory.dmp

Download

memory/6760-101-0x0000019C2C080000-0x0000019C2C15B000-memory.dmp

Download

memory/6760-103-0x0000019C2C230000-0x0000019C2C296000-memory.dmp

Download