4b77420bfc262f251461b41254b40b54b4206db9b68e890065f095d7e8b1b8b8

Analysis

max time kernel
146s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe
Size 836KB
Sample260705-cde12scs7j
SHA256 4b77420bfc262f251461b41254b40b54b4206db9b68e890065f095d7e8b1b8b8
MD5 091b6b11c725addb243f71ff25921b2d
SHA1 f0ac0272d267c8121a08851f7887b9b82fc9d76f
SHA512 904b1512e54eaa9fe39517b6633f78236cc440cf2f9b0a48baaaa709c1e89354995d4d6983c33347961611fc253f867891d3abaf0c3231b29dd21b0b0ce7eab3
SSDEEP 12288:m4Nv3npArW8frWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:m4p6hfGKqcFqQrJEerUxbA0gKuKN
TLSH
T1A305F12A77D84CF9D923C1BDC8468106E6B2780A0735DADF0791027B6F236E19E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3392	alg.exe
2540	elevation_service.exe
3372	elevation_service.exe
4944	maintenanceservice.exe
2248	OSE.EXE
1612	GameInputSvc.exe
5980	GameInputSvc.exe
3712	msdtc.exe
1204	PerceptionSimulationService.exe
5364	perfhost.exe
1536	ReFsDedupSvc.exe
3024	locator.exe
2144	SensorDataService.exe
108	snmptrap.exe
5636	ssh-agent.exe
5276	TieringEngineService.exe
2972	AgentService.exe
1392	vds.exe
6084	vssvc.exe
6000	wbengine.exe
6088	WmiApSrv.exe
4908	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ad6ce7e4a0960ed.bin	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5980	GameInputSvc.exe
5980	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3888	2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3392	alg.exe
Token: SeDebugPrivilege	3392	alg.exe
Token: SeTakeOwnershipPrivilege	2540	elevation_service.exe
Token: SeTcbPrivilege	1612	GameInputSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1536	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5276	TieringEngineService.exe
Token: SeManageVolumePrivilege	5276	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2972	AgentService.exe
Token: SeBackupPrivilege	6084	vssvc.exe
Token: SeRestorePrivilege	6084	vssvc.exe
Token: SeAuditPrivilege	6084	vssvc.exe
Token: SeBackupPrivilege	6000	wbengine.exe
Token: SeRestorePrivilege	6000	wbengine.exe
Token: SeSecurityPrivilege	6000	wbengine.exe
Token: 33	4908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4908	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 5980	1612	GameInputSvc.exe	95
PID 4908 wrote to memory of 628	4908	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_091b6b11c725addb243f71ff25921b2d_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2248

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5980

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3712

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5364

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2144

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:108

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5636

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1392

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e52b96a6ebf2c48b9cbee1908436c60a8c0d062b4ff6650682eac5089d51dbe0
MD5 b5920ec834096b6eda44decbc908ef19
SHA1 1a97f1b5961249a0c156c7f9817343f1ba1fa72b
SHA512 09fcc1c6d0c9af3ebdfc8f5480749fc21635436b81b6e4de70907f427d665ecc996637f3521159ce207d6314ab4f2e84e3452c38a0e8d75480328d795d74a1fb
SSDEEP 49152:bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBsFzrJLUBA7zK:p3q6gjBiCrJHy
TLSH
T17ED59D03F2D901E9E06AD1B8D7469133E9A2BC890B34B6DF0780B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 0187aba94907d2079f1c6c99ac57437a758f28c9b817cd5fc23c7f80a0a0dd6e
MD5 6d929372b14c674a1202c391b6aee624
SHA1 769cdc1bbf7f0445b4527e1e92cd02a337661662
SHA512 79f967d27f25f4fcccbee0b7d85037734df91ff0f7c76081ef65dc87f974fd6fa611ebbe06bc6c66a1a2a95116b228650dcb13411b9a419bab1a7863d502a089
SSDEEP 12288:61XLsSArSxy2lRq2czAXWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPm:QXYJItczAiKqcFqQrJEerUxbA0gKuKN
TLSH
T159050139A7E409F9EC67817CC8A2C012EA7378564360E79B03E895750F233D85E3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5ce8769c1530e13838a60dca1ad395504afb0d27146db1814e92337272e164d0
MD5 75585b55bf4599f8d49e1940e598af0e
SHA1 c00cf2e73a0624ca2a9ffc4e03429d7e0adff205
SHA512 b732c828fa7e10c2cf4f6bae9791ee7d49a3ff0f36c197be72f01f5bc724aa55f9f5016df7e8468a77e329287e7079c91ef672958d8b3d07118637e1c8f477ba
SSDEEP 24576:q0me3on057xOrMpKqcFqQrJEerUxbA0gKuKN:qCon0lowsFzrJLUBA7zK
TLSH
T17E35AE26F5748335D073C0B9C5D2A69EE972308657308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a68b992bf6a7761633291fdc87956c8f2926a4ca4d99e4d4ef92129f5666e1c2
MD5 bc7890b2f7889002ffa5f653f8c65c9f
SHA1 6df25ac19d6689efd025232073f68afd583c12e8
SHA512 406c30f33d3330d1b99486551e09e8fbb8840fe3b6c0b2ee3edda0a174c8ea15438cde911c06fd1acdce6f8ada50357db7ad047cc38458f6e0b4a652ed5f5a9d
SSDEEP 24576:ZAH/ezSC6vUyD/aqgrvW/6q8wyunKqcFqQrJEerUxbA0gKuKN:G/ezSC6vUzPvuHjyEsFzrJLUBA7zK
TLSH
T148756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7877aa40b297972cb8add9054fc63ac294fd6ccab99f26d1307b0b90f3ab84ae
MD5 ca8a182fa66bd9a5d10b2867377814c6
SHA1 2315c874fe5c92d93ca73a8cec14bab20af76f47
SHA512 fadf3186c655c90f5c622732e6c7f67d4eac605774130bb7a6f004014303579598adb170ea69cb2b4ddff728fbffb74cfa2bc0329b5e46fac8b0b9f19a409c39
SSDEEP 24576:PAbtPppizv/l+dRKqcFqQrJEerUxbA0gKuKN:PAbpizXl+rsFzrJLUBA7zK
TLSH
T1EE559E66F5748331D073C0BAC4D2AA9AEE7234425B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 f45876e1f2efeb87c0bffd2f50a453c1265162f78404aa0a62275105fda532f8
MD5 bdad012ac835685c7b0ae4c52ef374cb
SHA1 68f1d579781485ac3752cd7797ea3b952d990978
SHA512 19a356ab19659f8f641280f6032b0ff51e2db4744f9c7d6d08018e6dd917a0b0607bc027e14e409a367334bc62a766a5a361ce3785ca683a7be2bbda52ad7db1
SSDEEP 12288:Qq1WJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:QqwKqcFqQrJEerUxbA0gKuKN
TLSH
T140D423734CC94BABD5C16CF9C08BC0B624F76C7B5109D969488B71E414389E2C6BABED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 6bd63a1e501b6d394294747a119729871053a42ec66539219f33590baf5eec6d
MD5 1069077da68707b0e193d5ecb0afe599
SHA1 3cec974ddaa5c7507797e30fca4064d6f11b12b6
SHA512 fef86e146fff0f94cc9b6ac4a3612cb2e729784cfa1a9bd115ae3953e1eb6607a5f627a82320096431db27ed0acccbe963b20dfc8e4ceb6fc830a9f818ae3b9e
SSDEEP 12288:2eBNUbTVO86URWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:2JIU8KqcFqQrJEerUxbA0gKuKN
TLSH
T1E115D03BEE28ECD2C27A9DB89691C24097B274314F12A3CBD165C30EDE235E15E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 7068a8a614656a7445f1c2d271bfaa0cfb6b41916fe68dd2558f583b293d7f89
MD5 cbd7d6f7b8f6fbf906a2c7526fec0b2a
SHA1 bd1578c93bb30c586e7062f82301bebff09026c3
SHA512 bc5d4234bf92ef870b762d5ef17d08a5383507cff17ff078e51b194435369eb8a6e5932fd9c3f31ee40a4b3c92166156a6c243b069515eb7e45e642153cb3c01
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJF9DN5JxNRV3THu:XQvGAdlCEL8c/FRNV5CpfCrJHy
TLSH
T1B2366C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 d9fd0e129be0ff2cf031cafe49dd57f3edbf678e812f385b8a34f31e75285805
MD5 8fc2d37beb64014171b6080c5dd285a0
SHA1 7a11962c95a53dfea20ea4f64d30cc88a12aa810
SHA512 63086f470d94b3ddba0f6bbdbc627288a325cb428c46587376f82099cc88a5f56e75e680cf0b0c0f5a68215d3829819c03a7c2922e944dcb3bdc8a191ba00507
SSDEEP 12288:QJwSfxL/2Dc3bDLLmt0LDQewsAjkWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYv:MmewsAj3KqcFqQrJEerUxbA0gKuKN
TLSH
T1E015F031FEB4D436C2BB0CB65B26C716147D79204B611AC3E3E89A9D59302D22776F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2f11fe45c42ef79ef72ac70cc6e315c54113ecc60342c19c5754cf6a933a6803
MD5 f3ce98957bba534552c94445888c1315
SHA1 9f323ee297da17c5379407527408db187c5bede2
SHA512 89d53dbd66992fc7762b62435b1dbc7354e5d759c3a00630f2242e4a5a35f8ae715872beed10bebc2b7a5253bf5a02850cf42a71715119b12acad357279755de
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHKx:FUEtQevvqc2W1cpV2X132M
TLSH
T198474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 22f9ee79ae288b7ac7fefd8b316a2140fde0b42bea929d63d17efbf3b7788326
MD5 e4d269431aea6206991f1f3c0c2279d7
SHA1 c7f05f7db31405800cf41a9cd5f812a181f82e34
SHA512 600ec124b9c287748767bf13da148fa1bf4195b2f9bfa14b18288307b36bcbb8d8f63968a759795d8bef25ba4afb2a2410b07355a9ede0667480c1e237a031b7
SSDEEP 49152:eybRquA/m2yL5zMfFiV+XenmE3/z1sFzrJLUBA7zK:voq1VjnmOCrJHy
TLSH
T1C4D58D1976B8C2E4D1F6C77886A2C647F37178154B3097EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 af0e94098a8aa7b41c0bd71cf3a4a9d7963e9ad414660e8c5bf66bf0e56f5b07
MD5 b516b9beb00377006e081755e1f6143b
SHA1 a8e7ff2a5529ff48cf60e67b0d63908c1948ee76
SHA512 2337ed12b3d33db3cc36dfe7006436a0ad6724a5e08256afdefa57c23b3496acd094852989ae5b142414c8f60db84997558440ad188946f2c0a7dab38d9ca075
SSDEEP 24576:BAhGLvMFoiwtA5l7S538KqcFqQrJEerUxbA0gKuKN:BAMYFoiq5ssFzrJLUBA7zK
TLSH
T13045AE91EBF945D4F5B3AAB899B68171E976BCAA5E31C20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 d7b4b9eefc721fc7532dca7f482db44e89086246d4b0fd727f27c76ce2480096
MD5 dec0f8572a9cd631c197d4455b5e7aaf
SHA1 f18a8b4c79f9dff393255e5b093ee8710a115954
SHA512 27c445ef065383c6347ada7ff0ded0063cedaaa143dcd3fe6227b84c60473792345262604d426b307be3916a562237ad01bd0f1e1510a903cfc7f5a0464a8ced
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CIWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/I7:Owu+OWgKqcFqQrJEerUxbA0gKuKN
TLSH
T10705F15666E40CF9E9A39578C587C036F7F3B8122A25DB1F07A0C25B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 4c412ed6a73d64f008f08610c1ca8796f3526e5cb1151d3bad1a0194cba8ecef
MD5 df07537b9ec111e8b29f485a4b094d55
SHA1 6758d4ea1f0994828023cd5f6ba73a3666a181bf
SHA512 6397f0008c8a0bda91f9b38d4493cdfd9b158e3e311e15baea62e3919b3628190bc1eecd9217cf8e3b3d2921657fca9ff40f1091e07620b551153ef99397e3a2
SSDEEP 12288:pev1IoxWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:AvuLKqcFqQrJEerUxbA0gKuKN
TLSH
T194E422772AD802FAE19355BCC8D68146A3F37467233683CF055A52A51F33AD24E39B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a269419ca5561cd1b8c95680b0351cf1f8a01418248e943d6dd30c3601ecc652
MD5 1a1aaad7c564d34764891f1e0830a7e1
SHA1 c5c84438a500d26c6176ca144e0642583e3c6f43
SHA512 dee4659319f01acf8d9c5c5d8184d45366a5c271dfaad1a150437ef80a461f4483e44a75646d568c444ce435551c70a6d81873b1b6c97ad98a69b455f0ff70e5
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ue:3QRQyi36YOcP8Lvw2gAf+PN3MCrJHy
TLSH
T1AC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8d26bab0d2ff60b1952ca8d521ef8c97189e0ae906455639dd8d9717902118eb
MD5 7ca0da5ce96027463286ba8caf9f2a9d
SHA1 6ae91737699506d49b0ce7672519c3a64f025c60
SHA512 b63e4d0a52454cfde028c997cf1fd2babcda1fba253585d8d831b36b888ad2ad707f510910add3d3887a9e9b0ca09a2bfd9602dd1e2b2e9776ae8ba2346571d0
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U7:3QRQyi36YOcP8Lvw2gAf+PN35CrJHy
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d83c74d85ac879dff35e5d12c9f627a9941dfd618906032088a257f23786604a
MD5 69a2d74a3785cee2f4a6d28cf18baab6
SHA1 9b056b8565c2ed3487454bb59ccf16646d07f959
SHA512 596f71d626379a4524987f5762f35f52dcac10b41bffb12e0d0df746029e82df9df20621dbe4fdc85cc8db51edfddafbe3e000ec31eb13ad24efc536cdeca50f
SSDEEP 49152:868Qg55nhMeWu7PNU3/gsFzrJLUBA7zK:2thbRc/gCrJHy
TLSH
T1E1B55A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7c1dbd5e766f8f353d332a3a1adba672030b3757b1dd768bf61fcef0bceb9095
MD5 62a742aa6979ded958f7300984e3672f
SHA1 075ec6da420ccb7582b7a53287c30164f9b38df8
SHA512 627b5681d81d276118bb2e65725ce34a769aadc20e02ceaa0167922492f75b2956241b12b08e32d568db88a17c51d01d601cdcc345be97ddd956b32f5f0a749f
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99t:Py5112gYy5azzVv569nLKnhZKCrJHy
TLSH
T157168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6bec7adffd7de0e9024428e9716c868b85412b900fd5ecf0034f4e52087c4ada
MD5 4034aac26189c9a68f93d2e2a545e209
SHA1 8a2652f5cfc2d1b497ac31cbca7701a77519e2cd
SHA512 0118ffa87037dd65c11b63701f13fbb738784b63b350a52adfc69d7c5438e3edf61e604cb0201cc65221ad0f570e88701635d4f2ad41f4fa4d81ce1f7faf099e
SSDEEP 49152:GB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glDsFzrJLUBA7zK:0u6JmTxd2dDCrJHy
TLSH
T159D59D13F1DA01E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e6bb2386875d7307b6dde1555ca6afc707f000956672ffebaa3c8ccd01dd727
MD5 985efc57c65283b7e46aa1e3d26a4184
SHA1 099174f17fc0685a8a8d164568842a2ae351709b
SHA512 5df0efa11e10c22a7fb3c71d8905598231206ef60be843a16c8966c36cece52fd90eff9a233407b3e2144ac6b348363ca72e6572c3ba7d861e7872673abce7fc
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xysFzrJLUBA7zK:8mifPbRfCrJHy
TLSH
T1CDB5BE13F2D901E8D05ED178875A9232EA72BC460B34B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 635c7b877dc1c8283e18e95ea92408d2f39c3ea31ca020ccd0e22637a3d43204
MD5 8477030e82ffb707d8381a21e2f3141d
SHA1 bcfd448c426af0f868ff3e036ae5e706f9537021
SHA512 8c10336fe361617e87511b1264670906a7b781c278bb1e7e70abe3da1bd61d3beff35c803c9aa0efc7696cbf50a94eb14f6573624f9506c6557f6d9244a33542
SSDEEP 49152:8SuZQIY0Be2K6RVtOnks6NMHqssFzrJLUBA7zK:+5dKoi61sCrJHy
TLSH
T10AC5BE13F2E901E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3fce702def704c1303b9325b075dc3559dfcdaa38c5d07bf9ea8805cce539728
MD5 9c5ec0115c050fc2bf9ba04591cd834f
SHA1 64b6e280f005ec6e70ab90a470b84f998d20a15c
SHA512 b46294f47277fb5941e415832f211a4b6754416bd9d682987f7064092e5658198e53e11de0f650e6bde8236cda8e1cd475e1ff6d4cc5ddd73ac13ea36b7ec41a
SSDEEP 49152:4vrSn8EApI0figTgiDn0AP5wIsFzrJLUBA7zK:BX2iyphdCrJHy
TLSH
T115A5BE13F2D901E8D05ED078C7468632E972BC160B35AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 ebc26e8ac020356fa9ec357ad2cf15433acf4113bf468cbbf317eff9c73033e5
MD5 2d98994a6e5fe183b9799bff578f00dc
SHA1 85f39956ad7fa139d5c49614aff16560396fbb61
SHA512 5247dcaf858f0ca1b34ce751307e8938befadc67ded8c22e81ad9200c264d1218c813d4735a2698995f1b54e9186f7c04523796aafe18b179238b63a5ac5c41b
SSDEEP 12288:q5WJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:qUKqcFqQrJEerUxbA0gKuKN
TLSH
T173D423734CDA4BABD4406CFDC08BC0A624F7347F611AD16D698F70A015699B286B9FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 3a7fc5a38889b3e1b160c5e3792919314e6258f53c807f19023180f3d2857a89
MD5 6f35d32f014ae665bcebdd21bc26dcef
SHA1 d765496f263d11e0b9fb60ff788e344531956b83
SHA512 446b89fbc4875ebb6b60e6a5b3ec219d0dd8f68be83abce497f6099d49341bdef35978d706761f4187dde3a3cfd62765ecf9338c2a68945117879589dfa4d32e
SSDEEP 12288:QxWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:QcKqcFqQrJEerUxbA0gKuKN
TLSH
T1E2D423734CDA4BABD440ACF9C08BC0A614F7787F611AD1696D8F709054589B286B9FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 442056a93d299d2d52f0f74a69087569a272f3165d0599e237ec41e02894c255
MD5 9f914cb9bc04cf50a77e5e22baebd56b
SHA1 dcd600dfdb3588c8f2c9df697845db1434b8d449
SHA512 aa750f6f3116b60c8238fa54473345272ca284edd0b77402187fe8513c5e3a5e1380bf7e50670d52082b930d383cf52595d9df3261255191a4194f572c3f6834
SSDEEP 12288:eHWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:eyKqcFqQrJEerUxbA0gKuKN
TLSH
T10FD423734CDA4BABD480ACF9C08BC0A624F7347F611AD5696D8F709054549B286BAFEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 f87f674519ec8478ae6f077e326b4a3b44d05a03e5066e44734011724d711bf6
MD5 9bdc9a18e0abfb6ad248d61c1cec436e
SHA1 c8c0c45d345dfc1b8d37777c38d0ed3e1a2fef0b
SHA512 07dbd1955fb4b6f3d85201bbab9c49498aab59188d36f5b95444c623ad612bc76dddba29081625b2e18409972d695c4e47a910eabce9bc7e16d076f4d66bca12
SSDEEP 12288:vlqWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:zKqcFqQrJEerUxbA0gKuKN
TLSH
T1F0D423734DD907EAD481E8FCC087C06661F778BBA226D26F9A4720950D717A18978FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 0e0c5ba452d47f3991730d60e32fe636b7190a86809760003f43d24a8e88e395
MD5 3d96d4d9f6033b095471744a79e3e9f0
SHA1 1ec526c7cab09942a4be84d4f3066eea4ccc14a4
SHA512 5b902778c95cbbf06d45ff9f9dedb57a58f90ad869dd1d16594fb74e817f2ecacf8d0e1c904858dff42f633f554e391ce6b3901b19b0dedfc389a11117e3f7f4
SSDEEP 12288:9kWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:93KqcFqQrJEerUxbA0gKuKN
TLSH
T162D423734CCA4BABD4406CFDC08BC0A614F7387F610AD5695D8F70A055699B286B9FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 5a9c40f5bc75e3ec83f8f011ba39faa06d1408531013940aecff6742fe121528
MD5 dc1526a662873e5cf59711286f79cd0d
SHA1 efd16ee2693a7cbe42f84e502ee0790e11072613
SHA512 317100d38059c158f25b853cac62397023a96a3b9addf6af7bdc79a4378767a617d564db827cc7ff8ba1ceb68152e0ec6d924cea872c15c9bad76387bf29e9c0
SSDEEP 12288:2EWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:2XKqcFqQrJEerUxbA0gKuKN
TLSH
T197D423734CDA4BABD440ACF9C08BC0A614F7387F610AD5696D8F70A055649B286B9FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 9bb86a43693e605567325bcc842b09625d6e12e4ec7bdd0383f640e4b2b9886f
MD5 e3092332582743f46253eb633ec76bcd
SHA1 2459b2072df0c5a3749eb7a556732131475e1fc5
SHA512 3355a63d38bf06f713fe146d82aef5674f192cbb73d50fc5a064296e73e3656917c526d94838d3c4c12562daecbd53416dfdca2f02ba9b93f36feae67effa138
SSDEEP 12288:RTWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:R+KqcFqQrJEerUxbA0gKuKN
TLSH
T1FAD423734CCA4BABD440ACF9C08BC0B514F7787F6119D169AD8FA0A015659B28679FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 185827f18caa3891fa10f2f6b21a90b6c0a4b702b3ddb85d2d456b35a727c5e5
MD5 93c0ddab1ef0f3216679842b43078f5b
SHA1 8923ebc2c6f28db69b2b8cae28545daa4e553482
SHA512 33b8198b546765ed85a1f42f5a829da45628aa4162d8ea8a852f46bbcfb2ce80b61f6715e1f50560336355b24f2b73dc6de3915e08736c92f43b576a3fa2afb2
SSDEEP 12288:eiZwbYGze/xStcPvySWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWQ:BZMpzeZSR9KqcFqQrJEerUxbA0gKuKN
TLSH
T1141502A5B79009F9DC63817EC8568916D6F37C6A0660C61F07E932661F333A10D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 9eeeb0186d41666000cc03bff20c5074399bf8626b16bdade11c736af9ce635a
MD5 aae1138088cf5b2efa04647581908515
SHA1 8b867c82f3103b667c1780176853c8e75eafa30f
SHA512 5634d12b52b647db15a22aba0219f5d664be0e863e5c95ffc619960a3a8cca1164da3ddda60c4a90b7c418f9bc58e5a4e71895f21b28264d09d83e12c81835f9
SSDEEP 12288:efWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:e6KqcFqQrJEerUxbA0gKuKN
TLSH
T119D423734CDA4BABD4806CFDC08BC0A614F7387F611AD1699D8F70A054599B286B9FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 f0675e7f56c731e7976a5ae558be8c792db9ee1053b3b75fe3656c0c97f6784f
MD5 b3088fefb64797fa7d37640e885ed565
SHA1 55ba88428b3f7ac7356afacc84f250ad02456384
SHA512 eacc73ea25ed44d600492931df9156eb42f83ed817d57c3226c1f1743871d1fe1f9c01ffc5dd5df8d08c4b24b3ab16c20c1182a3c7fddeabbb1a5289188e1d67
SSDEEP 12288:A6WJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:AVKqcFqQrJEerUxbA0gKuKN
TLSH
T16DD423734CCA4BABD440ACFDC08BC0A614F7787F611AD1696D8F609054699B286B9FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 c2b8d92cd3b41131892a81482bce1e6cc5b291d6f5b5336c52dcc08bdf888d98
MD5 1e45707d8f7a7e0d47280c57e6030b92
SHA1 5a6d851d10403f208efb263a1dbe8bddc1945bd3
SHA512 3b83652ad38f8434961f33fb74dc677075ba81fbc926fe612aba1c8684f8a4c71317e3f43e9bde28a1ad4e1893467216443a0765f7aaf989ea4e0c3bb16a7140
SSDEEP 12288:I0Pz5L5UWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:DzLHKqcFqQrJEerUxbA0gKuKN
TLSH
T14DF412276AE511FDD0629178C8924A12F3B378370724CA6F179503B62F276A19E3EF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 298a535818dff008f33804b6b6361ce85143d6ac35ee95a3b31f261ee1fc5201
MD5 f01a76d01eba0f3f65bd0f56e44d309e
SHA1 66a3f7ed60b33b90edabdc40908624efe854da89
SHA512 675ccaeb51e4fd257bc6770bb93f6d03860e9d78072807f029ff1acb9ed15a5a21409625fc93ea16ebc1ca9a8a30906049242ebc9dcbe9499150d06f76100101
SSDEEP 12288:+ZWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:+0KqcFqQrJEerUxbA0gKuKN
TLSH
T1B2D423734CCA4BABD4806CFDC08BC0A614F7387F611AD569AD8F709054589B286B9EFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 caafa1d77d2181c94d21b2f20eb8eda59712960cdfb9e4a7dcd4a0c33a5735de
MD5 2dafe0fdd1fb39cf97c84b0a765e8223
SHA1 07757e69eceb79bae356555d621ddc377c992e8c
SHA512 52f2c665dbcf53f5b582c542b52b9fff971527c80007c29c88870e9f18cd3fa076e55ae7da887c074441a5a9b71006554c5a4d02b445cc7eb2bd0010a787cde8
SSDEEP 12288:qkWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:q3KqcFqQrJEerUxbA0gKuKN
TLSH
T1A8D423734CCA4BABD4806CFDC08BC0A624F7787F610AD569AD8F709054599B28679FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 b2ad12844abbb0920b461cb2c37c956e9c87b84dc50d20a61de1752ecb11cb13
MD5 001ac04827834210612dba1ae729b03c
SHA1 4cfe4df9ba1fdccf3f027aea690654c7cade0044
SHA512 7727d44909bc49a567127c86d96818061f40243228dd4f829f78718c242e3548b49b6c5ae5fc8b8212524d7bb5d7c9b562f5fd4c9b011d74bcaf18b96586f754
SSDEEP 12288:90Pz5L5NTWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:2zLMKqcFqQrJEerUxbA0gKuKN
TLSH
T181F412236AE511FED0629178C8924912F7B378370724CA6F179503B62F276A19E3EF74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 58bbe55df6f4a183cefdd641b55af62da1fad354b463da81cfaf53bea4f512c9
MD5 c26556accb6995511e472c08c554ca08
SHA1 4d4a2f4861f725b774ecf62b14db60c4746e23f8
SHA512 f7997dd4262fab06c1bb353e6bc51a333e5d6796c81f8fe28e18b4e04f49632f480ef3cc8b9a8311bf32ee5edf1f1636da925172e1fcc25e658f0249cf8d2f45
SSDEEP 24576:cTxaLl3z0zTMKqcFqQrJEerUxbA0gKuKN:cTsLljFsFzrJLUBA7zK
TLSH
T1681501A5B39008F9DC63857EC8568916D2F37C6A0660C61F07E932665F333A14D3EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 868ba2c2b9cd9edeb5f5910a09d5363b3822618fb0d4bc63f1d48236c708ee16
MD5 2767b27269882ff2d6ad59b8ea887349
SHA1 86a8fd467153ffd0f7b58e052e2172bb815d0d78
SHA512 6679e946edbcb19099e6ef8fd38733f2a0a766158b8afaabeaee152db3de73d60ac63c855969a62e6ac23dce02142a7c403e0d502b679fb9885f60403c24d7e5
SSDEEP 24576:x3CdvCHKy70pCKqcFqQrJEerUxbA0gKuKN:hCdvCHKyY0sFzrJLUBA7zK
TLSH
T1DF35CF90F7E405E8F0B39A75C8668511DAB67C5A1B31DE8F03A8255A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 cec516ab72f188b6379f21cb10959e43f5ae709f78aeb22a0e512d7694c05722
MD5 ee21345b3e8c9a61c93fc9949fce12b4
SHA1 a1a565fb970dd9b99a6e6f35d229967ab7edd83f
SHA512 b853ee6ac608c86c9a7dfe77a4ab75d0942590abd94b7337e7f425c779d2cf1e74ec936a5703b5f332ba726d8c994f5a96e677116826cedaf4d5a2aa55c0894d
SSDEEP 12288:c0PWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:cDKqcFqQrJEerUxbA0gKuKN
TLSH
T1A5D423734CDA4BABD4406CFDC08BC0A624F7387F611AD5696D8F70A014599B286B9FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 3b637bb0d96c4ec3e8c78397e979b124bf30a7c2f09b90962f2febf6ec0ddb4d
MD5 623d0a3452f5e1376974212a2cd160b3
SHA1 67549336470ff20e38f6d7e53827b3114afaac6c
SHA512 60807aa3235e324a19ba43372618ca7047ef1792fd3da1e432f2e5324f145b52db184fc9969478468d8684164bf9756923452d6c5812d2eba33600c7d5236dee
SSDEEP 12288:4p4WJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:4VKqcFqQrJEerUxbA0gKuKN
TLSH
T10FD423734CD94BABD4406CF9C08BC0A624F7387F611AD5696D8F70A014699B286B9FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 2408bf074c459fac6514f98caa23acaa23fcdd464e3adc8bd6095f1e4e8b927f
MD5 dbe461c451106af950feb2c34b24c75f
SHA1 8274949128b2ae7d99ea62059c2b06b19d5f99fe
SHA512 bd0750935d694cd3e077943ff32dd092f505a55749bb28212a16797a7f23335966ba51191d37944ddf99b84d066688818ed952e51da149c3893b20990d26437c
SSDEEP 12288:jvlWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:joKqcFqQrJEerUxbA0gKuKN
TLSH
T151D423738CDA4BABD4806CFDC08BC0A624F7387F610AD1696D8F709055599F246B9EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 4d85f178b0f02f848aaab8fecd4e15cdfa0ad8a200f6a253866fe9988659b5ad
MD5 fabf4ba023a8c18232cc86414ebd1caa
SHA1 f8820a65c1dd256a7a05c583acf2ceb71c07f13a
SHA512 23f2937287bf21de6f4a35c3a9366b1b98d5ec909e1d9c9ced10f2eb8854332a1c66a39c1d3757950014604120019edb752c5f7ce9c281a66afa80eeac54ab5e
SSDEEP 12288:4oyWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:4EKqcFqQrJEerUxbA0gKuKN
TLSH
T112D423734CCA4BABD4806CFDC08BC0A624F7787F611AD1696D8F709054699B28679FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 66fd4c71f20782ac9425357fe74e66fdeffefd9bbffb6f6b71d9840d43b5650f
MD5 8be6f5f9a1f23791fb0ce4aceb7bbd22
SHA1 f7b48ddbbd42dd4346135b6b95213df48e22d815
SHA512 6957498fa2a11ac8138f1edb0bc23f2f4259018fa7f5fb928d207a83656bd59a50590b5530ea940b06c20e8a8aef9461f1c4fdf33d3ac787af52664204d90180
SSDEEP 12288:FEsfOWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:NZKqcFqQrJEerUxbA0gKuKN
TLSH
T1BBF4022AC69802E9C05E61B9C7468641B3733C2683E1D3CF56C1F17E1F366909EEAB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 4f6cf61810e6cc3becaa75de609895ddf51695afa687da8bb74f07176944a572
MD5 c7918c9fa44ffc2747de75526d67bd29
SHA1 464ae9f49f0d9b87b611e3b3c87af0b2e8cd1fac
SHA512 074c05c7f38fbc8f400dec66c8a47c6fa3f7fca922ff372060b794696bdb18375ac743362466d42d655327446c9aba4817dab72a5f82d29d7185ba3bee793ce3
SSDEEP 12288:BI7KWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:WFKqcFqQrJEerUxbA0gKuKN
TLSH
T1BCD423738DCD4B6AE4916CF8C08FC03524BB747B5B05D0ABA84B719454349E28EB9FAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 89e88c1fa97a3ff1cf4ec8c353dc6fde22d702806e5cc55444f0940fabf5ad45
MD5 54928a49e7b08b83f418e6ea0b943357
SHA1 2a67607d44045d7db42388a3bab4159ef6fe4af8
SHA512 bcb59226056c773f4e32a6cec8113cd4964a27c426f4547160b410818539ed30947cb1c2054427268232f6f2846c2124cb185c6d4f1ce5395932628eee3fb52d
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYjKqcFqQrJEerUxbA0gKuKN:bgb4mBIBhGFksFzrJLUBA7zK
TLSH
T14D659E1E22EC02F5E0F5E2B8DDAA4417D6B278160732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 7cc99a37481e603f802e900aec55a54f3b020019e6e27df0a353867f88acb34d
MD5 16d459a98c82cadf37f86d1421333fcf
SHA1 c0ade0980a4dd33f5c3ab068dbfdae8f12776432
SHA512 7d32eaabbeba97d99569eef7953396c213a3fbc504a40f364fe7924d3cb80ce9784604d173ce2e37864fe7d01ce4efd54290527305764e5b9ad3238cceb367e8
SSDEEP 12288:uLGzWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:gGeKqcFqQrJEerUxbA0gKuKN
TLSH
T169E4223A18EA06E9C471D9FDC496C07738F334765318A5FF48C6A0B48A259F1963DEAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 b1556fe34d1523bd052f084803e733aca9c45345078469deec95149c57d666bc
MD5 d03dcef98b2fa1bf62d737ec73c53cd4
SHA1 692e73374653ce6329c8e9c6b435e2971060b0e2
SHA512 9452d30915613cd42049477d2c84f30923f43de00ec160d52702695bebc73935984356b475de6bcf30fa8e52ec454badfa03535e304050ec1cd9b566147e6231
SSDEEP 12288:LcWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:LfKqcFqQrJEerUxbA0gKuKN
TLSH
T13DD423734CC94BABD4806CF9C08BC07624F7687B531995EBA88F719044599F28A79FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0a23d590636b35ff740db5324c0904d3ac09f7446e82ce4d22e832b6ce030f3d
MD5 b471e8a2bb3ef5c2d4ed277f337c389f
SHA1 6c7a5620ac9728d32dbb18dd9d9df36604b4b829
SHA512 6d5ca04813c5bece1c03aea066836690da77afdbc637c0450788c4548745c94177b28eb4441c8167833ca0d2a31d9ef7f49bc416160bd5a31d434e864d782fe3
SSDEEP 24576:Yw58u8FpJqH1Zzria7/mnKqcFqQrJEerUxbA0gKuKN:J+ZFPqVQa7/wsFzrJLUBA7zK
TLSH
T11335F16666E102F1D477D138C9864663F6B2B4260324EFDF06AC8B511F23AE14B7EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 143c740a8b3c089d730c181ab1283303fad5471c5a218a4b758cdcd888d97e94
MD5 d7069fcb16faa8e152bce5f8060b3b71
SHA1 2c0ea96a71b1c4b65b413211fafcb5c3e2a0eb67
SHA512 a22342e5d6c129c05798409b5a19bd5b5967f2a627ea6266605d105dc68674c7c90183a38421fdbac09cea803b4103b6e09e20335461897063d8a31e649d3454
SSDEEP 12288:PHvUrBFrEjwaQQWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNg:PPUr+NQDKqcFqQrJEerUxbA0gKuKN
TLSH
T1B005F12F26ED08E5E676E17DC5868219F77274621312D2CF02D1817E4E27EE8AD3DB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 726fc2fcb27dca6ddc679e2648ccaef2c891d046aa3cfe15a357deb146b9a70a
MD5 517ec77114bd6538c52d4654f847be98
SHA1 64733e222fa0017e604b3f53bfb61c6f22490aad
SHA512 5493e45d0fc6d4f4ca1991f1b8188f68a3ba9f310a72a732f7d14bdd43f464180a495d4e4212c12b0e51354c3e0c0b0b15fd4450fb54fb36705d4367af5576e9
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnsFzrJLUBA7zK:eG05lO43bKCrJHy
TLSH
T19CD5CF6A62EC01F9D1BBD17CD9C6860BEBB23425033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1bd85b5023862ac3d12a6f17af028aa3f2e3237740de03a8be5813198504c8e7
MD5 cc997ca3ee2ea6d492f69f2b1c89faba
SHA1 9a02512ab10f58fb8938960542c2c5f2022b8b5f
SHA512 e803ac3ec8ff171421711a33a077929420b3e9fa690f4703d577c08f259f645d3ee8262a2fe1fe433a35e6b28dcf4eefa880b97db8cec805378ffa9247c6327b
SSDEEP 24576:30a5POZ3dpbWVM50JicR2hG0lasx2+47eidn7KqcFqQrJEerUxbA0gKuKN:Ea5POZ3wJt2pasx2+mdsFzrJLUBA7zK
TLSH
T1BF65BF5EA6FC01D5D1B5D17DC583861AF5B2342653319BCB012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 787eddc4b7a1878cb4b1d35161b90dd2371625c1ee1a5a7557006eb89b13d07b
MD5 42194eb7caf8d8787d5059497a1f9bc7
SHA1 0cc5076b4c73edec53433a841a4bcb61ae6a78e2
SHA512 c118f01ae42576ab046ea6435faeecd60d07818e240bfd4d548ca67038e49db4685a056c61e3c51ab67694269a423bd4b328455c8ce4cd1dc11be886cde7a8ec
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkZgKqcFqQrJEerUxbA0gKuKN:1Nc/zEOVHF9sFzrJLUBA7zK
TLSH
T185858C2623E901E4F5B7E1BE89679546FAB17869133486CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 d86a6db6f3e31c0324fd14a5986e88fe41122904ccb3691885d52c9dfbb3fd1c
MD5 52b2e610e27e2cbd755c6fa227b565eb
SHA1 8169b9961e8981112f7da1c2b2dede93fd65a3cf
SHA512 9dedb296dc215051d01f7cacdb5412c761696ae49f692f9ace2fa331b420626202d78e5d8cad2129deaf05cb93aebad127028176650abb13ac46852f06820cc6
SSDEEP 24576:gJnJPbzB4SJKqcFqQrJEerUxbA0gKuKN:gJnJv6SJsFzrJLUBA7zK
TLSH
T1DA15E13DC2A810E9D4B7C2B4815A175AFE71387D2F2669C719B4D4343F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 972a699d03c5dfd7b0f464d080bec6e18bc49fdc870424799e158ae30f3fdadc
MD5 05c2ad819bb3cbb19342b28810ca4108
SHA1 dd3f75828e9d719e02c12e4a982ded9098b2c2ac
SHA512 3ce3bc58b7602cd8e14b18ce6c22fd27754adb33dfcfde92ff99aaf16d3a866f662dda77ff216b306d3630dd8d28324520649dd9a58fbb8e9960dcc665919d9b
SSDEEP 24576:5CLHGL0MoeVtFumTijCmlKQWDkHKqcFqQrJEerUxbA0gKuKN:5CLHGeeV5ijCmlDWDkHsFzrJLUBA7zK
TLSH
T10BA56B05A7EB4284E8F3CAF5C92694169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 2459a7cf1289a2f055a596e1df6a49b831c01b46bfdd762f268196f72d6d0ead
MD5 2de87852f28b3306000636917c8b0232
SHA1 d9f0812dfdca5a17af810ad60f438a96b1cab60d
SHA512 0c488c23a291fed40d59369b1b60fec70748f5340dbc8f539247ed9b3beb53746a7a09a4e9f9097dd3da87a07601766bb95b3e55d4bd5fbadffe9622f545c3eb
SSDEEP 12288:u1Hck6j5ZI77iWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:i6DIvtKqcFqQrJEerUxbA0gKuKN
TLSH
T1F3F4016D27BA01FAD067D07DC1834112E1F2B07683125ADF0AD9D1B94EA3ED8B93DE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 de4f6343922ca87eab40ed2daa80be127940b63061d08763a3931ce502b9bd38
MD5 d7243a667110975b8113212980856479
SHA1 109fc89ab9d6839f78de35d47ba6f00d5bc7ca51
SHA512 6f6bb84b631a2bb15774ad8e5829703899406e7881959e6ea9ad5bcf0c43317936a43b42de36570ce53562aabae11c85f1d3ceeab8bc466e265a9c694aca6c13
SSDEEP 12288:AG6kysWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:RtyPKqcFqQrJEerUxbA0gKuKN
TLSH
T1BAF4222247C842D9E9B519BCC553C1A11A76BC315B2193EF54C2F23E2E36BE0AD34F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 f2d35a6f610dd027ae82e293f3f401d60512ac8c3e1d6bea99dcc881aacaa3cd
MD5 c35606c07c1fb125ee9e31c65ea8c8f1
SHA1 d23af5d42903bfed0aeea6c6f3ca807a2ac01164
SHA512 9fc40e328f2d6db680cdc5e44ccc047f745aaa49be9281660e294914fff4822bd8dd4123fe018aaa980efb6210cdbf02389ff4f2cbf3254123c5b1e7142d4bb4
SSDEEP 12288:ziUWJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:eHKqcFqQrJEerUxbA0gKuKN
TLSH
T1A2D423774C994BAAD440ACFCC04BC16620F7347B171A95EF6CCBB1B049299E28A75F9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 0e99ca0b54b5d6cce0a616d72149042db6c9e7f780535fad2fb5fe8feb3bc457
MD5 c562ad34d061708a3cc94f164347d82d
SHA1 3e2b12f29c49edd8647ba7b51fb6029e8f52799e
SHA512 33c6542124c45d712fd395441c79315f0014f5c2dd81dab9b6aee1721d95161c69d593fb2ac7639b243cba681bccf6c7f089ef89cce2ba7a26f00fa82be94118
SSDEEP 24576:IPg5LoTfaidZYKqcFqQrJEerUxbA0gKuKN:qguTrZYsFzrJLUBA7zK
TLSH
T106559D1D67EA05CAE2B2D679D8635493D633B4311372C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 6b998ffaf87f86a3e2c4b518d5ad4e936516f793c003c25c76e317d9745e4b37
MD5 f40584163f5f9c27869be188c876dfd6
SHA1 ae106ec6cb8ee03d2db0dd7a333677925666f088
SHA512 4db15d11d2160a2cfc85772233a7183a25c6ed4c2f0a143df49c8f5c871ed28bf7f8623af3b2c161ce46d7eca77b32c891c3c3726add3d13435488a0c2d033d1
SSDEEP 12288:UpJcm8CN6WJrU/P5czcA+y9QrYWpbreerH0ZnX1duUVYNWH/IiLPuWvRLNWd:UrcmRVKqcFqQrJEerUxbA0gKuKN
TLSH
T1C405F16EB6AE00E6D1B7917CC8868116F6B37031231267DF0592C37D4E67AE97E38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 911d90861e6e1dc8a060bc2d4a8fde65798d8d1d8f31c2c318c261ed01c14a5b
MD5 514da52aeb8ba281f9dad451a48a6424
SHA1 a02f088ff0f543cf224526623c6cd1a1375d12ef
SHA512 1ca94216c1b9a72c9299eea133d88b65445104755ec4f15b64fd9a8552198fd5db5e446dd572be8184076be2d253551c038aa9749bd811c2fd52b74f019129e0
SSDEEP 49152:zDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS33sFzrJLUBA7zK:o3Upow8sBeCrJHy
TLSH
T184A58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-387-0x00007FF7964B0000-0x00007FF796563000-memory.dmp

Download

memory/108-308-0x00007FF7964B0000-0x00007FF796563000-memory.dmp

Download

memory/108-311-0x00000255DC740000-0x00000255DC7A6000-memory.dmp

Download

memory/108-310-0x00000255DC740000-0x00000255DC7A6000-memory.dmp

Download

memory/1204-264-0x0000024EF2AF0000-0x0000024EF2B56000-memory.dmp

Download

memory/1204-348-0x00007FF7EC6E0000-0x00007FF7EC829000-memory.dmp

Download

memory/1204-263-0x0000024EF2AF0000-0x0000024EF2B56000-memory.dmp

Download

memory/1204-261-0x00007FF7EC6E0000-0x00007FF7EC829000-memory.dmp

Download

memory/1392-351-0x0000020130500000-0x0000020130566000-memory.dmp

Download

memory/1392-350-0x0000020130500000-0x0000020130566000-memory.dmp

Download

memory/1392-349-0x00007FF7B4B20000-0x00007FF7B4DAA000-memory.dmp

Download

memory/1392-444-0x00007FF7B4B20000-0x00007FF7B4DAA000-memory.dmp

Download

memory/1536-295-0x00007FF7EFA20000-0x00007FF7F0163000-memory.dmp

Download

memory/1536-283-0x0000017B64270000-0x0000017B642D6000-memory.dmp

Download

memory/1536-282-0x0000017B64270000-0x0000017B642D6000-memory.dmp

Download

memory/1536-367-0x00007FF7EFA20000-0x00007FF7F0163000-memory.dmp

Download

memory/1612-317-0x00007FF6F7F50000-0x00007FF6F8018000-memory.dmp

Download

memory/1612-234-0x0000020E29A00000-0x0000020E29A66000-memory.dmp

Download

memory/1612-233-0x0000020E29A00000-0x0000020E29A66000-memory.dmp

Download

memory/1612-232-0x00007FF6F7F50000-0x00007FF6F8018000-memory.dmp

Download

memory/2144-412-0x00007FF707FE0000-0x00007FF7083F6000-memory.dmp

Download

memory/2144-300-0x00007FF707FE0000-0x00007FF7083F6000-memory.dmp

Download

memory/2144-410-0x000002525D5C0000-0x000002525D626000-memory.dmp

Download

memory/2144-384-0x00007FF707FE0000-0x00007FF7083F6000-memory.dmp

Download

memory/2144-299-0x000002525D5C0000-0x000002525D626000-memory.dmp

Download

memory/2144-301-0x000002525D5C0000-0x000002525D626000-memory.dmp

Download

memory/2248-55-0x0000023914C00000-0x0000023914CE9000-memory.dmp

Download

memory/2248-56-0x0000023914E10000-0x0000023914E76000-memory.dmp

Download

memory/2248-57-0x0000023914E10000-0x0000023914E76000-memory.dmp

Download

memory/2540-25-0x0000015F278E0000-0x0000015F279C9000-memory.dmp

Download

memory/2540-26-0x0000015F27AA0000-0x0000015F27B06000-memory.dmp

Download

memory/2540-28-0x0000015F27AA0000-0x0000015F27B06000-memory.dmp

Download

memory/2540-27-0x0000015F27AA0000-0x0000015F27B06000-memory.dmp

Download

memory/2972-338-0x000001CA29630000-0x000001CA29696000-memory.dmp

Download

memory/2972-343-0x000001CA29630000-0x000001CA29696000-memory.dmp

Download

memory/2972-339-0x000001CA29630000-0x000001CA29696000-memory.dmp

Download

memory/2972-337-0x00007FF7FF420000-0x00007FF7FF740000-memory.dmp

Download

memory/2972-345-0x00007FF7FF420000-0x00007FF7FF740000-memory.dmp

Download

memory/3024-290-0x0000013B7D5F0000-0x0000013B7D656000-memory.dmp

Download

memory/3024-296-0x00007FF6566A0000-0x00007FF65674D000-memory.dmp

Download

memory/3024-376-0x00007FF6566A0000-0x00007FF65674D000-memory.dmp

Download

memory/3024-289-0x0000013B7D5F0000-0x0000013B7D656000-memory.dmp

Download

memory/3372-35-0x000001CC218A0000-0x000001CC21906000-memory.dmp

Download

memory/3372-37-0x000001CC218A0000-0x000001CC21906000-memory.dmp

Download

memory/3372-34-0x000001CC21690000-0x000001CC21779000-memory.dmp

Download

memory/3392-13-0x00000266E96B0000-0x00000266E9716000-memory.dmp

Download

memory/3392-65-0x00007FF620D20000-0x00007FF620E42000-memory.dmp

Download

memory/3392-12-0x00000266E96B0000-0x00000266E9716000-memory.dmp

Download

memory/3392-14-0x00000266E96B0000-0x00000266E9716000-memory.dmp

Download

memory/3392-11-0x00007FF620D20000-0x00007FF620E42000-memory.dmp

Download

memory/3712-249-0x00007FF638E60000-0x00007FF638F79000-memory.dmp

Download

memory/3712-336-0x00007FF638E60000-0x00007FF638F79000-memory.dmp

Download

memory/3712-250-0x000001E41CB10000-0x000001E41CB76000-memory.dmp

Download

memory/3712-251-0x000001E41CB10000-0x000001E41CB76000-memory.dmp

Download

memory/3888-19-0x0000028E25700000-0x0000028E25766000-memory.dmp

Download

memory/3888-22-0x00007FF758030000-0x00007FF75818E000-memory.dmp

Download

memory/3888-0-0x00007FF758030000-0x00007FF75818E000-memory.dmp

Download

memory/3888-2-0x0000028E25700000-0x0000028E25766000-memory.dmp

Download

memory/3888-3-0x0000028E25700000-0x0000028E25766000-memory.dmp

Download

memory/3888-1-0x0000028E25700000-0x0000028E25766000-memory.dmp

Download

memory/4908-388-0x0000018BADB30000-0x0000018BADB96000-memory.dmp

Download

memory/4908-390-0x0000018BADB30000-0x0000018BADB96000-memory.dmp

Download

memory/4908-389-0x00007FF7A7EA0000-0x00007FF7A81DE000-memory.dmp

Download

memory/4908-448-0x00007FF7A7EA0000-0x00007FF7A81DE000-memory.dmp

Download

memory/4944-44-0x000001305A830000-0x000001305A896000-memory.dmp

Download

memory/4944-45-0x000001305A830000-0x000001305A896000-memory.dmp

Download

memory/4944-50-0x000001305A830000-0x000001305A896000-memory.dmp

Download

memory/4944-52-0x00007FF6900D0000-0x00007FF690237000-memory.dmp

Download

memory/4944-43-0x00007FF6900D0000-0x00007FF690237000-memory.dmp

Download

memory/5276-329-0x000001B68BC50000-0x000001B68BCB6000-memory.dmp

Download

memory/5276-328-0x00007FF6A6B80000-0x00007FF6A6D14000-memory.dmp

Download

memory/5276-443-0x00007FF6A6B80000-0x00007FF6A6D14000-memory.dmp

Download

memory/5276-330-0x000001B68BC50000-0x000001B68BCB6000-memory.dmp

Download

memory/5364-276-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/5364-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5364-357-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5364-271-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/5636-402-0x00007FF693B40000-0x00007FF693DE2000-memory.dmp

Download

memory/5636-318-0x00007FF693B40000-0x00007FF693DE2000-memory.dmp

Download

memory/5636-321-0x0000021FCDE50000-0x0000021FCDEB6000-memory.dmp

Download

memory/5636-320-0x0000021FCDE50000-0x0000021FCDEB6000-memory.dmp

Download

memory/5980-327-0x00007FF6F7F50000-0x00007FF6F8018000-memory.dmp

Download

memory/5980-241-0x00007FF6F7F50000-0x00007FF6F8018000-memory.dmp

Download

memory/5980-243-0x00000266A49B0000-0x00000266A4A16000-memory.dmp

Download

memory/5980-242-0x00000266A49B0000-0x00000266A4A16000-memory.dmp

Download

memory/6000-372-0x00007FF737450000-0x00007FF737956000-memory.dmp

Download

memory/6000-366-0x000001C4124A0000-0x000001C412506000-memory.dmp

Download

memory/6000-368-0x000001C4124A0000-0x000001C412506000-memory.dmp

Download

memory/6000-446-0x00007FF737450000-0x00007FF737956000-memory.dmp

Download

memory/6084-363-0x00007FF7A6FB0000-0x00007FF7A7480000-memory.dmp

Download

memory/6084-358-0x00000115782D0000-0x0000011578336000-memory.dmp

Download

memory/6084-359-0x00000115782D0000-0x0000011578336000-memory.dmp

Download

memory/6084-445-0x00007FF7A6FB0000-0x00007FF7A7480000-memory.dmp

Download

memory/6088-379-0x0000014E7F2C0000-0x0000014E7F326000-memory.dmp

Download

memory/6088-378-0x0000014E7F2C0000-0x0000014E7F326000-memory.dmp

Download

memory/6088-447-0x00007FF610E10000-0x00007FF610F3E000-memory.dmp

Download

memory/6088-377-0x00007FF610E10000-0x00007FF610F3E000-memory.dmp

Download