b43f985391a4402e3f403416306eb65923caeb9870d462645dcf6a8ca7fc235f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260712-qtk4wscy3s
SHA256 b43f985391a4402e3f403416306eb65923caeb9870d462645dcf6a8ca7fc235f
MD5 3fc701bfacabaf8a1550bfc73365466b
SHA1 a05569666332f40fda30d3e6dbd4009c1faa713b
SHA512 6b206f5f2d6ab5024b888f32ad03384d0a8ebe146e7a0629ae8a2d02bc21224ae3899b1080b61a8e4f7646e5e8d1d923fc050a07ecd5baa01f65253c5e982342
SSDEEP 49152:KHs5/baWEzVHTh1bK2pTETMcn3F/el4q:KHmh2RJ5
TLSH
T12D85BE07B69640FCD069C1B8CB569532EAB1B8850F31BADF1390A3292E77AE45F3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3524	alg.exe
3412	elevation_service.exe
3428	elevation_service.exe
2644	maintenanceservice.exe
4600	OSE.EXE
5908	GameInputSvc.exe
5464	GameInputSvc.exe
504	msdtc.exe
6128	PerceptionSimulationService.exe
3432	perfhost.exe
5820	ReFsDedupSvc.exe
4908	locator.exe
5656	SensorDataService.exe
4776	snmptrap.exe
2368	ssh-agent.exe
2724	TieringEngineService.exe
1724	AgentService.exe
692	vds.exe
4136	vssvc.exe
1548	wbengine.exe
2236	WmiApSrv.exe
2552	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6b39315dc618523d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5464	GameInputSvc.exe
5464	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2196	2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	3524	alg.exe
Token: SeDebugPrivilege	3524	alg.exe
Token: SeTakeOwnershipPrivilege	3412	elevation_service.exe
Token: SeTcbPrivilege	5908	GameInputSvc.exe
Token: SeRestorePrivilege	2724	TieringEngineService.exe
Token: SeManageVolumePrivilege	2724	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1724	AgentService.exe
Token: SeBackupPrivilege	4136	vssvc.exe
Token: SeRestorePrivilege	4136	vssvc.exe
Token: SeAuditPrivilege	4136	vssvc.exe
Token: SeBackupPrivilege	1548	wbengine.exe
Token: SeRestorePrivilege	1548	wbengine.exe
Token: SeSecurityPrivilege	1548	wbengine.exe
Token: 33	2552	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2552	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2552	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 5464	5908	GameInputSvc.exe	94
PID 2552 wrote to memory of 1544	2552	SearchIndexer.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_3fc701bfacabaf8a1550bfc73365466b_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3428

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2644

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:504

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5820

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4908

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5656

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2368

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2236

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aad131907ac01043fbb929c3c9255bdbb10881bf8eb45b65bdc296b10554db83
MD5 96c6bb57a620e2bdb7eeb3a29dd15c84
SHA1 86ce73dcf346b2de059d0256cff303a25ceed6f7
SHA512 d62b37e238a3bfddc54b92c942ee4ad1ddf0360822337e779d33445985fc74b68cc07fdc3fee614307224d026d430904df6af2d7ee0ae18a28a102e8327cb0ef
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnn3F/el4q:53q6gjB95
TLSH
T107D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 5b9fc76986f9ad86aed08bf6113df78ea1333db325dad22d2af9bae8d1154d23
MD5 895befeaae6abfe9ec2e8ed56dc1aac9
SHA1 eab0e05eb3cd0d0cc9052d6d0febbe7c32a44f7d
SHA512 0d247a0f5163445fd2a71dab396d46ce84b1c94cb18bd66ab869d7d3bf6831655332e112016af0361d6cd384841c140c51fe625908c9f0986b610410d1d453aa
SSDEEP 12288:T1XLsRre0x8VP5m2czAXZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNln8:JXY9XcczAoW5hXSHg/ehHeRqh9zS
TLSH
T11305022463E048F9ED67927DCDA28901E672785147A4F78F03F4992A0F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 faa73fa50585edc5fbbed9c1e7f8d80dd08271bcc465ca229e3ad82fda591501
MD5 f3401c4701eb4d64a2c7f974a013eed5
SHA1 e9f53e07bc225fc797740b8f7ed53e7f2f891982
SHA512 3484ee363eff273501dfc8fcb824eff241bb1272968b1518d5499fecb216e30093c889221f125b4a8482de2e9cd3f2683683b9756981488972e01a47abf90268
SSDEEP 24576:c0JeMpu0qfxOrM7W5hXSHg/ehHeRqh9zS:cwpu0YoR3F/el4q
TLSH
T19F45AE55F6748735D073C0B9C5D2A68AED7130821B308ACB4296D77C2F67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9c47164807890cf98b29e9187263f814ecee63d3d1f346ead509b601e83e9804
MD5 286d6172ad2f120538b2724978c9a91b
SHA1 82ada6a2508053162af6a720cc15b048ca560b75
SHA512 c0f1eddde4d02ddf21b47b0a4eeb31daac80471d038d977d843b2d883c2d25b92a72d6953aa689349e87c8c372920339541a2f8e86237d54dd4db59f34aa6be1
SSDEEP 24576:qRrnezSC6vUyD/aqgrvW/6q8wyuNW5hXSHg/ehHeRqh9zS:anezSC6vUzPvuHjyp3F/el4q
TLSH
T1B0756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 d500e0b04128afae1bdbaa383265c33db0b50289b1fbd09a4357e4e348631d27
MD5 d00545aa1aa80067db54e1fa120053b7
SHA1 3955e90c2427499ac4bdd6670af9e33850642062
SHA512 ff4cf3ed33ff1aacbb4fd488d49e38262bea4ab54cffc8d42d0d6334123157accc3c1122e6cb544d7a9bb8eaa1b1fbdd7ed4a0ac8d44488dbea1eccd6867d032
SSDEEP 24576:gabDPYrluv/l+dwW5hXSHg/ehHeRqh9zS:gaYrluXl+r3F/el4q
TLSH
T19E559D65F674C331D073C0BAC5D3AA9AEE3234425B318ACB0246D76C2E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 1181457f95191d605730b8a20a29db5825d0d13f1a3fb346ec5d719d3f259326
MD5 894ffed9e8761c99669545b73e4f2ec9
SHA1 e117f744bb255c09ea8ff5186c48f7d86cd1e11b
SHA512 39d137f933ea6b2065011d845d38f34e479efea1a56fe78a92ac70e026be64e25bc017fc202ad01475f16a69e72175207c6652fc152e8aa626fd6f0318b2314c
SSDEEP 12288:AtlZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:At+W5hXSHg/ehHeRqh9zS
TLSH
T165D423C08794C825F350BEB64BF74F49A55878412DAE6ECF037AB85E0AB70C7F6451A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 2bda1a8f6e2f9ffb9460b45c64823196451a369714550f81430f6f7ccd5eb77e
MD5 61a72fe391e77aa67c7fa448487b44eb
SHA1 412781fe965c3d38f8518468639c3f52df7c92dc
SHA512 b84ec7c254e931522b45d11e23192d96a3e794b765a427e5259097e6e7ba5d9d9ab0a510404455d08dcefa4f92e282e2f325255946fe23ae873c603d01179e48
SSDEEP 12288:XeBNUbTVO86U+Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTE:XJIUXW5hXSHg/ehHeRqh9zS
TLSH
T1D715CF7BEE28ECD2C27A9DB95B918600E77274304F62A3CBD175820ECE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 cada02425869b98c28b224cfd918d0214c3803078ea09f3e0f1895194d26f8cf
MD5 b76c7855b9be8ba7e0edede3f4386c66
SHA1 8c3c374fd026cba9d76fb1bf41b84c049ebc368e
SHA512 3f90161fe34436c3abb211f63ba11178eec50c343cd03897663d8f53cf052b11fee1ab5b35e9278d128b4d6c23dc7c8ed7f2cfabd633e0dc7264108fff2fb14b
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH2:VQvGAdlCEL8c/9RNw5C55
TLSH
T1BE367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 f532521419375b2da77a1201b2e2ceb94300f04faeea9e916f4c7174e0a61dc3
MD5 e036eb2106060486b834568dbc97bf16
SHA1 d6db6c71eb0bfe4c243b11f42345687f471bc525
SHA512 3ca59cc2b6309be668b3c86b781c0e955c89e261fc12d6c276feb35997f0df1bef501f4ae065dac09345637dcfc88ae9a86edb7ed77cccb4cc40eac381f01518
SSDEEP 12288:dowSfxL/2Dc3bDLLmt0LDQewsAjNPZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDuL:mmewsAjNAW5hXSHg/ehHeRqh9zS
TLSH
T1DB15E030FB74D436C37B1DB21B36C706646C79204FA62AC3E3B89D9E49702C26776A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 79168c8ea987fd9b043b6b51f066ff151ad3ced4d5ec32c0d2a2589c1be82438
MD5 485dac73d8f6bda2973a21c893e2def5
SHA1 50b445a54928c2ad96e642f43c4c5425b4156fc0
SHA512 71b38bc0b2e8bcc17627308bedef043ce0dcb449a76097b0b972c7d0cf61ef7f9a96e3262a0b7206da2576a2b0bb1d2917e93f63bacdef1af083fa25bd0943e5
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHr:HUEtQevvqc2W1cpV2XF32
TLSH
T11E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4b5fa28adbb2a00384053fd03866ddfc9a098ed5273e32a802cbbc4801c4609c
MD5 b5aebf9a34f287c8d83a2b0fc617f49c
SHA1 22af5d219e02d621b6eae1b8114c0d69b403b828
SHA512 de522a92543a7dc69642b67dae3507720c9ddaf3924ccdf9726445a148c6114599754726f0987d98caea50b0abfa5d0ad715820f0be4a30948d82df7ec2f4687
SSDEEP 49152:DlbRquA/m2yL5zMfFiV+XenmE3/zJ3F/el4q:hoq1Vjnmv5
TLSH
T168D58E0976B8C1E4D1F6C77886A2C647F37178154B35ABEF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8607c197715d9c7f199afa05fc31930a0b2cfb99e5e16107079e964d5627df96
MD5 4d00227e87374f628a64b3d9606bd4f8
SHA1 d53c2f0aa4ed1a3a0c4278be632dab93a25b5272
SHA512 3750a5b4d10f0c64bd9dfeb05b055db57b0692c42d81c0c66ceaf911b818489766d60c87ae99b56353da3f23c9f194d4539e7b9d8bf743f2c7c3e0a3eb19efff
SSDEEP 24576:RAhGLv/FoiwtA5l7S53zW5hXSHg/ehHeRqh9zS:RAMjFoiq5y3F/el4q
TLSH
T1D745AE80E7F945D4F5B3AAB899B68571EA76BCA65E31D20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 495339536771e502a2fe00bfccdc179c8fc39cc624d7573b445aa36d5ac8a0d2
MD5 7eabfb0533c9d020b9e2c13e38863c08
SHA1 b60fac6c479a39a10959a42a2d6f054bd5935e02
SHA512 bb3bbfa6125ac7ee145ce42cd6fa2703d802655b7b267d94895c61a705b828ca43bf1380a03cbf930b1b84ff9820136b82cfbf55ece7c5835a4843d6a7332bd6
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CcZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODI:QwuuOWoW5hXSHg/ehHeRqh9zS
TLSH
T15C05F18573E44CF9E56296398697C536F7F2B8022A25DB1F0360C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 43be90f511af2a7c27702cb6a563d46a4c120869d7ec5555c77e088b80f30bb0
MD5 7e4ad5711f24266532d4e8171d70a0ef
SHA1 92de162cd2341cb13d4cb4c7f4f2d3bca146a5b2
SHA512 530601c0fcbe2addc35092fdfb43a3e53f425b9e6b8dc1372c0af8052f3b20d2f94b54d9dbd385c9069f28acdd6c0d84e0865f5a919581d5eea375a18099b64d
SSDEEP 12288:BBs1IFBZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:7suEW5hXSHg/ehHeRqh9zS
TLSH
T1A8E4128423E494B9E2A2A679CAF24E45E77074522B7A57CF0339455A0F736C3BE39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 76216b818c52cdabf49adca5926bbdad67da241e7588970a3deaa5c24f51601e
MD5 be795386a18fefe689cf7981dc93b171
SHA1 7a2555c0508f30d1351f2b3bfe1fd9e396096c46
SHA512 e6798e4d69b6a7afc81d8909b4580fe2639713b71f9e21048f6a947c508964d2f5933cc1f1bfa0ba944c1ea2038b0a0a886d2daf6aa1d4aa9cab4a898ddf43e4
SSDEEP 49152:0oVdZ0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uy:pQRQyi36YOcP8Lvw2gAf+PN3K5
TLSH
T184667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 44f733c34342b6cd525e56fb65dbcce768fac13f0e8eb4b7101dfeb85087875f
MD5 5fc7b835d5b2e39301b8047f49d1434e
SHA1 0ade2ac36a81f3adba5434108f48ad5bfcfda460
SHA512 cb51caff001b547fd6fa6586c883ddce22d05f9f405cfc7b2f9e3e5be4bd63c607283731cda27ee478a3b6150223e037eb5d6aba67c95a2d9d31fa4e5514cc07
SSDEEP 49152:0oVdZ0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Us:pQRQyi36YOcP8Lvw2gAf+PN385
TLSH
T148667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0f2eeaba118158cc8d1d0d653f767fc9b6d0a520229e8d3665b13eb6c1807582
MD5 736a36ea73c266381dffa1b7ed1e77bb
SHA1 dbd7d536dd46b6088e5557bf3dacf9a1a8b8be00
SHA512 250669149e3f22e38fc671cee6cf33aa5f7373503a2164f3f425abc7ec0a9cb5d84094bef4fc3c1a4d9f161922c9f243b19040da211d5c2533bacef3677cbf3b
SSDEEP 24576:7wv2Xf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0IW5hXSHg/ehHeRZ:X68Qg55nhMeWu7PNU3/63F/el4q
TLSH
T124B55A33B2F200A9C44DE1769F4A872196D17C758FE1E7DB8115720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a88f2899e3534c949f38044ceec3c22d9c6d13cc22c097f629aa23f69776ceaf
MD5 8d9589072fc7f6162566d10f065357b0
SHA1 96d044bb0b2c6a5a40ed27e0faf1d01381892b8a
SHA512 4ab166492295706526acf271151e575c0dce59a8b46e37d04b4dead081d0c9d01340e00d162a12612ecc20d2a40670e82899ba56d120c45eaf7450de79551977
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99n:xy5112gYy5azzVv569nLKnhZm5
TLSH
T117167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e235281861bff67a78f2884c484a34b45af27eb6f3d5624a6f1a4df59b8e2653
MD5 677448c87f07c7c26daa1e1e5fae228d
SHA1 1afc2b1cb14bbc55f4ac2c2b2adb421ae2c4a8d6
SHA512 c3ac3a0b0b633d2d2a1da952319ef80012883e53e2bdd2e1d9fbd5ed76ce7a3f3c8988137276dd2635cd5e7913e71f9e2d5923081f186392e5c01286ae0327bc
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glh3F/el4q:Mu6JmTxd2di5
TLSH
T190D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 871719ecec0a17f44cf9cf7b5fe5fbae036f02e653d5343e7c8ec5ed519cfffe
MD5 9319803de1a181d14ee3f91fb620a778
SHA1 0b6ce099343ef38e81bb07707d1c314badbb84f2
SHA512 dcf31c231b0d4714704f85311dde8747e3d44837835200501d75098c06d528c6d6ef690fedb42704b3f12ff6e76fb7ff76668932b9bb51264e4b3eb32990b32f
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4xq3F/el4q:UmifPbR65
TLSH
T1E3B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b0d5e15d43af113a37ace3d72eb553ce832ddb888ed64d23364d80641277775e
MD5 8b5cb97dfe296ea57dd4bdd4dab09f9b
SHA1 18182f7c76df93b2295c21d8d45073ebfa647ef1
SHA512 790faafc1f70606ee2df2fee306d1ace97bf6061a9363f8f3397a347e6b1c1c22789f64c94357a942a7be7ba056b117e9bdc8a1b318853f18d803ee549c60a58
SSDEEP 49152:YSuZQIY0Be2K6RVtOnks6NMHqf3F/el4q:C5dKoi61A5
TLSH
T1D4C5BF03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 70f7e8b06d05ed8ae10e7c42f6acf890a5efbfc602711b65996584fc144a1744
MD5 566c742eb7bd3b640f85ee50760f327a
SHA1 88ea734d52eda70257e8bbc0eca874ea0ebad641
SHA512 8092c8908674e21f06a411e4a4fbf1001f28500b829ef4d433b4f83dc9b862471927d9d6c2e5ed9f21c083b0e3f70ad971adb6fa47c7a93cdda0cf63f7da94a6
SSDEEP 49152:FGm2Sn8EApI0figTgiDn0AP5wRkstZULrWV:ZX2iyphgtZUXo
TLSH
T18EA5BE13F2D900E8D05ED1B4C7568632E972BC160B38A6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 a44dbdcb73f8a00f2d0cc038407898ce3579403d124470fb071b5e9cb6b4e1b2
MD5 7c583622c7b028bea147c1703aa2d380
SHA1 1802a36bf6c95253df370c35c00419d24e5bc8b5
SHA512 cec40709bf064da92fa99b538a258c9ecbc66346d5e5e092f2312cbae1b879748e856a638c75d548f745018d3ae92dc63782a6678d08407c522d93de3ba661f3
SSDEEP 12288:xO/2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:xO/kMHuAFztD/M/IchtWAGg9W+AX
TLSH
T1C0D423A1FAD21529E10E87F364EB2B4F51B96E3F11B8C3E9EB78158577A5400320BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 a1a7e06d9ffc207b8bf677d4527b3a429ec0a05d5764972471d235687d2c24a1
MD5 09a5a8a958919286c4dccd29b7fc6e4b
SHA1 eaa7a3ea53299ffcd938632996a38782771f2505
SHA512 2063aefff9f4f173cd633d5f9cad987ece0454a364c62c56a49901b41211ce6badcbd1d8bc61a2ab4eb09f4852bfef9b177caef621eaa2db310cd28e7167db7d
SSDEEP 12288:z7H2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:z7HkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T134D423B1F6D21929E10E87F365EB2B4F51B5AE3F10B8C3E9EB78158177A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 dad78fea6314023bf4d6652ae70224ff20642f0d04f1b37e4e64ac08343fe5a1
MD5 2a573d79c2a6700acdc6443c75be626b
SHA1 17d12972d3d1914b1efc382338d1b1dfde1464da
SHA512 bbb5d2202427ecb3c7b88a3f66a2f1fac4b66e31614d211c4f73bc0ba0cc6c2b2b37d2cd45a096983b0df1f3100b4e06169e565aa3c7063807331586682ed8a1
SSDEEP 12288:FVH2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:FVHkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T13FD423B1F6E21529E10D8BF364EB2B4F51B5AE7F10B8C3E9EB78158577A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 1211016b0be6b9a81d6bc24e706aed64e21bc11cf000ad0e1553bac7a191f45a
MD5 420d047225d1c9d35fb92ea0faf4aa29
SHA1 cc252fb45757757e3bd66e2a15e73f8aafe46726
SHA512 42c87f05c892b3629ba4902ad77d1a32288c2dad97dfb773108391830a7d8fd80105bb05c9d84247a15ee0be7f52e8db3cc26e1cd583a8897f2795e976d41791
SSDEEP 12288:2lu42XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:t4kMHuAFztD/M/IchtWAGg9W+AX
TLSH
T192D42262B7A214A5E41AC7F294F62B0E92B5BD7B1174C3EFDB7009853FA1600361AF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 59c2ba78a285f86fb74932e3e873cadd5bbe526767c7d3be5e43ccc4fe49244a
MD5 923de8b558a868c81c91335f0ea8e287
SHA1 6db330566a68b315552b48f841c43e8977523bbe
SHA512 5e0e8d47701ab0403dfbcd8a0b7dc5550e363d4a645bca1b2bd8817116320d0b49468d2f47ea2c52459eaee6858dc0c12c324829084df528dbf7b3539cc5a165
SSDEEP 12288:UmT2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:UmTkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T190D423A1FAD21929E50E87F364EB2B4F11B56E7F10B8C3E9EB78158577A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 04827339e0776753470a8ff7e9706a5f4d8ab84a1dd2c3d0c08cf0358f85f249
MD5 9084a0a4df084d72c26a93b8b33e3f94
SHA1 7dedb173861e34d1cace71064b8f56f82427285b
SHA512 8baa7995b43012438691d0922b38eaaf431ce292afbd9f593284f85c4beb0975ea6dc693a141b33f3fada7fa06ab77c5f721e0d089eb8a1c0b91e79e88ebacbc
SSDEEP 12288:X0T2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:X0TkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T1F4D423A1FAD21929E10E87F364E63B4F11B5AE7F10B8C3E9EB78158577A5400320BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 e82f81c17215928abec72caf088313c2634d8ea50d05e8470ec9a074ce8c899f
MD5 1638d6106ad062a1cfad383b9d3cda55
SHA1 8000c517bde0fc7170a966cd8d89991033baf02b
SHA512 21a5388c6fa1b7221d4be7730c6a6ec10b2def2c4f6a05b156d358469b34ccc28b0f0531520bfd0991cff6172aebc61423e0bad7801c85332a416725482c64e6
SSDEEP 12288:2Qe832XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:2QD3kMHuAFztD/M/IchtWAGg9W+AX
TLSH
T10BD423B1FAD21929E10E87F364E63B4F51B96E3F10B8C3E9EB78558177A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 768269477730bc3b066a165ea35f05a33bd94c3da0e558a8f9ed72abd72dd42f
MD5 e2d13c92b9c3ef4799ca89aa84e8c6aa
SHA1 b0a8901d1587951d480f293b3a0505a6b28535e6
SHA512 c8fe0b994ba295ba8f60892f529ddeaf5da5f70d103f85b0cbce66e93cc055eee16d780ae127b2d437a477bacd98de603e99bd210c18ce7a76128102b8e91a21
SSDEEP 24576:HZM2zNaS9GwkMHuAFztD/M/IchtWAGg9W+AX:HZM2zYMkstZULrWV
TLSH
T1C41502A5B39018F8EC67827EC8655A0AD2B27C2A0670C71F53B436666F733501D2EF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 24f726c4b66299094102a423f18fd7538b19c2346963e15b2ffdbf4dd8550ca5
MD5 921d03acf5503788d5e24a5054213928
SHA1 df9b2ff9d8c961fea33832b588e0cfd8795e05a4
SHA512 1bb6697307fd100e3541462c7a96c8e92c0f729c241a5a3e44ccbfabcce87ff20892e5cfdce87b8485ff53cd0c8289221aa619cc2cf43f5c6c57724eae772894
SSDEEP 12288:3zC2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:3zCkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T1A0D423B1F6D21919E10E87F364EB2B4F51B9AE7F10B8C3E9EB78158577A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 7a6798f5557a9f75fbf9736d64c41e3991f5df8e8e27e2649fa1c284430cf760
MD5 cf3fd2036f1f364bae4d33baaf2d25dc
SHA1 eaa5c8e5f6afbefb398141764bee81137ed5d757
SHA512 463d7808989267d11372a848c5991e2ed18d296c103e64d698f9decf12632942ab1a445d3e517b5c120056e0f7fc7c52e209851715b1b5fc8b8ba19538cc3436
SSDEEP 12288:dzMZ2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:dzMZkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T17DD423B1F6D21929E10E87F364E72B4F51B9AE7F10B8C3E9EB78158577A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9ec1163af02c5a46ae1ada1e8577b9e0b853bf0bcc5bcc8bbdc3738ea99f4c6f
MD5 639d3250f75936c50edf02c1f7ba1fa2
SHA1 f241bef24cb7fc474b02b9ab6a76e84dd3a54ac7
SHA512 ff74d43116be0d3082aa578a3e2309218678ffa6ee4d52bcb1da201db86909b2757f09150061e95416ccf2e972cfc15d07e185999a9c6f4e688772400820ee9f
SSDEEP 12288:fRPjELGR2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:Rj7RkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T158F4025777A130F9D12A827588A21B06F375B8370774CBAF57B406B62F236506E2BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 95fd4a3267ac18e2dc7f62573c4349ceeef1a676dfd87cedfcb77b8d0059b644
MD5 966c6c5d672788a3be60d103c99969b8
SHA1 f014cc4524c812d01cf6ccabdf1dcb41d2ac10f2
SHA512 384e1ae2041b37a877d8a59ec732883a99db0431aacfb85f6b4f86c863e566f3135aaabe82f3f79e637ab1d0d6847dc9f35c314e7afface7a600a1183aedc06e
SSDEEP 12288:/wB2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:/+kMHuAFztD/M/IchtWAGg9W+AX
TLSH
T151D423B1F6921919E50E87F364EB2B4F50B96E7F10B8C3E9EA78158577A5400330BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 afa64dbaa58509e56d29e18e5c3cb40273ec41f958b619f8483ef2763c5022f4
MD5 c7e3a82cf5ed32e6bc43db7a95b01930
SHA1 52d26571f1a3bc82082ee54772d85c37c7f00a92
SHA512 696fcdf66fc2251227277de655606cdf5975f9c34f593cf80cf56197bc63f20f3206b9806c6e8002a2599f7f3b1153cc769ae73936d8d1df6aa678e28c689d3e
SSDEEP 12288:3sB2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:3ikMHuAFztD/M/IchtWAGg9W+AX
TLSH
T108D423B1FA921919E50E87F364EA2B4F51B96E7F10B8C3E9EA78158477A5400330BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 9a6c61796d57aab5efff41d91aa7c33e32321e9112874657756adc1113b11643
MD5 ce6ebab1d42a28558ea7acbaff45585c
SHA1 c71675d6b0e11cb2dac537748119e6732387186e
SHA512 1b2cbaffd460e36f32272e1da88301d9dbc8088f9e4a19e99294b61d1d446021f576dbc3aef4fb1bf35a97f29d4a2666ddca06bd0342d51573514afa33ef64f9
SSDEEP 12288:ORPjELGl2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:0j7lkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T154F4025777A130F8D12A827588A21B06F376B8370774C7AF57B406B62F276506E2BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 ad840361106264d51d2606cca6081ed937881c9a5e920a01d870704324e30ad8
MD5 1633d7a629f7a695fd7283c799a2f30b
SHA1 131e47dd5506a3aa39199a50827c52d47db7b0a2
SHA512 60f1ef4162e62c0422f85a95243555afcd2f2c3e1fc2e3bbbd84abc6a4c919f71d7ec057151fd9c34e5dc1a433786fd6c75a1c12aaea366acf43b5f00108cc09
SSDEEP 24576:KT6aLn3z0z5vkMHuAFztD/M/IchtWAGg9W+AX:KThLnjakstZULrWV
TLSH
T1B11502A5B39018F8EC67827EC8665A0AD2B27C2A0670C75F53B436676F333501D2EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 185020ad550b5299553dff8abc04cbb393a51a236fe7681472d80abf3c4325ca
MD5 9c31474eced1e9d7b98579183171ff93
SHA1 32831059b8b37743fe61b6cf9bd0d711c01d8ee2
SHA512 26ec54e88891c832148fd04d8b02316b994e8fc9b287ac4fc8a8f9cfe7caa44da1fdb92620f6459e0e93ef5e9db8f653953e01717ae4ae8aae3fa5c3d1d979a9
SSDEEP 24576:w3rdICH1y7/z1kMHuAFztD/M/IchtWAGg9W+AX:6rdICH1yjJkstZULrWV
TLSH
T17135D090F3E414E8F0B7CA7589765512DAB67C5A1B30CA8F03A4265A1F33AD19D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 8f5b2df61984687bd3636f1bdb10e6715c157abba031c9b839acfa16ff514ce1
MD5 21ee2c81352174e0583227e1d9952ae6
SHA1 6fc5ee25f1a82d9dfd999adf01eb42e530f5f224
SHA512 ff51adc97bae878255f74579da5253f6ae94aabecf550d20444f45f7c4b039539f8d3fdca15aefee4df85a438df18a23b046c1a0196b51947702da00fb0772c0
SSDEEP 12288:Dw2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:DwkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T19ED423B1FAD21519E50E8BF364EB2B4F51B96E7F10B8C3E9EB78158477A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 0dedf0131949372884ec08a9c832147f2c67865e2b49b769d3aa897f234b1500
MD5 f85611a0ddcca6436e01a07f125b9340
SHA1 7ffc80fe5b16200286b49afd51d9bccd72f56ba5
SHA512 2ed4adb82247b8805aa7764adeb81aa62cd29bcab299815ad39b2b609816c10d4ee7519d884ab136f12b04c820373b43e98e035a6163bd7169408cc075a89a83
SSDEEP 12288:Yi2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+A:YikMHuAFztD/M/IchtWAGg9W+A
TLSH
T1A2D423B1FAD21529E11E87F364EB2B0F11B56E7F11B8C3E9EB78158577A5800320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 1e0caa68cffa6f2f804a437cc3d29c93f08920d01c8601203e535efbb7782e30
MD5 48f4b6d1004c162c35cf86acb91c5526
SHA1 8a442c038d2fe6bfca665b5f455f84da51c3ca35
SHA512 93701cbdcaa7a67259fda2d16d13c56d658c31d193b244c68c4b0111e8fb6d3428303aa88bd3066763c6434bdf61a6fffcbbbf5249d6ff60945fa0faca3aafa4
SSDEEP 12288:O/2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:O/kMHuAFztD/M/IchtWAGg9W+AX
TLSH
T157D423B1F6D21929E10E87F365EB2B4F51B5AE7F10B8C3E9EB78158477A5400320BA71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 9b49f07735f27758de134b6e79e11bab70b3d199b6778337802d08ae67d4ad56
MD5 5a2981f672c66428d57a341d49fc6fbe
SHA1 0fc5fd88b4dd8071b7be08a2f15109c584ff105b
SHA512 a640ebaffbe038e533885447a8049d3be02580fa7e61af27932043d9cca0d87b4389e14e5f0a85f97323a038d70c159b54cd7159ffa19acee90cda68fd5893f6
SSDEEP 12288:9A2XLO5tCwxQUUiJ5/OARPzGXm7Xz/M/Iceamo5tWs9za4ly3g914+AX:9AkMHuAFztD/M/IchtWAGg9W+AX
TLSH
T1EAD423B1F6D21529E10E8BF364E62B4F51B9AE7F10B8C3E9EB78158577A5400320BB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 9b1403e6b0942ad35beb86c81a4e2aade32fa621509fcca33b5bbbaa03b3becb
MD5 ca3e453f05ee55efb6f682fc109ebbd7
SHA1 c92fd0fc761393b9565d38d1e806bdcb950e8177
SHA512 c33d2baae6e4d993d67472c86b00a1f9c01e411d98a27e2cda27abf4a7b73e3821ecf7e9b342a15fe0f34531ed9009f26908580839f5c9960b4f3d331a272cee
SSDEEP 12288:C4PfFZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:peW5hXSHg/ehHeRqh9zS
TLSH
T17DF40144D29481E8D06EA675CB964A41F3377C215AE6E3CF13D0F43E0F76282AEDA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8e290c3221348032c161d825c4b5a4cb00e0d838e28a990ad2b83ad44e973cd0
MD5 0fd0a3148e03f9104f56bfecc87f28a2
SHA1 1a1aa3a86310d86c36a843dbddaded2626bb8f1c
SHA512 2d5cc7611d50700b1f8bcec667244955db4da6870a4fea693ae8f16ddf32571d03443818a1f20a1d892f7d2eed6ead43838a823fc9ff3f9fa465de68a2692705
SSDEEP 12288:Rg7AZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:6pW5hXSHg/ehHeRqh9zS
TLSH
T1A0D423C08398CC16F270BEF14AAB8F14B51C74512FADA9CF632E645A0AB35C7BE4556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 03a3fe8b63d578cfafadfdb57f7b6731f2bc49db26da910281cd67dfb07addf7
MD5 c15205e414ddc3e751de8557cf0c71d7
SHA1 72013551de769b1a86fec7e1dd77166409891290
SHA512 a12f7678047870b6feb6354dffa40a762401082ff6da9b86e51f2fed0ddc52c2d040a2e359e40e98cec5a682a56eea3504d7cd6933474bd6b4d43fa54986c932
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYV+XP5uszauvzbHvnEeYkm4d:Ogb4mBIBhGFF5Xau/PEqHd
TLSH
T14565AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151427D2F2BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 e96bba07ec83a813ed08f1fae8a5308188a70bf894a1c061b76e591d42b4389e
MD5 4f9bbbf6e164e05396800b350e614811
SHA1 f750c4bb9e08d175917c3d14454d9018e61b38e2
SHA512 3c73473fdaed5285d2bbd5518d4b33e175eb2f38fe26b345de2674633a54d9c51640a414a38f926ea9148389ef7bcaa2b67d141d6b8cbb791a9b8b13be966e7e
SSDEEP 12288:XBGLZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xG8W5hXSHg/ehHeRqh9zS
TLSH
T18FE4239462E5D858D131FBB58AB28E46F4B430502F6D29EF02E9E43A4F725C3B639C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 627b93efc6e4a44d4a0e96087c4ba6ce10b17fd8c1472f67e8bff5b726709581
MD5 fd94c1c339dfc8b7da3c3c64910160b8
SHA1 2a72dbc7119152ba24be87ef6c46a3fed4ad841f
SHA512 c985ddab8c88ad792ac6ec06952b95cf98a7db1e7dd2a38d4d7415b321ae33f707bf42048a9003b7a12131b88ef78ae1ceea3d5f489ecfe8397fd579648bd65d
SSDEEP 12288:TZZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:TyW5hXSHg/ehHeRqh9zS
TLSH
T1E1D423C05395CC16E250BEF547A38F45B54C70122FAE2ACF136EA41A0BB75C7BA794A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 34fb2efc29c45cedfafed04f8704abb10c9722081ba0aa7d0fbc131e9e037eea
MD5 42b125e4fe95047427bdb76dd4247d44
SHA1 a20821bf69b48eb83295ff870074dce8f02e6ddf
SHA512 f402cb033b8ad3ed43dc24fc6c61dde739ed1683c3e0d0aeeb60c7862a54ae1579318d90dce4d6860ffa918ecf860b35085a8071c05155feb10fa7b02242397c
SSDEEP 24576:vU88P8FpJqH1Ozria7/mQ+XP5uszauvzbHvnEeYkm4d:s7kFPqVJa7/y5Xau/PEqHd
TLSH
T18B35016677E001F0D47BD1388A9646A3FAB2B8150360EFDF06A84B551F13AD54BBEF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 1300b210db331d9bed5f07988e964b2353bf572032dabf3ae683d7a9be8bf8f3
MD5 26b854d10f61ef059214b734af01c27f
SHA1 1c5aa20a4b833f979fbfe4e6be8aece4fd0b20a6
SHA512 d86ad585e3e647717804790993d8d7323e51b3630a513271839a65335643d709e0b72d745e62bbe01be10b7ac0a347b0e5aa4d2d789ebfa015104a54be98cdd5
SSDEEP 12288:gHvUrBFrEjwaQ5Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQSW5hXSHg/ehHeRqh9zS
TLSH
T1B905F15E62E81CE5E676F17D8A828709F77174621712A2CF02E1817E0F639D9BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 2c50d5845164df91cb24f9ac68f23efa8d8706b14aca56a20d448442ff957073
MD5 355e70500b43826486585f5283ca8574
SHA1 1ee009be92e2f5f3f616e30afcd598663a9999b1
SHA512 50be17cb4239fe19ad47add708b2684bb3b553105cd028ee6b7487d8c543276dcf4caee233568134db1e2262cf1556f4f6f7cee7b67385826949e9dc0bddb982
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjz3F/el4q:5G05lO43bL5
TLSH
T1D0D5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 526ca44520756b18089ccba3911e897836dedf9367d9bc2c7da0e93a7db6af99
MD5 95620bec16304109269896ce761082e6
SHA1 4991bbe7ca61bb3696f74efeffdc82804500e4d2
SHA512 8781002fac551c4b206c2f6604cab2d1bafd5d9e943e850904ea36d4b602753a074051aeada787bdf1d30547b8d2f38d5e20fffc3a674995aa656f9997803392
SSDEEP 24576:Raa5POZ3dpbWVM50JicR2hG0lasx2+47eidnt+XP5uszauvzbHvnEeYkm4d:Ia5POZ3wJt2pasx2+mq5Xau/PEqHd
TLSH
T1D765BF5EA7FC00D5E5B9D17DC5838A1AE5B1342153319BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bb364b0cd56c599d26a345456f706f2c5533f4360a2f233d5953ab57897e77c2
MD5 4feb0a361da413da62dfbee3db53dcc4
SHA1 d6d5f4233ee1928d36a8afeefe525794ad29a47d
SHA512 2c4981cbef26fc140ce87d3821bce106b1abe679a4ad0ac840294a0c77f0637911bc84c07a4c0925c1688c71f61f6c948b80f5e951f3b6d36e48f1927e02480e
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkNW5hXSHg/ehHeRqh9zS:INc/zEOVHFt3F/el4q
TLSH
T135858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 ab8764000fa1c04a8879e8dde006db3f70b734c4b30f2bdddd2f937cbb8771cb
MD5 7d38aa3598eba8c2c67c883a4dc480b4
SHA1 c0f1f63c5b73d34990aee723e9803920499b2170
SHA512 68697a2a87850d3424408f6852c0ed87a0233cb24cc92e8ae6e17c6c9b4c02f0045228095b78445359bbed4eed272b8791a96cc74cb577429da1ac54007ff58d
SSDEEP 24576:FJnJPbzB4Sp+XP5uszauvzbHvnEeYkm4d:FJnJv6SU5Xau/PEqHd
TLSH
T14315D03DD2A810E8E4B7C2B4815A1BA9FE71386D2F2169C719B4D5343F12FD0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 cd66a3cdeb4f760adb75fab96f748164ec04313a2cc7c5002df02997dadefe80
MD5 51e5630b93cbb1a27e593b63d8a862a0
SHA1 d816b386224cc32297b44f7dcfe808dd6bc9e3c3
SHA512 3503af33e0f47f9b43ca684c868420df8a464e8fb18ac993bf594136b8a0edc535979ce76f93de3195342451b8c48879972a5b93d8248c49236a0134252d26db
SSDEEP 24576:5CLHGL0MoeVtFumTijCmlKQWDkj+XP5uszauvzbHvnEeYkm4d:5CLHGeeV5ijCmlDWDky5Xau/PEqHd
TLSH
T1E5A56B05A7EB4184F8F3CAF5CA2694168E327C549B34F7DF4A80C96A2E32BD1D578B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 2735ee990f497e2d920c718663ede42197ac4006d62f2f779ee05419d346631c
MD5 0322fcf774b6900ea404249c393bc6d3
SHA1 89ca21714e5a4b199baa512c48afa05c687d7d13
SHA512 51b4a950b8ed03e17426a63320786e827dac41e130614c174d26ad1dae8aa9242be1cd7ebf2a14fa644314087c4188cfb586fb3e449cb60cc60399e2a7481c05
SSDEEP 12288:XxHEk/j5ZI7bZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DIAW5hXSHg/ehHeRqh9zS
TLSH
T1D705025C637A40B5D167E07E86930501E2B1B0719B666ADF07A8C47E4FB3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 4a912d4b9bb2ecfe3f79071e4b691c016a9e88bab9b497cf6c0c14b80aeb4140
MD5 97c5bb4886f9eb36ac3d821926539046
SHA1 00bd7f3cf3c4630b43cf08022eed1bcc097ed5ff
SHA512 991fc2ceb064f93240c6b3e8f53359b9ad54818e2cfbc221468983000e9a8f7f4f9b88467296c678a330c01a10b78ec6d235af29d00ad2e43f984db495854c54
SSDEEP 12288:NG6kyZZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tyyW5hXSHg/ehHeRqh9zS
TLSH
T198F412405394D495F2716AB88AB38694EA38BC206F6667DF12A1E53F1F337C6BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 e076f3a653ee7a2775073e550729911dc8cbe602578aa0ee57bf1fff6b393dfc
MD5 590d99939b2dfaee47ec7f47a1045b4c
SHA1 ce38e65cb1580a77b31cf299b9706612f3abc562
SHA512 f27195f49049732f6de7171f36e9774548322438c43caa866e7bcaf0369682e09fc3312e1ca24edf6c5a74f87442a72e7dbbe465573ef12fb19711308f50d246
SSDEEP 12288:cnDoI+XD2DU5iHUbaaaFcQazg8D8+Hf3nOTwjNse4U41kswRW/cTi4d:Yh+XP5uszauvzbHvnEeYkm4d
TLSH
T187D4236FA768EC58FA5847F152B46BB48DF538248741A9DF28D109B86F02AC46CF4F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7f867a6f41de7c93aa47b9ea87e2b9d2e1e9b93caccca054cf899ac7591dcb25
MD5 9789bbe63f4c7d87bed00b7c71846d04
SHA1 1a348cdb0359644281aebca77a2d1748c89d7060
SHA512 8f5f46d94f5d64ab24cc11c9f8256e50960ea25b943d87d93eb9bb86a2352e65a5b8fc229391a59f574ab1546c554df9fcc330b33a50f0eb29aaaf765c2150fd
SSDEEP 24576:K2gjPoTfaidZj+XP5uszauvzbHvnEeYkm4d:hgMTrZy5Xau/PEqHd
TLSH
T176559D1D67EA09CAE2B2D275D8721493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 5c1e23d230042681d286e884dda680f697adaab2608b58c8e87afad1932afbbf
MD5 d662dd38233484dd8d5efb3d928c627e
SHA1 471339dd201c316cd6b53323f14da9a769b49f42
SHA512 7cc58296c92f55f7d4da449cc6c9c28132b00a1a07e713c7ad8930e2c2ae933a02716c1aec900a8403c22d71812539dd07a7286c329bc72079aea04600e23e1a
SSDEEP 12288:UpJcm8CNfoC+XD2DU5iHUbaaaFcQazg8D8+Hf3nOTwjNse4U41kswRW/cTi4d:UrcmRr+XP5uszauvzbHvnEeYkm4d
TLSH
T1F805011FB36E40E5E2BB82BCC9914655EAB374305312A7CF01A1877D5E13AE97C78B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 754ba23ecdd46db4fec9ef99f7b868dba14ff4c506c2b9e5826218cd7ed02900
MD5 641ca28e1509930205dede35a0bb2e3f
SHA1 b88e02af829440f2a0f89955f1cfed6f404e8732
SHA512 bd2c4c23b6919a2d73008e4871d9e402f3097f878e5aab8eed25a1ea0c713d07d7b9191197c63acfe1572ca87aa0f2c2e31ec773d4b38a75f9e3588ab07da9fc
SSDEEP 49152:dDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3J5Xau/PEqHd:e3Upow8sBy5XaoFHd
TLSH
T111A58C3DA2E800A8D9AAC379C54213A6EA71782D3F3055DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/504-249-0x00007FF741C10000-0x00007FF741D2A000-memory.dmp

Download

memory/504-251-0x00000263F48E0000-0x00000263F4946000-memory.dmp

Download

memory/504-250-0x00000263F48E0000-0x00000263F4946000-memory.dmp

Download

memory/504-308-0x00007FF741C10000-0x00007FF741D2A000-memory.dmp

Download

memory/692-349-0x00007FF633230000-0x00007FF6334BA000-memory.dmp

Download

memory/692-441-0x00007FF633230000-0x00007FF6334BA000-memory.dmp

Download

memory/692-350-0x000001CC94930000-0x000001CC94996000-memory.dmp

Download

memory/692-348-0x000001CC94930000-0x000001CC94996000-memory.dmp

Download

memory/1548-443-0x00007FF6E8AE0000-0x00007FF6E8FE6000-memory.dmp

Download

memory/1548-364-0x00007FF6E8AE0000-0x00007FF6E8FE6000-memory.dmp

Download

memory/1548-365-0x0000028C1C020000-0x0000028C1C086000-memory.dmp

Download

memory/1548-366-0x0000028C1C020000-0x0000028C1C086000-memory.dmp

Download

memory/1724-338-0x000001F10FCA0000-0x000001F10FD06000-memory.dmp

Download

memory/1724-344-0x00007FF682750000-0x00007FF682A70000-memory.dmp

Download

memory/1724-336-0x00007FF682750000-0x00007FF682A70000-memory.dmp

Download

memory/1724-337-0x000001F10FCA0000-0x000001F10FD06000-memory.dmp

Download

memory/1724-342-0x000001F10FCA0000-0x000001F10FD06000-memory.dmp

Download

memory/2196-22-0x00007FF6C2780000-0x00007FF6C2B64000-memory.dmp

Download

memory/2196-2-0x00007FF6C2780000-0x00007FF6C2B64000-memory.dmp

Download

memory/2196-3-0x000001D1F4E00000-0x000001D1F4E66000-memory.dmp

Download

memory/2196-19-0x000001D1F4E00000-0x000001D1F4E66000-memory.dmp

Download

memory/2196-0-0x000001D1F4E00000-0x000001D1F4E66000-memory.dmp

Download

memory/2236-444-0x00007FF7D2CC0000-0x00007FF7D2DEE000-memory.dmp

Download

memory/2236-380-0x00007FF7D2CC0000-0x00007FF7D2DEE000-memory.dmp

Download

memory/2236-374-0x000001BE5BC80000-0x000001BE5BCE6000-memory.dmp

Download

memory/2236-375-0x000001BE5BC80000-0x000001BE5BCE6000-memory.dmp

Download

memory/2368-436-0x00007FF6E88B0000-0x00007FF6E8B53000-memory.dmp

Download

memory/2368-320-0x000002CCE4540000-0x000002CCE45A6000-memory.dmp

Download

memory/2368-321-0x000002CCE4540000-0x000002CCE45A6000-memory.dmp

Download

memory/2368-318-0x00007FF6E88B0000-0x00007FF6E8B53000-memory.dmp

Download

memory/2552-387-0x0000015BF41B0000-0x0000015BF4216000-memory.dmp

Download

memory/2552-385-0x00007FF7B4490000-0x00007FF7B47CE000-memory.dmp

Download

memory/2552-386-0x0000015BF41B0000-0x0000015BF4216000-memory.dmp

Download

memory/2552-445-0x00007FF7B4490000-0x00007FF7B47CE000-memory.dmp

Download

memory/2644-43-0x00007FF6C2370000-0x00007FF6C24D8000-memory.dmp

Download

memory/2644-44-0x000001B73E180000-0x000001B73E1E6000-memory.dmp

Download

memory/2644-50-0x000001B73E180000-0x000001B73E1E6000-memory.dmp

Download

memory/2644-52-0x00007FF6C2370000-0x00007FF6C24D8000-memory.dmp

Download

memory/2644-45-0x000001B73E180000-0x000001B73E1E6000-memory.dmp

Download

memory/2724-329-0x000001898B390000-0x000001898B3F6000-memory.dmp

Download

memory/2724-328-0x00007FF70A2B0000-0x00007FF70A444000-memory.dmp

Download

memory/2724-330-0x000001898B390000-0x000001898B3F6000-memory.dmp

Download

memory/2724-440-0x00007FF70A2B0000-0x00007FF70A444000-memory.dmp

Download

memory/3412-28-0x00000163047C0000-0x0000016304826000-memory.dmp

Download

memory/3412-25-0x0000016304670000-0x00000163047B8000-memory.dmp

Download

memory/3412-26-0x00000163047C0000-0x0000016304826000-memory.dmp

Download

memory/3412-27-0x00000163047C0000-0x0000016304826000-memory.dmp

Download

memory/3428-36-0x000001C7F53D0000-0x000001C7F5436000-memory.dmp

Download

memory/3428-37-0x000001C7F53D0000-0x000001C7F5436000-memory.dmp

Download

memory/3428-35-0x000001C7F53D0000-0x000001C7F5436000-memory.dmp

Download

memory/3428-34-0x000001C7F5160000-0x000001C7F52A8000-memory.dmp

Download

memory/3432-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3432-276-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/3432-271-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/3432-327-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3524-14-0x000002E375D70000-0x000002E375DD6000-memory.dmp

Download

memory/3524-12-0x000002E375D70000-0x000002E375DD6000-memory.dmp

Download

memory/3524-11-0x00007FF72CD00000-0x00007FF72CE23000-memory.dmp

Download

memory/3524-61-0x00007FF72CD00000-0x00007FF72CE23000-memory.dmp

Download

memory/4136-356-0x0000020492A60000-0x0000020492AC6000-memory.dmp

Download

memory/4136-357-0x0000020492A60000-0x0000020492AC6000-memory.dmp

Download

memory/4136-361-0x00007FF67C5D0000-0x00007FF67CAA0000-memory.dmp

Download

memory/4136-442-0x00007FF67C5D0000-0x00007FF67CAA0000-memory.dmp

Download

memory/4600-56-0x00000215DD230000-0x00000215DD296000-memory.dmp

Download

memory/4600-55-0x00000215DD0E0000-0x00000215DD228000-memory.dmp

Download

memory/4600-57-0x00000215DD230000-0x00000215DD296000-memory.dmp

Download

memory/4776-309-0x00007FF7814E0000-0x00007FF781593000-memory.dmp

Download

memory/4776-310-0x000001F1A86D0000-0x000001F1A8736000-memory.dmp

Download

memory/4776-311-0x000001F1A86D0000-0x000001F1A8736000-memory.dmp

Download

memory/4776-384-0x00007FF7814E0000-0x00007FF781593000-memory.dmp

Download

memory/4908-290-0x00000158A9C60000-0x00000158A9CC6000-memory.dmp

Download

memory/4908-370-0x00007FF7BAA80000-0x00007FF7BAB2E000-memory.dmp

Download

memory/4908-288-0x00007FF7BAA80000-0x00007FF7BAB2E000-memory.dmp

Download

memory/4908-289-0x00000158A9C60000-0x00000158A9CC6000-memory.dmp

Download

memory/5464-241-0x00007FF77CF70000-0x00007FF77D039000-memory.dmp

Download

memory/5464-243-0x00000208A18F0000-0x00000208A1956000-memory.dmp

Download

memory/5464-297-0x00007FF77CF70000-0x00007FF77D039000-memory.dmp

Download

memory/5464-242-0x00000208A18F0000-0x00000208A1956000-memory.dmp

Download

memory/5656-300-0x000001B016AA0000-0x000001B016B06000-memory.dmp

Download

memory/5656-437-0x000001B016AA0000-0x000001B016B06000-memory.dmp

Download

memory/5656-299-0x000001B016AA0000-0x000001B016B06000-memory.dmp

Download

memory/5656-439-0x00007FF6AC2E0000-0x00007FF6AC6F7000-memory.dmp

Download

memory/5656-298-0x00007FF6AC2E0000-0x00007FF6AC6F7000-memory.dmp

Download

memory/5656-379-0x00007FF6AC2E0000-0x00007FF6AC6F7000-memory.dmp

Download

memory/5820-347-0x00007FF6EA760000-0x00007FF6EAEA4000-memory.dmp

Download

memory/5820-282-0x00007FF6EA760000-0x00007FF6EAEA4000-memory.dmp

Download

memory/5820-283-0x0000021B9AC10000-0x0000021B9AC76000-memory.dmp

Download

memory/5908-287-0x00007FF77CF70000-0x00007FF77D039000-memory.dmp

Download

memory/5908-234-0x0000011AEEA10000-0x0000011AEEA76000-memory.dmp

Download

memory/5908-233-0x0000011AEEA10000-0x0000011AEEA76000-memory.dmp

Download

memory/5908-232-0x00007FF77CF70000-0x00007FF77D039000-memory.dmp

Download

memory/6128-264-0x00000181A67D0000-0x00000181A6836000-memory.dmp

Download

memory/6128-317-0x00007FF6DC550000-0x00007FF6DC69A000-memory.dmp

Download

memory/6128-261-0x00007FF6DC550000-0x00007FF6DC69A000-memory.dmp

Download

memory/6128-263-0x00000181A67D0000-0x00000181A6836000-memory.dmp

Download