00cd22d911c24876db2526a94d2d87f6c7a4f6ca0ba0a09d6d51555759183023

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe
Size 840KB
Sample260712-rf14madt7s
SHA256 00cd22d911c24876db2526a94d2d87f6c7a4f6ca0ba0a09d6d51555759183023
MD5 1b89e751892d9f24791c84950360dde3
SHA1 ef092a45c21b3d9594e33ad8e1b0717b6b8883ff
SHA512 0652230fc7a9221770acdcf3509714e5c3b29467bd6ea1a6d8dda804259c7223367b4bc429f85b0b48ec2d50fbbde3ad42598dd5ed0b6a822e3329d0fbe0f4c2
SSDEEP 24576:F8x69/QIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:FL9/9WkYSm557JVIJ6tSr6P/
TLSH
T16D05F15976A84CF5EA67C17D89429602E77278090B74DBDF0760027B2F237E0AE3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5540	alg.exe
4548	elevation_service.exe
5848	elevation_service.exe
1340	maintenanceservice.exe
5028	OSE.EXE
2388	GameInputSvc.exe
3720	GameInputSvc.exe
5336	msdtc.exe
5604	PerceptionSimulationService.exe
3396	perfhost.exe
1524	ReFsDedupSvc.exe
4316	locator.exe
3696	SensorDataService.exe
3524	snmptrap.exe
2616	ssh-agent.exe
6140	TieringEngineService.exe
880	AgentService.exe
4600	vds.exe
1132	vssvc.exe
1736	wbengine.exe
3512	WmiApSrv.exe
2760	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7a0b02e383806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3720	GameInputSvc.exe
3720	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3076	2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	5540	alg.exe
Token: SeDebugPrivilege	5540	alg.exe
Token: SeTakeOwnershipPrivilege	4548	elevation_service.exe
Token: SeTcbPrivilege	2388	GameInputSvc.exe
Token: SeBackupPrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6140	TieringEngineService.exe
Token: SeManageVolumePrivilege	6140	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: SeBackupPrivilege	1132	vssvc.exe
Token: SeRestorePrivilege	1132	vssvc.exe
Token: SeAuditPrivilege	1132	vssvc.exe
Token: SeBackupPrivilege	1736	wbengine.exe
Token: SeRestorePrivilege	1736	wbengine.exe
Token: SeSecurityPrivilege	1736	wbengine.exe
Token: 33	2760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2760	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 3720	2388	GameInputSvc.exe	96
PID 2760 wrote to memory of 256	2760	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_1b89e751892d9f24791c84950360dde3_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5848

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1340

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5028

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3720

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5336

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5604

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1524

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3696

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2616

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3512

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4ba9b280d8d36c89f84d9f7a960e0c7f8abf321c90a3e51836edcb653693f663
MD5 cc9f2f9f7ffb5973dd15f440b2b54b78
SHA1 45eda4d7f711b0c56bb163a6b13fa48840f640bd
SHA512 ffaf9220309e22ddcd24dae0a7c31ad5f3a3a60c2fb2384a1d7db64484c3e01bcc0bd7be2a996cc78480c405afdcd4b40928dc4715454d6594bb2df9aa244b6e
SSDEEP 49152:5zB632BuPkFKRrdE6oh7stBhuXjfS4LWxnVWkYSm557JVIJ6tSr6P/:e3q6gjBEWPJBSGP/
TLSH
T1B3D59D03F29900E8E069D578D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 87e2c4ba282e1f93d3bea3275f846b7c105c4aebb683a6b9d77aa168e5290ed0
MD5 167d51d8fc4276e09a00641325492eef
SHA1 792f1a2b54b390e1d40bbcae983cecf44d820ff5
SHA512 afe6cf7dc230c1ab87819e17ca0877c8956322e61e92f7315cc7891a88bedeec10c9f7f0db432da39913072ef2cfee58c3b5ba6f4f882b225fea11c8f3edc301
SSDEEP 24576:cXYTDKczAEIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:XKceWkYSm557JVIJ6tSr6P/
TLSH
T1EA05026877E408F8ED67817DCCA28611E73378564BA0E75B03A496650F233D86E3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a26aee36a32f0bc0c869297984d1d226ad23848797bcc98fb48ff3f32a00cf1c
MD5 9a7d82173f83a8d9c9c5c8964b835a87
SHA1 3bd95a9941a12913d6ffa21f8a9e04879e1ef144
SHA512 9c2de0292c42ef2f60b0fee6b6fb0de1572d243fe14be8fdf5ded34ff4779e2b21be1f386971edd00499162e7e9d8ead366c147fdb0a1b240c7e9a97add0310b
SSDEEP 24576:c0Jea0M0kTxOrMCIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:cu0M0GoEWkYSm557JVIJ6tSr6P/
TLSH
T17245AE65F5748335D073C0B9C5D2A69AEA7130865B308ACB0286D77C3F677E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 7e947d8b2430909be7b93ce8de963f17e69dee1b183fad8c499ca375080d99f0
MD5 dc9657ee0501f4f2320e67acbe2585bc
SHA1 1194ea7ef76314d2b59b409e569b46f2b7fe30f2
SHA512 9511d450238425a47239df86a3283f6f5cc5c156aa691c273a42ed70c802e8a6b21ec2cf98cb18ed7046da0c034c754bc483e87322f0a2bc9731b4bf3620e4fe
SSDEEP 49152:i/ezSC6vUzPvuHjyiWkYSm557JVIJ6tSr6P/:GezSC6v2XuH5WPJBSGP/
TLSH
T1D5756C65F5788323D0B2D0BAC5D6BA9AFE3230465B3089CB0246976C3E277E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 18ecb3c4fefc05fe38a750e2e70487c8738254693043f33b4223b97d408c5054
MD5 f94d557d4f28c5cab8be93ce598544ed
SHA1 8912fe91f576edfcad01512518678918d4e36347
SHA512 68d25d9271e5f6877273f38fa49b7d9db532bc8846ca00712503e93f1aff84767ccd1b992be287931b6e42a84228902f7831ce30d283d7e93df3497d75347f1c
SSDEEP 24576:CabdPYR8mv/l+drIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:CauR8mXl+IWkYSm557JVIJ6tSr6P/
TLSH
T1FF559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 95c1838c02d20fdd3ff25bfb1de9eba3549c98c7ee836368d0f655fc05ea8d96
MD5 ac82392b023f7e0f82a4c686391e64f5
SHA1 7fb98fa69a3839f84f050a5023c13297a6f7c168
SHA512 3e3ec8e364d654eca7c86860c1a9f080287794f982c30cfb9b681a8fa3bcc4f320881837863ee0bdfe5f43d93507f72db1362e47bbe0c3c02357473d3752d00b
SSDEEP 12288:+IGIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:+IGIXWknY6QKTm55L3pnVIJ6ntSrM+S3
TLSH
T123D423D8EC2898A4FFF58D7A09622F1256307F2B8EE8DD69042573960E34294FD1DDD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 a6b18ec34cb5060253f382c62f4fe59914ab4b329b505d966b9493e456addaf1
MD5 6bf2d47603698a9b9f7361e8f5b64513
SHA1 8e217f9fb9ff0f32c71fd00df322be333b183140
SHA512 87c572bd14c2172789fb73a21e7148bf878ab96a43a067851d30c71d681b287304dc2205e8c3922af1408abcd991a269f64e6050d3f2b41136183b9a21055d1b
SSDEEP 24576:zJIUoIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:zJIUlWkYSm557JVIJ6tSr6P/
TLSH
T16215DF7BEE28FCE1C67A8DB95A918700D77278314F61A3CBD125830E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 4aafcef3568d21541dcedb91bd2fbf5b14259ea58faf1915f9e2f4c5f2466aa5
MD5 42a66df39a0b1469d40b6c7a5586e552
SHA1 f69b4e21bd8b9cee6ad7841550e93d452a200fcf
SHA512 a8b56ef86a961c1472342fc2c6b82f5da615f60fda507f1fb613ba7c66628362f3e69ed7f3331bb04b4ad931af7b2cfe78c92c00262e90ed5570f245b135e247
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJT9DN5J8NRV3TH9:jQvGAdlCEL8c/TRNw5C/WPJBSGP
TLSH
T12F367C656BF880F5E1A7E138897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 be5b1e66bda4b20dbeceaefd5c05d39cf51f2abd84caf6b94a2095336474ea44
MD5 599697a0ef79fd1782ba181e1d471c04
SHA1 7c71b736396e8efacc874a9f28baadd108b1fa6e
SHA512 775dba2a4e0c37d165a61c4e1df24404dd96c35af426de04936e317d5f50176ca98f79ef14eea72d05f775c947f5219b1bfc2ede14f508e483cc187f07d32d34
SSDEEP 24576:umewsAjJIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:9ljUWkYSm557JVIJ6tSr6P/
TLSH
T1C115E070FE74E436C7BB0DB61B26D716143C7A204FA11AC3E3A84A9E59302D1677AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 843604679e33f5eb77cd9e0b771c815c06fe518e99c9e00439cf2779c63d8c9d
MD5 33b501fea67a7aab8cd947c32dc9e734
SHA1 133cf276f7a6217222cb22290e59d4536308d4ef
SHA512 ff16fb13306d4a342e3198fe0bdc129d97daa5c3de48f15b35ac0d903325895994cbe376e30b8031582fa4a76f6c531cce7aa9e317a61e8221e51806df4a6d9a
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXLldPlbuJHnJ8GP:lUEtQevvqc2W1cpV2XL32J8GP
TLSH
T120474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c9ad1456492101cb575ef1540e16a3a60eea2946c3cc150adc65b3c515b377d9
MD5 4437c730c9f15e868c379c382191c45e
SHA1 ea3d871fa064176da64d6b06d0b6f400e57ac821
SHA512 25be5b1f1c1540d48a00ce183ed834e12af85bcac9163c3c0f31a42541869f335e2a7e311f10bc2aa41372f64c2bd3f08789d2919f5543520b96048f75f69d58
SSDEEP 49152:M3bRquA/m2yL5zMfFiV+XenmE3/zlWkYSm557JVIJ6tSr6P/:6oq1VjnmcWPJBSGP/
TLSH
T1EBD58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 512f7b1e3a05c9ffb7d78d60d612a975ac128d14f696c42738f826d7fe2dbefe
MD5 e6e19cc3165edd3c90c7798f77d3673d
SHA1 d484360c7386e74aa407a7edd2cb09f966fe99c9
SHA512 ff396ebe455bae54815f974bfb90ce8f275a05f0028b501ca343e3cf607d62cfa7106b71105e73e97f8f5c669b6d97db6c511259a978f6b6abd06b3411ae2e48
SSDEEP 24576:bAhGLvcFoiwtA5l7S53PIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:bAMIFoiq52WkYSm557JVIJ6tSr6P/
TLSH
T1E845AE80EBF955D4F5F3AA7899B69571EA76BCAA5E30C20F1150D11F0E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 b7eb2ce76258e473e1cd4c48493047f8aae221c7af822bd658d8d8315cb1d4c8
MD5 807569a49d6879a15b9b72aa0e5c0fe2
SHA1 5aa84d919765fa93cf27572e3726598d1a086e79
SHA512 94bce55340f2cfb77e83b6ad6d40d8518572a3097480b0d7a6398a63cf4304b693a98683b467e99e5ef356800ab0e885a18dd6a0cc3ea71289727f42a740f67b
SSDEEP 24576:uwusOWCIXWknY6QKTm55L3pnVIJ6ntSrM+SP:uwfOWWkYSm557JVIJ6tSr6P
TLSH
T19A05F18976A40CF8EAA7853985578632F7B2BC161A64DB1F0760C35B5F33360BD2DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 152ba9de60255afd6b55cda38af1b54f174bae958981ade46bb0ea30590a47a1
MD5 62af764261067953e9fbf3643c99ec93
SHA1 f129bace3520580422cc2c764a32e58e6c45a046
SHA512 ba7b12cc08c1bfaf2db3d4041b7a0ac19b2b2be43509e792b19e92f193d810f7a7d26aaba23e0a7300e331202588e3356fa9ef0e4fa95c43ef2b591c3098e722
SSDEEP 12288:TnS1IDWIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:LSuaIXWknY6QKTm55L3pnVIJ6ntSrM+e
TLSH
T1B3E412D836A460F4EBA3867D8DE25B01D73178274BB487CF052543AA1F226D4BD3DB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 83a21df4587dfa31de5e4eb1cd5d4169e367add7e27a011f99e73a5092e4c634
MD5 69cf839c2aa164888099fc815c012374
SHA1 39e1c93bf2b55734e36ec2cb08a873617bd90fba
SHA512 f00315e67753a5b3c6e5a9fbf64a28662b71407ef3e8804080b966e8ba50e52b40cab23fb9a8eedefbf8c4d8192ef5ead51a1ea10c4200622e19b48d54720480
SSDEEP 98304:+QRQyi36YOcP8Lvw2gAf+PN3RWPJBSGP/:lQyiKa+X+PNgJ8GP/
TLSH
T1C8667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d976bfefca1651e7008c545507787644d5d272055a01369524f6a76c281b7056
MD5 bb5c4acd7b1e5e9fcb9e5ed76ef7b8d6
SHA1 998c1bee583fe80ca39c6a045c47bfdefcd7c03a
SHA512 59a583ff4f61337a108bc12b5e53728ac777d40fde4a071c1c8fcd13061536e4abea126362404ef46127a9c607b0b735a68c99f83ad955b335630facaaea6d9b
SSDEEP 98304:+QRQyi36YOcP8Lvw2gAf+PN3CWPJBSGP/:lQyiKa+X+PNHJ8GP/
TLSH
T14F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d21c27ee22ae667431f67407fc46ec638d374e88b42148635ceb6d4098b21606
MD5 0549e5c4a95af1bd781fa46b812f9627
SHA1 aab4ab9f405544ece08201069d77d30a193e6701
SHA512 cc223bb4e3a748dc294af72f3596bf93d7b92c160135e7ba8e16ccee154f84ab20fb11d14d51060f8184babeff813f6d24632c256ded1c7681d0421aaaf3cdbc
SSDEEP 49152:768Qg55nhMeWu7PNU3/dWkYSm557JVIJ6tSr6P/:FthbRc/dWPJBSGP/
TLSH
T10DB55933B2F600A9C44DE1769F4A972196E17C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b1e28d5522f2a7ee58233e9ad7a5f9de6a554c98b65379fa7f8233aa5a3e4cd3
MD5 d792923028ed8518dbff345fa5a01ddc
SHA1 b795add4b25670ceed05a64f1b30e7e715475ece
SHA512 f8a5ea311537475f1baceffc49090c4767fd9af8c4956c0d8b9bd3a087412b6ce5c5022c2202266d685b9844e5155e217a4383c5dd1c66f1164b0368975ff72f
SSDEEP 98304:jy5112gYy5azzVv569nLKnhZKWPJBSGP/:+LIHAWhFJ8GP/
TLSH
T18D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d826b7485bc0cbf7aa5b42288ab766a37d479e48a412e30cd9f574bfad8ce5e2
MD5 c09d01a24fd9cd9f3d258984df092a50
SHA1 2dc077e57976dbe52731a9e157540bd26c47e6b4
SHA512 2f27270602ee90fdc40e3cbb3a0e0833a2bbe969435a6e3ee760920eef48e20af565bbc241183f0c64d7b0791d169059811b667406400a5672b0ab6b11c4830f
SSDEEP 49152:Ak+taZ3usBWOBr4tEGp0bqx0z+n217aau1glwWkYSm557JVIJ6tSr6P/:Lu6JmTxd2dwWPJBSGP/
TLSH
T1E5D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77d05f20da5a0bf33d68c3eac24dc745c61b9d8c91b84d4d167f5305366faf92
MD5 c6564727e96009202a9c37600678a478
SHA1 259c7b50aa124b592ca9211ea80ecf7295a10025
SHA512 15e81b81724d9ecc0f61ddb3ca0061820d1c9f0afb83535b4f16bb8f83a7fdbdb8553e02f7bfd5e8b57e6d3bc00d9d08ce4b668536565ac594abfd6003d6b470
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xtWkYSm557JVIJ6tSr6P/:jmifPbRyWPJBSGP/
TLSH
T176B5BE13F29900E8D06DD17887569632EA72BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fefa62aedb607cd967718e5c535ca3731a2bda001e2d0e8e2e256812d14528ed
MD5 f58a75c7a72df5eb5516eaecfd00f94a
SHA1 a3bea8aff17b09cda799f48b446e31996ace57e3
SHA512 8c432f5128a11cef255edc7496b75b12b5b673cad6e1c37da21d349936268f6be1db08380dd93fec853a5293fb596da5cc2ed2c90c581685a6ba3ddb6538b598
SSDEEP 49152:7SuZQIY0Be2K6RVtOnks6NMHq0WkYSm557JVIJ6tSr6P/:p5dKoi610WPJBSGP/
TLSH
T1F1C5BE03F2E940E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5ceece8c56ada432890e10a70212d08c80ac879654fbd98f4a0411d8e9ae0fe1
MD5 5e10b2c210eb7b828fa38c91e937300c
SHA1 48132bc48339bc778bf851e94ae81339aeaa914e
SHA512 3bc15567e17a54f30eb05fa07536d610ffab3b5658b381a827a9e7cdd20da9d724a26277f75d73218af747d09cb9040a09ddcedb0c362572806406c8b13da1f5
SSDEEP 49152:bbSSn8EApI0figTgiDn0AP5wRWkYSm557JVIJ6tSr6P/:TX2iyphuWPJBSGP/
TLSH
T139A5BF13F2D900E8D05ED178C7568632EA62BC160B34AAEF0A5077561F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 4eb6f0202593f04385daba540f33816b394787fdc5bc26b5d80c76c45205c539
MD5 b1f072c2c0a61b5a80cca1b08098b4c2
SHA1 44ad5ce0928ec61d4f87e4b61e1e95410bb2581c
SHA512 661805a3da9c07acdb878a087cd542c99f5c3fecc100e4f873206c333e5ca77558015b92a96ed8500976e9e3321c2f7743b01d8916fa99f0542df7e89c5beab5
SSDEEP 12288:uT4IHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:u0IXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T143D423DCFC3889A4FFA1CDBA4A522B1296307F2FCFE8D96D051922561F10294B91DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 2011fd93e8b550b3ef76b07442f2fa5cf7da3015901991a846e2f7d6bc7c0045
MD5 cfd9cdfea301e56096a8feddd5862b09
SHA1 ce6379d7d4fc02651ce2196d11602ef9db8821f2
SHA512 1ca56be909ff9ac9c496f7af3e2080d67a42f73720c929718f7d5058ce15e1f37581445961d3c19b451ce7d6f318ef3b6ea464e97639c3a036746b13e8346b81
SSDEEP 12288:UB4IHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:USIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T1D6D423DCBC3489A4FFA1CDBA4A522B129A307F2FCFE8D96D051922561F10298BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 a8726c68e58de2afbd0c5b0f62c5bc005a93944e470a2ae3a7cb866687b1a6c6
MD5 9f91fb1aee2fa35fe739dbd0f009c35d
SHA1 013789447c84ae51f5e2c7dda6b363fc28e0914d
SHA512 1521efa796552e9fc8f2f37dd66a58ac589187d8d698688e48996a075188e0fe64ba7fd5e26a853fd822d0e988f0fbf5a0274945f54524091e027df935676de7
SSDEEP 12288:SWIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:SWIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T1D0D423DCFC2489A4FFA1CDBA4E522B1296307F2FCEE8D96D051922561F10298BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 efc7e902a1795c8fda1e9bd5678580a783acdb8f007f06023d4552be56d3013a
MD5 d3752adb7a485e03c64922bd4f37778c
SHA1 c36917dfcaa1182a05cb27232f6031bfd3f73e62
SHA512 c8e53bb186e99781f9676343d58abb0f7e238a85770ea9f73b7df19d6d67a5f7cdaca4dc21c040682591974a8a6271e98231d44eeabccfd700336211b85e5e78
SSDEEP 12288:9lYIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:AIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T110D423D87D3885D4FFB2CA7989626B12D7307E2BCEB4DA6F061512560F20394BD2CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 426598ad37f34ca7dc6a00c4de484f61d1aceb9281e08089d4916bc8fb17dcca
MD5 98b78a84ff0ce682c66fa431f42c0edf
SHA1 79ad203670e6caf3a05650717277cbb41d5af32d
SHA512 698885bd9235545266ace37518d475281aaefba2b6eb3a85284063dfa2ca66ebde5ebb53b3bd32c8f748c9f93475ef96be8b3d51a212cfba3520ef0d9db39f75
SSDEEP 12288:RUIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:RUIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T153D423DCFC3889A4FFA1CDBA4A522B129A307F2FCEE8D96D051922561F10294BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 ff9c181ae59cd8338968843a23f3f9f57eb0b03ed839cce138cae24e53161a1f
MD5 f6d2ac58b4f900adc20c2e0f87bd5147
SHA1 81091edf9b329ec06fd1aa1472cfb353e04122bf
SHA512 6d59e250a8f1c71fd4980fc9d6488aa4648226f46598a583eafeee01dbce92865cf122e3e8b65f22f8e3c4b14c49b5b50b17b4717c23fb5db34062fdd3f13ac3
SSDEEP 12288:K4IHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:K4IXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T14ED423DCBC3889A4FFA1CDBA4E522B1296307F2FCEE8D96D091922561F10294BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 1b8840d9c0c75c430574341103fb0c9e6518f6704e848cedc41556513a305e26
MD5 8123206391f795565053b071f1417de1
SHA1 9901d6b117ab036c6d592db6c62303e73d9b9830
SHA512 9910dca664dd7af13e55a85fc25f2980e22266ec8c1b620375ab406b9a0cbaa38f08a3d8b77b1da3eba3a41186fbb5faffa87b0b5bd9a21393d206c7aea48c40
SSDEEP 12288:ZvKIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:ZSIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T118D423DCFC3889A4FFA1CDBA4A522B1256303F2FCFE8D969052952561F10298BD1DDD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 1aa941a93770f15933d8ea24e25ae3e634268a5980ad8998d553d3a19538dc4c
MD5 a34fb26f446db0232cc402ae417daf18
SHA1 f5f34eff838f0d33297751f1df419e6343ec4626
SHA512 b3fd38c82a39265226634ba844e038f25cc7eb6225f31292c5a13f6b8ec541ffb23268b34a44f775ec089083a5907f4b58a8d4d0eff43334a539dd3502376d52
SSDEEP 24576:HZM0zEaSAYIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:HZM0zRnWkYSm557JVIJ6tSr6P/
TLSH
T1601502D8B66058F4ED67853ECD515A06D6B27C1A4BB0CA1F03A432671F333A06D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 738e6f8d88c78d009bb4163fccc40d2b46afae689d0e9342aa5822fb448d7bc5
MD5 f1027dfd38f82f555ef035b2a16b4cec
SHA1 0c005f2f6e1d158637a79702485edcaf82517360
SHA512 f46e5b92ed2a3460f58b757107ff56c048c215ff43a86628cf325e9e18fc3570f3a32a5adf1fb5fb290473f0873c56641dd511f1676770b1508317dc937f273f
SSDEEP 12288:yTIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:yTIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T1EFD423DCFC3889A4FFA1CDBA4E522B125A307F2FCEE8D959091922561F10298BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 81f959fde43479e0447d3592694df83e4d8183d827de07e5992d1272532e35d3
MD5 57c4d7cc5a386dfaf7bb1ee0de21712d
SHA1 3093369b21c2d8992d23c56dc3d9b4c979444ff8
SHA512 a40a6b3ec528491b7ce6831d5678dcbdb9ff8eedb62e9215dad62681b61010a82fb641473e9bd2316e0032199df2579c75f52a96d20f56318d113604af9ebcbf
SSDEEP 12288:s6IHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:s6IXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T104D423DCBC38C9A4FFA1CDBA4E522B1256307F2FCEE8DA69091912561F10294BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 bdeaa27ebfef43aa8a743e810928bee91c3463b32ffcd7d0f90679d3670bfee7
MD5 6933cb7a16ae42a80849748e1fb57a63
SHA1 2c36846ac3c4bd0d8fe4ca0db8d144bb9109d630
SHA512 276560255f430558e9f9c0b7272010793b36e16c0f7107f5f7f52a69eac4460905f66de8c7ff244b03cd048c25341eb1df2cfa588cb0bfdfce610976ceaa6b26
SSDEEP 12288:91Pz5LEoIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:vz2oIXWknY6QKTm55L3pnVIJ6ntSrM+e
TLSH
T198F4029B766520F8E676863989621B02F73178374F64DE6F176403761F23290BE2EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 0877019ef54b07b5ede2d8486def51252a5fd5461282c83ff4bdecaa15a13d76
MD5 f9e3171491e08674366eadb3db3a5d1d
SHA1 040cc68e83d600a97e1769be1ee02a626f6ae2d9
SHA512 a64094e236a1aa681bda5093fdcec2842a417a79c45da55e5ba011c510f9aec8f7b98e96af65aab28e61f8aaa1de42f941663248701b027ce1a0b5f461806a99
SSDEEP 12288:68IHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:68IXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T1BAD423DCFC38C9A4FFA18DBA4E522B125A307F2FCFE8D969091912561F10298B91DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 8a79d85e9dc756ad2bb2f267e17a652464a014501bffcd8018a9d38ad0a80e41
MD5 afa33a4f871edb1f0634f2e7f05ebb0f
SHA1 af3caa187e476bc57ce2285937b01e1fe94a30b8
SHA512 f8c1d38cd90574a2c7b9fc3563cf2dbb3d49d010186b43b29736327062e95a59f684edbf3a1fca6aceceae3b11a9796632bd55b789f397b17a9a45a15cf80fe0
SSDEEP 12288:CfIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:CfIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T185D423DCBC3889A4FFA1CDBA4E522B125A307F2FCEE8D96D051922561F10298BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 b74a37ef81175810290ee98825a35f1a44d111d4fe04c91a17de213e4729b303
MD5 765deddf06533c50a0384a0a3f3b7a4b
SHA1 41892e246c17bfdfaf581926f4b0e174a7b067f9
SHA512 44519c24d79f51437973170360463702b57c8aff98f23b24f3489f553e2f6cfae513b1c3f9f89784760e61629691aaef5abb99d047b7e26fc3f64a416a2337fa
SSDEEP 12288:A1Pz5LEpIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:Sz2pIXWknY6QKTm55L3pnVIJ6ntSrM+e
TLSH
T122F4029B766520F8E676863989621B02F73178374F649E6F176403761F23390BE2EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 27bb0be3da7ac9f972eacca28ccd4571a5b6997439508cbb97b503698dc55971
MD5 5220830c9762847c51c9284b5af85797
SHA1 fd554937657190e2e1338c9f9b9fd6c24a64c5e8
SHA512 0721909f35f69647a889013cc9c635cd60207176d0ec028632b79dc57bbdf10cf067d00894d37f9b1dbf3250141e203ffd12d8c895666595bbb2251f479b71d1
SSDEEP 24576:VTcaLl3z0zD2IXWknY6QKTm55L3pnVIJ6ntSrM+SP:VTbLljkWkYSm557JVIJ6tSr6P
TLSH
T1E7150198B26058F8ED67853ECD515A06D6B27C1A4BB0CA1F03A436671F333A06D3DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 0f041d04867ea756f5aa6bea15d7a6d7fae0b90634924016d68814a3aaee1246
MD5 f5509b54cda3280184a4e7bd805b085b
SHA1 6a9a7fa72bcd75cde0fc83a563032df6815cc057
SHA512 95f55ce718bd55fac21a3e4ee40bd4116b6f434a61438af6b0aeb80dbe92d3333226def2ecdef318894b7ed0803e063b6574840e05a4a23caf33804fcd99a13e
SSDEEP 24576:w39dzCHvy7UJiIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:69dzCHvyIxWkYSm557JVIJ6tSr6P/
TLSH
T1C035CF90F3E414E8F1B78A3589725612DA767C5A5B70DE8F03A8261A1F337D19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 ccb0ad4386c9c03d528c067e75ec1dfcf518c20b3fc22cecc2590c4d0f01f81b
MD5 364a8d93befcde1ef1b091d07ff5fb04
SHA1 cff5210166f1840ce55782cdd8baff66a7302a35
SHA512 10e2cd28ca05441a04333b2744f3ecb36d0fb1309847271c3eb243f7bd5f0a796d6ec10753cb9ed94d1ed6fa3fa82d65bb8eac7f1ad36f1e8db909962e7041a1
SSDEEP 12288:AvIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:AvIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T1A0D423DCFC3889A4FFA18DBA4A522B129A307F2FCFE8D96D051922561F10294BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 bb39ef8fe1a2fd851935e146fdc6be81291eccbf92194215d80135086e76e378
MD5 917b23843007f5ef4d645ca385d7a43a
SHA1 e4df7af37dd9124affa7fca57ff6311a111c900f
SHA512 b35c917fb727415e31bcca9fd52d892c82ada3a79ca4c8d2e81fe17fabb0c7a0ba6fa5738dbeffa748b7e6d59322942b00459189718b6e0164d5deb0661b998e
SSDEEP 12288:YcIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP:YcIXWknY6QKTm55L3pnVIJ6ntSrM+SP
TLSH
T162D423DCFC3889A4FFA5CDBA4A522B025A303F2FCFE8DA69051922561F14294BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 79fc30ebe1e6a76fdb6d06eedab63ff491d060351d2aafcdf427fe94c4217cf2
MD5 d10db9acdab2334f782193508c49086a
SHA1 96663f0c730241fc80d596f6506b87c9c9c2e620
SHA512 2d44de0be1ef29ac1fc91a1e5810179f8065a1975e681d385d4a4c0bc78c8b99e52efef3e527b67e3acc7f61862d5b33ebbee483336e84fd8e07ae3c652f278c
SSDEEP 12288:LvhIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:LJIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T13AD423CCBC3889A4FFA1CDBA4E522B129A307F2FCEE8D96D051913561F14298B91DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 4e0adee7f6bd623e14e9ea6ebdb53bd479098d62a1147962cd0614cd106ed97b
MD5 71d2174924eecb49c9b5b06144679b97
SHA1 e5c557e02d6be090766d35112743fd6deace2519
SHA512 9e0bf699bde8dda29d881a1220989a978ab34fadc7eb45130b33b416424415f2569fe07fdfac3c55636a09773b49bd96c0733048624e0b13a88001fa844a0e28
SSDEEP 12288:8eYIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:8DIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T15AD423DCBC3889A4FFA1CDBA4E522B125A307F2FCEE8D96D091912561F10298BD1DDD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 5c1043049c147d6784ea0aa93d215070802b020e56efccc350942acc30bf7fb3
MD5 325a56f1ebabb02af6b4d9658c33c64b
SHA1 c4b414019b60f94eaadb4668940dba9736a4950b
SHA512 09e07d1f30bc6c86b7d3cdafb5a7c2af63814b5a3ff0ce955d9585fa1414cd3a3641a96c5fb21bfa153b0e642b61545de14e6e1c49ef855e00f38ce9c0375ffa
SSDEEP 12288:DC3fmIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:kmIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T134F40198D26841E8D6AE9579CB525B01B3337D268BE0D7CA12D0F17E0F35290ADEDB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 a127f0a4346e7117174c296fb86d3df4b2c2b2c929681c7fb43ceacab12bc992
MD5 c4fd20faad3537ab41229c43a88b916e
SHA1 42bd82bc569fcfa116f0f2f496db3cbd3fc9df9c
SHA512 6bbfc1b13d20e77be06433545c7e30d939de2fa9d8fec60ed18b175cefc4bacde6a8b42043f29f128aff4ecfb4de5e79e1eed0d2362002346b577f1351d22fda
SSDEEP 12288:jp7eIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:1eIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T14CD423D8EC288954FFF58DB909526B2166347F3F8FA4D9AB141523961E206C4FD3CE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0f3311dba61135353954a3882938edd39b523d6ab1cfc0c6f90cf1fbb1b5bdb
MD5 3db43be544d4768badd0ddcbf3574f14
SHA1 f27da8fd6f93b82263c6424af258fcd3bb36b4d2
SHA512 7961400904c2d093204600b278313f521462f7dabb7ecc82e75c72168f7d90b24dbb1588bc6cfc017acd88ff1cc288dc68d2007c0ab38d40d012fcbd4f124c4e
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYCIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:Bgb4mBIBhGF2WkYSm557JVIJ6tSr6P/
TLSH
T1D065AE1E22EC02F5E1FAD2B8CDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 d581865b06d57bf907284cbdd85467659f5ee811e24c7ee200421b459434f3b1
MD5 b45f370d06823462c20cc8a9f3cf3748
SHA1 3d46bced9c5f7a289a13efa6b8ee4851d39cafe8
SHA512 23f0dda744593c026c5520ff27594d5514e55aedc53c44eb2bd87ae5336b0b35e30b163209be466f77507fa268e81d2c8e63188a2c41ba478c6ee2bf2012d00c
SSDEEP 12288:PaGJpIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:yGnIXWknY6QKTm55L3pnVIJ6ntSrM+S3
TLSH
T145E423EC787564E4DF75CE7A48616B1375303A368F64A9FF04A4A2764F106E0BA3CD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 ae63e5895cf17c4ff5f51ab56fd13f7d38973714648bbb94c6f0a36fe13fb273
MD5 35f5c659be676d662bf82b413b829bc3
SHA1 12762190eb7c2d847c7501cafb8d8f7a72ffb317
SHA512 a9d30eba008e912d68bfc6cfe7230a7185fef2d348064b12751d3ca7b9392e36c95e9affff580c8fbbf794f11497658944fb6c7af4806daaa655febbb58f44a1
SSDEEP 12288:yyIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:yyIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T132D423D8B828C994FFB1CD7A09522B125B307B2B8FE89AEB041562560F152D4FD3CDD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f9c9aaf3a3a51e114f4571a7164643eecf2f4f85e4ee0ebe299ed1a6ec39e6f3
MD5 aa187dce09e83ba5d3f53c43ee0bfb77
SHA1 5aea13b778d30a77f2f93425516ec0b8e84a7c35
SHA512 220d78a282f417abe8e0767635375297ff47222979188079c752e577ca3daf25ba9d4e74e154172fa66d6340bc76c2b3da4e2e8c07f73e6be01faa43466a30cb
SSDEEP 24576:vU98H8FpJqH1Ezria7/mBIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:sycFPqVTa7/5WkYSm557JVIJ6tSr6P/
TLSH
T1D835F1A576E001F0D577D1388A824763F6B1B8260764EFDF06A88B551F236E45B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 9976ab43c960721fa7499fb3a128c5ee71b7e0167b68ed7be6244485b3fe6915
MD5 40dfc5eb392d733cfb5efe62c1ad2b04
SHA1 26ab32d247ad9d753338043a81439c4871594cf4
SHA512 4f2f46c72b63917a91d5495f5d746986546032d5805718802696fbc5ab50eb6e0f103454d8839d4d43a0fa61409a9e403e2cf836c5dcba82bef862681ae1d19f
SSDEEP 24576:9PUr+NQWIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:9JQnWkYSm557JVIJ6tSr6P/
TLSH
T1B605F16E65AC18E4FB76E17D89824719F771B8660751D6CF02A0817E0F23AE8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 9476bad5012b45950c68752360ce747e62242a0e7604e3642d2c81e7e4f24dc2
MD5 59440b183d44eee64cba9f0237d30003
SHA1 f2f0d81cd71ab4601fb22cc41b199adc2fc7f7f5
SHA512 c76bd422aa6e7ec3b02b0aa1ba6f7a158927970e40763acf9277544936a0ce5d1c7e3826f9bbcdc0bdf13a5d5855426e1434624a1019797b09ef13e2db96c620
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmWkYSm557JVIJ6tSa:mG05lO43bZWPJBSGP/
TLSH
T1DCD5BF6E62EC11F9D1BBD17CC9864A0BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1b35a92db128996bc9ed91adc7214083bc9280177a3f7b0c38e067c7005f4c04
MD5 7a27d6c724415a80db0718cc844f5cdb
SHA1 a98649843159f2f44b9cbc23f8f7abdcb65603c6
SHA512 4aed378129050384268181154558c5b7d2fcf6d156679bc6439fec943c6a38ee14dbb6e0a4bf7bbf89fcdd18beaa3b13a6a77a2a585f4fd1e8673508ac11128f
SSDEEP 24576:hma5POZ3dpbWVM50JicR2hG0lasx2+47eidnHsPxPX2aPccWlfhOuKVcQoxu:ca5POZ3wJt2pasx2+mqVmR76VEu
TLSH
T10F65BF5EA6FC01D5E5B9D17CC583461AF5B2342153319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 aaf408a1ac0e11640317330f61e16b3339dab8e3a3f5a6e988a12fa025e7a6f3
MD5 b93382a8bc747599e19e1811e2bd7a7b
SHA1 bff02bde0a486c73052092cc546093c80521d5dd
SHA512 f99d1209ffaf05a48aa689897478ffccaf71e1b2920d2a560daa73443f2294c8c20f1028fd20c154f544f2bf90fb503ac11d3af84b29c82c7af813f277df82fc
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkPIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:uNc/zEOVHF3WkYSm557JVIJ6tSr6P/
TLSH
T19A858C1622E901E4F5B7E1BE89779646FA71786517308ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 68fd04df466a627628e99ca73b273049979f450a2f922627c5f11498d018c2a0
MD5 8e084b1ce4471f524c8facc3c254689a
SHA1 15ffc370d74d5f3d226f845a589d232ce086804b
SHA512 3c91c18936f111212ff4a5e21aadfe702e1f67e6c9e8d733be71113bd0f87bcf1e7c1bf81029e0a6f23440654e8a76baea89657999e65f7262341784be4376e4
SSDEEP 24576:0JnJPbzB4SdIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:0JnJv6SAWkYSm557JVIJ6tSr6P/
TLSH
T1CA15D06CD2A810E8E4B7C2B4815A1B56FF31387D2F2569CB19B4D5353F12EE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 113ba6737ecd87937947f0a3dddf74f499cd2e9a9247b04c1d654db5908b6508
MD5 ff6fc65d19f5b8d60a3037a3284dce96
SHA1 af71211f973290851e9dbedb89f430bcc5f38838
SHA512 bd24cd3f8a195947c1b6f2cb7b2e524825d0e84b32b6d31502dfef4e6e1308a6da2ba958fb5cf85807799dc6b1ec3ac43fa2d3ad8248e9e7b6f9bbe09081ee9a
SSDEEP 24576:mCLHGL0MoeVtFumTijCmlKQWDkPsPxPX2aPccWlfhOuKVcQoxu:mCLHGeeV5ijCmlDWDkEVmR76VEu
TLSH
T139A56B05A7EB5184F8F3CAF5CA2294169A327C449B34F7EF4A80C96A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 6db5022a103ff6ad41cb4e878112955497f73f0d145cad4febe5f2c79f4b819e
MD5 cff0c008792bd7ea1f990673562b33c0
SHA1 2157a224960f11c043180d99a70c1ef5462b3835
SHA512 441242ffd0c7a0baaaac9a1bd92a7839a8e91fb55b394253fa4ec776aa254f0512cb8c04c041b6b65062baac4989eec86ffac2879febf79f2411a07c59aedc2d
SSDEEP 24576:86DISIXWknY6QKTm55L3pnVIJ6ntSrM+SP/:86DILWkYSm557JVIJ6tSr6P/
TLSH
T1E4F4019C737A10F5E2B7D03E86830602D271B5768B655ADF0694C1BA4FA3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 aa4a5d5b01703aef4a2cae5be3be3b04be10f38dafcdae7600f9e3dc5803de37
MD5 064f2fb70210b29df7f52ab3aa9aef3f
SHA1 f704989761f45094a9a6258e1760cc4ef3b165cf
SHA512 037eb871e4b5da2d1cf32dc54514ccf94c83b3b17be77a99e0004cea7a7c1af9f25fba811182369dc7a06fc1ee33c3c94844861d7582f0bad9e535ab8cccffae
SSDEEP 12288:vG6kypIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:etypIXWknY6QKTm55L3pnVIJ6ntSrM+e
TLSH
T17EF412886668A4D4FFB54A788A6343219B30BD258F6097EF0590A33E1F357D4BD38F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 79c0675ac0bf698b8bf49385002a62c2b86d65fab832ef4d0a32663302d0f86c
MD5 d08c1fc8dcb6cf6ba725bff45f739a02
SHA1 1bb2a71e6ceb48f7beeb9b7da08a4cccbcf66948
SHA512 87dfa0d81bc753ea6433a240f71dfba2df7c76e6953138fed3e7d816ed6958f1e6a841cd79237f931d3eb8362e8ac8dc907d27c19cdff9aa2d1caacdaa3a7d89
SSDEEP 12288:ZBBIHhQwX1+/wYnkn7rtn57k6QKT0/ZUA5LX3pnVIJLm6Q04Sj/sz+SP/:TBIXWknY6QKTm55L3pnVIJ6ntSrM+SP/
TLSH
T15FD423DCB838A5A4FFB1DD7A09221B1256307B3B8FA899EF146562760F142D4BD3CD81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 e7090fa4b1eb1c50be9e569dc0978b10339fbaaea040cb4342fcd15bae5607c0
MD5 999626d6f5253e1e660eee88931ec72e
SHA1 0bf0aee1556c996e584d34367238ea4a17ad66b3
SHA512 bfe3cb787a6ca56b7b3c9e5c2960e776b97e3f92b9b609b5d9dea575f3e83246a73d80068b4b20a5718c74203ad60dca6f55b6c7a955ef8e2f2e976321887463
SSDEEP 24576:NmgoLoTfaidZysPxPX2aPccWlfhOuKVcQoxu:sgnTrZPVmR76VEu
TLSH
T11C559D1D67EA05CAE2B2D679D8321493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 2d45a0b8a0c3c42f355e59be0c2d038c72c1f395ec925c0eb14fa297da741303
MD5 966c2a16d17203747ed794d43d2b3889
SHA1 c62d1c995ed38dc22f057616cbdd07e61aec2117
SHA512 bb54b58be37e9611d77d279676d94d15a9962cfb2943bf4dfd501633349388fa38bb7f577dbc41d9a590427f501fa04750e9b56f565c50d0ba62b24ccb778eee
SSDEEP 12288:qpJcm8CNDsPxPX2aLgkiBM/z4cqfuOpx24DTna3Q2xCPWPTWSakEQopzTw97:qrcmRDsPxPX2aPccWlfhOuKVcQoxu
TLSH
T1FB05F00EBA6E00E5E1B7C17C8C414549F6B370202322A3DF16A1C67E5E57BE97E39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 675dae2858b0041391bb815dd71081758ca5ae9e55d7e023078ae2d2e9e16b2e
MD5 78739016f76fd5dffcb7d2b183d5ef1d
SHA1 3c9b0c5a1486bb9e9627285a94838362cec1a404
SHA512 4f9af7d4fde1c5e912dd77b3ddd6c56ed69c572c9f6aae08fdcd672fb8e25fecd195ec449f48a166d8fe4b374675534cd3a9944336f4e1e8c0c22a0769ddf7ed
SSDEEP 49152:BDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3iVmR76VEu:y3Upow8sBTVm
TLSH
T1F3A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C178BF1BEF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-339-0x000001CAC21B0000-0x000001CAC2216000-memory.dmp

Download

memory/880-338-0x00007FF6BBB60000-0x00007FF6BBE80000-memory.dmp

Download

memory/880-340-0x000001CAC21B0000-0x000001CAC2216000-memory.dmp

Download

memory/880-344-0x000001CAC21B0000-0x000001CAC2216000-memory.dmp

Download

memory/880-346-0x00007FF6BBB60000-0x00007FF6BBE80000-memory.dmp

Download

memory/1132-359-0x0000024C50030000-0x0000024C50096000-memory.dmp

Download

memory/1132-360-0x00007FF600680000-0x00007FF600B51000-memory.dmp

Download

memory/1132-358-0x0000024C50030000-0x0000024C50096000-memory.dmp

Download

memory/1132-445-0x00007FF600680000-0x00007FF600B51000-memory.dmp

Download

memory/1340-50-0x000001E60A4E0000-0x000001E60A546000-memory.dmp

Download

memory/1340-45-0x000001E60A4E0000-0x000001E60A546000-memory.dmp

Download

memory/1340-44-0x000001E60A4E0000-0x000001E60A546000-memory.dmp

Download

memory/1340-52-0x00007FF72DF80000-0x00007FF72E0E8000-memory.dmp

Download

memory/1340-43-0x00007FF72DF80000-0x00007FF72E0E8000-memory.dmp

Download

memory/1524-284-0x000002C627040000-0x000002C6270A6000-memory.dmp

Download

memory/1524-282-0x00007FF7E1050000-0x00007FF7E1793000-memory.dmp

Download

memory/1524-283-0x000002C627040000-0x000002C6270A6000-memory.dmp

Download

memory/1524-366-0x00007FF7E1050000-0x00007FF7E1793000-memory.dmp

Download

memory/1736-369-0x0000019B7CDD0000-0x0000019B7CE36000-memory.dmp

Download

memory/1736-446-0x00007FF62BFA0000-0x00007FF62C4A7000-memory.dmp

Download

memory/1736-367-0x0000019B7CDD0000-0x0000019B7CE36000-memory.dmp

Download

memory/1736-368-0x00007FF62BFA0000-0x00007FF62C4A7000-memory.dmp

Download

memory/2388-232-0x00007FF7C91C0000-0x00007FF7C9288000-memory.dmp

Download

memory/2388-309-0x00007FF7C91C0000-0x00007FF7C9288000-memory.dmp

Download

memory/2388-233-0x000001A583980000-0x000001A5839E6000-memory.dmp

Download

memory/2388-234-0x000001A583980000-0x000001A5839E6000-memory.dmp

Download

memory/2616-439-0x00007FF6E5ED0000-0x00007FF6E6173000-memory.dmp

Download

memory/2616-322-0x000001237F7F0000-0x000001237F856000-memory.dmp

Download

memory/2616-320-0x00007FF6E5ED0000-0x00007FF6E6173000-memory.dmp

Download

memory/2616-321-0x000001237F7F0000-0x000001237F856000-memory.dmp

Download

memory/2760-389-0x0000021881300000-0x0000021881366000-memory.dmp

Download

memory/2760-387-0x00007FF6CA0F0000-0x00007FF6CA42F000-memory.dmp

Download

memory/2760-388-0x0000021881300000-0x0000021881366000-memory.dmp

Download

memory/2760-448-0x00007FF6CA0F0000-0x00007FF6CA42F000-memory.dmp

Download

memory/3076-2-0x000002419FB80000-0x000002419FBE6000-memory.dmp

Download

memory/3076-19-0x000002419FB80000-0x000002419FBE6000-memory.dmp

Download

memory/3076-3-0x000002419FB80000-0x000002419FBE6000-memory.dmp

Download

memory/3076-22-0x00007FF6DE020000-0x00007FF6DE17F000-memory.dmp

Download

memory/3076-1-0x000002419FB80000-0x000002419FBE6000-memory.dmp

Download

memory/3076-0-0x00007FF6DE020000-0x00007FF6DE17F000-memory.dmp

Download

memory/3396-349-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3396-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3396-276-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/3396-271-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/3512-379-0x0000024837490000-0x00000248374F6000-memory.dmp

Download

memory/3512-378-0x0000024837490000-0x00000248374F6000-memory.dmp

Download

memory/3512-377-0x00007FF6AAB10000-0x00007FF6AAC3F000-memory.dmp

Download

memory/3512-447-0x00007FF6AAB10000-0x00007FF6AAC3F000-memory.dmp

Download

memory/3524-401-0x00007FF7BCBC0000-0x00007FF7BCC73000-memory.dmp

Download

memory/3524-310-0x00007FF7BCBC0000-0x00007FF7BCC73000-memory.dmp

Download

memory/3524-311-0x000002B4ADC10000-0x000002B4ADC76000-memory.dmp

Download

memory/3524-312-0x000002B4ADC10000-0x000002B4ADC76000-memory.dmp

Download

memory/3696-386-0x00007FF670E50000-0x00007FF671266000-memory.dmp

Download

memory/3696-300-0x000001FCEF0E0000-0x000001FCEF146000-memory.dmp

Download

memory/3696-442-0x00007FF670E50000-0x00007FF671266000-memory.dmp

Download

memory/3696-440-0x000001FCEF0E0000-0x000001FCEF146000-memory.dmp

Download

memory/3696-299-0x00007FF670E50000-0x00007FF671266000-memory.dmp

Download

memory/3696-301-0x000001FCEF0E0000-0x000001FCEF146000-memory.dmp

Download

memory/3720-319-0x00007FF7C91C0000-0x00007FF7C9288000-memory.dmp

Download

memory/3720-244-0x0000013806700000-0x0000013806766000-memory.dmp

Download

memory/3720-243-0x0000013806700000-0x0000013806766000-memory.dmp

Download

memory/3720-241-0x00007FF7C91C0000-0x00007FF7C9288000-memory.dmp

Download

memory/4316-290-0x00007FF6C4A50000-0x00007FF6C4AFD000-memory.dmp

Download

memory/4316-291-0x00000138C95F0000-0x00000138C9656000-memory.dmp

Download

memory/4316-292-0x00000138C95F0000-0x00000138C9656000-memory.dmp

Download

memory/4316-373-0x00007FF6C4A50000-0x00007FF6C4AFD000-memory.dmp

Download

memory/4548-25-0x0000018356900000-0x0000018356A48000-memory.dmp

Download

memory/4548-28-0x0000018356B20000-0x0000018356B86000-memory.dmp

Download

memory/4548-26-0x0000018356B20000-0x0000018356B86000-memory.dmp

Download

memory/4548-27-0x0000018356B20000-0x0000018356B86000-memory.dmp

Download

memory/4600-444-0x00007FF7FF620000-0x00007FF7FF8AB000-memory.dmp

Download

memory/4600-350-0x00007FF7FF620000-0x00007FF7FF8AB000-memory.dmp

Download

memory/4600-351-0x0000024A199D0000-0x0000024A19A36000-memory.dmp

Download

memory/4600-352-0x0000024A199D0000-0x0000024A19A36000-memory.dmp

Download

memory/5028-55-0x000001C6CD220000-0x000001C6CD368000-memory.dmp

Download

memory/5028-56-0x000001C6CD490000-0x000001C6CD4F6000-memory.dmp

Download

memory/5028-57-0x000001C6CD490000-0x000001C6CD4F6000-memory.dmp

Download

memory/5336-250-0x0000020BAF030000-0x0000020BAF096000-memory.dmp

Download

memory/5336-249-0x00007FF6BC1D0000-0x00007FF6BC2E9000-memory.dmp

Download

memory/5336-251-0x0000020BAF030000-0x0000020BAF096000-memory.dmp

Download

memory/5336-328-0x00007FF6BC1D0000-0x00007FF6BC2E9000-memory.dmp

Download

memory/5540-61-0x00007FF7E4870000-0x00007FF7E4992000-memory.dmp

Download

memory/5540-12-0x000001E92BE00000-0x000001E92BE66000-memory.dmp

Download

memory/5540-13-0x000001E92BE00000-0x000001E92BE66000-memory.dmp

Download

memory/5540-14-0x000001E92BE00000-0x000001E92BE66000-memory.dmp

Download

memory/5540-11-0x00007FF7E4870000-0x00007FF7E4992000-memory.dmp

Download

memory/5604-261-0x00007FF739D00000-0x00007FF739E49000-memory.dmp

Download

memory/5604-263-0x0000022328530000-0x0000022328596000-memory.dmp

Download

memory/5604-264-0x0000022328530000-0x0000022328596000-memory.dmp

Download

memory/5604-337-0x00007FF739D00000-0x00007FF739E49000-memory.dmp

Download

memory/5848-35-0x0000018298150000-0x00000182981B6000-memory.dmp

Download

memory/5848-37-0x0000018298150000-0x00000182981B6000-memory.dmp

Download

memory/5848-36-0x0000018298150000-0x00000182981B6000-memory.dmp

Download

memory/5848-34-0x0000018298000000-0x0000018298148000-memory.dmp

Download

memory/6140-330-0x0000022A10D50000-0x0000022A10DB6000-memory.dmp

Download

memory/6140-443-0x00007FF7448D0000-0x00007FF744A64000-memory.dmp

Download

memory/6140-329-0x00007FF7448D0000-0x00007FF744A64000-memory.dmp

Download

memory/6140-331-0x0000022A10D50000-0x0000022A10DB6000-memory.dmp

Download