532d15b9bb50d2e3648af79d7bf93dcbbe00d63231be3e04f1755df7639564b6

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260714-ds69hsds4p
SHA256 532d15b9bb50d2e3648af79d7bf93dcbbe00d63231be3e04f1755df7639564b6
MD5 ad65a6dcd4fa522aae8388fc749f3cfb
SHA1 92502102c7dc34523ae21b392a348d51fe01f799
SHA512 738bd21f8fc7718064a2748e365432161ead8d06f3fc0a2596098ee58a16e7467e2255e6b616adb7259a84578c95d9b003002f7c254d447341b94e940c2f1c9d
SSDEEP 24576:YhfDc6X3lQMnxr4cQFTj0OZeVJIS0rA1V389Xuls1XTSv58s4Zwcu:Tul1nqcQFTIOZe1V38BXTSl4Z
TLSH
T17145F01ABEF1C032C1235230CD6ED358A1B5B4B258264847BBDD671D2FB05D3972ABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
6004	alg.exe
5072	elevation_service.exe
5484	elevation_service.exe
3308	maintenanceservice.exe
4768	OSE.EXE
4712	GameInputSvc.exe
4332	GameInputSvc.exe
2108	msdtc.exe
5548	PerceptionSimulationService.exe
5288	perfhost.exe
5268	ReFsDedupSvc.exe
4444	locator.exe
2948	SensorDataService.exe
5828	snmptrap.exe
2800	ssh-agent.exe
5076	TieringEngineService.exe
2760	AgentService.exe
1336	vds.exe
2400	vssvc.exe
3176	wbengine.exe
1604	WmiApSrv.exe
1964	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3de803da238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4332	GameInputSvc.exe
4332	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4380	2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	6004	alg.exe
Token: SeDebugPrivilege	6004	alg.exe
Token: SeTakeOwnershipPrivilege	5072	elevation_service.exe
Token: SeTcbPrivilege	4712	GameInputSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5268	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	TieringEngineService.exe
Token: SeManageVolumePrivilege	5076	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2760	AgentService.exe
Token: SeBackupPrivilege	2400	vssvc.exe
Token: SeRestorePrivilege	2400	vssvc.exe
Token: SeAuditPrivilege	2400	vssvc.exe
Token: SeBackupPrivilege	3176	wbengine.exe
Token: SeRestorePrivilege	3176	wbengine.exe
Token: SeSecurityPrivilege	3176	wbengine.exe
Token: 33	1964	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1964	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1964	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4332	4712	GameInputSvc.exe	94

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_ad65a6dcd4fa522aae8388fc749f3cfb_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5484

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4332

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2108

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5288

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4444

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2948

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5828

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2760

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2400

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1604

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3f95a0aab76ae7124d6b69f45937702b1635388342d8a106f29639978719375a
MD5 ad4939bdd7568a9fad10b379c1e7b749
SHA1 49075926c8bee6e59002f661ad5c956b98ce1e22
SHA512 a3ba8c9a9c7730ff8529f70a98fe5d1931d1a0d4221a4ac7089d6414f7c54b6843ec4de1b27a91d75e3e344f80b3a0d3afe68f4b01de294213d8aa45bf1ebc25
SSDEEP 49152:yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnjV38BXTSl4Z:U3q6gjB2ONT
TLSH
T1B0D59D03F2D900E9E06AD178D74A9133E9A2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b102ad4b7ac412f18c16293e449da0a23afb7076269ca68f67098660682dc6af
MD5 4b5e61e46b25c4b4e5981110c24b78b2
SHA1 fe4e4bf752b0c1219f2a8745b01b54c23191b329
SHA512 6aeb1ae844ed75faf8eb00fc06f51ff7a8c82fe450bc1a3a6c2c2d5eb698368c2904fcb8e4b368eb15aed2eabba266d61242e50316cd2357739bac8e9d85ef96
SSDEEP 24576:xXYSFtczADS0rA1V389Xuls1XTSv58s4Zwcu:Btc1V38BXTSl4Z
TLSH
T15005012977E408FAED67C27CC8A68502E633784143B0F78B03A499255F237D96E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fa72dbb702d39fb959ea15d964f5b301f4283c2d89726f533dd336dfec3ab90e
MD5 b4f2892badefa23df538f149b2747733
SHA1 d03214af9e0b5f0a28878dba0e8897a913bf2192
SHA512 8290064ea64e188ffb8be789005a65987895db834e51df17e24f865e36ac6b4651f4efcfaa613ac0c81465bf11ee3ec97263e4f0f6f3a8a23e2dbd521a7f2b28
SSDEEP 24576:E03elSI0y3xOrMvS0rA1V389Xuls1XTSv58s4Zwcu:ELSI0go5V38BXTSl4Z
TLSH
T19B45AE56F6788335D073C0B9C5D2A68AE971308257308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9f84ee3095a4ae0bd5aee6a6d8809f5796722bcc7f18969a7c7a0ec6dec30105
MD5 96c2179255e7b06d5a798682d7313b00
SHA1 e17e7b5e5a79314889c271b33b2f029410b16729
SHA512 b8d2230e01dc8d14ee93e85bc1ed3feb1a53047d606880842aa5b838624de7b2e6f16db2dc75045f0a6e4f74f05ddcedad4859cb513fca1564b19f1f9052af8e
SSDEEP 24576:xAZ/ezSC6vUyD/aqgrvW/6q8wyu0S0rA1V389Xuls1XTSv58s4Zwcu:I/ezSC6vUzPvuHjycV38BXTSl4Z
TLSH
T1BF756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 4cb0bcc89cba06e85aba70038475857595da1ba798a2e92f2321124bb7b7f948
MD5 ac5f32e4c0e448d70602f7542189c519
SHA1 2c70320eb87b5424e0d0a92054c6e9e9f0ffda5f
SHA512 2f8d06d86f31e377f7cf61a88dc5ce6075c61cce69f65487d46c9df1d0f1f0ce6bcec277c7b4c973c218240afbfae3580280d5d1c23f782de07b0eed112d48fd
SSDEEP 24576:tabiPFFytv/l+dBS0rA1V389Xuls1XTSv58s4Zwcu:taYFytXl+uV38BXTSl4Z
TLSH
T13F559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 5a6766e59c0fef649f676e45124f7ef7eb0d30ad4c1b2ee9467e74470217b356
MD5 b00b8c4bf7cb44ff9b7b6a29096abfcb
SHA1 1478941c2aba36508f75c170600662a58a9c5530
SHA512 2bcf31b47202cee3120b314bb9bc2717164c3568651c77332f78e2c4b81d0637a2fae44a720e65dac09d68fb8079816f20a790f58ad2b9b0b00ad9bdcf7f9981
SSDEEP 12288:AiucS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:AiNS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1D6D423C36EAD00F7E36BFFB8C56E0543A0717C0273B5B80A5116B9589F52997A28371E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 a6cc1c07e056ed6daa3ce54a47168b20da72ed2dddfeaab484e9ee0d22007f22
MD5 332aa4f1c29bc592d3adaced9d2870af
SHA1 f76caad41a435daacf492b8dc34aef2ab1f73c7c
SHA512 c3eeeec279bd988ce5452c284c065a0a5240512c25208cc51fbe5aa88d0530c12eb7b1558f39a2de4951fd3e72b66db586f4a7e1865265989d035337718ecbb7
SSDEEP 12288:geBNUbTVO86UVcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:gJIUiS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T16E15D07BEE28FCE2C27E9DB856918600D77278304B62A3CBD165C20EDE135E15E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 15b1d3b817e8b99f804f603508d2bebbf4edb7c84cb1d9a35bf14216121be438
MD5 1b89923f4372d696cedd8fd373efeced
SHA1 6b03f0fe224c766540fbdeab497d13fc748b594a
SHA512 6e71b851a62bdf06da8e243df0ebe03f0f5b662b447f924bb324acba5dcd8cc1b997fcf1b9656dbe28f318601deef31b63baf5b3763223fd7a4772f3b389e57c
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJJ9DN5JONRV3TH+:nQvGAdlCEL8c/JRNa5C0ONT
TLSH
T195367C656BF880F5E0A7E178C97A85B2F7B678021D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 0ddb33cdcceaa06821f805b0e1ed3aa5cbc39eb1e015703724102eed3306688c
MD5 f3bf0dca2b87c59c2822be0c2a04935c
SHA1 fc2ad1793b2b04194880f9986cc4f4e0687f22ed
SHA512 f34330ce50730d48039e7fdae92a6f9603c1887f7445b7f26b4e2e33939105ac9802d95f9cc4a976aeba484c7a5dd08505b7645e197725384c3b8416cbaa2231
SSDEEP 24576:hmewsAjF9S0rA1V389Xuls1XTSv58s4Zwcu:EljOV38BXTSl4Z
TLSH
T18B15E032FE74D036C37B0DB65B3AC716547D79204B6129C3E3A89E9D5A202D22376B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 05705e73c88835bdfb60362faf755e1dbaa25865f662b1631dc1c227b6097731
MD5 ad980988a4f13c9a0404f02597193149
SHA1 807ad32ef47f5741ea05dc76c809b839b6aa6dae
SHA512 ee6d7bb52341fd0a50f5547ae4f99428582523baf48074bb1439936df114daabee96afe9e63a24a8741199a65f5fb627a9b86cdbab2b45e72ee1dff871f05b46
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHYNT:lUEtQevvqc2W1cpV2XF32Y
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3771e09d6f26681fd7b38d83022dc7b7908ff0e45173c420b86e2aa5f7d262a5
MD5 1a6a4393c661a84243b903363fae495d
SHA1 10cbeb01f0f584363bdc533928a26dd7fab35367
SHA512 0b080ba6fb4053e082c6561736ffa97122315a2b4860eff3fdbf928aa9d53f210361ad11a15dbe754e70626b002f599e1109dbfce004c3453bef1ba80aed71e5
SSDEEP 49152:OXbRquA/m2yL5zMfFiV+XenmE3/zLV38BXTSl4Z:8oq1VjnmSONT
TLSH
T190D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ad0ba959a6f6c925f381e3223bda76eded31fa711c49534209d034efa60c8be8
MD5 3019505ffa706ebdaba05f2e9c1186ab
SHA1 68325d23eca7f5f19ed036e7223bd9b0c468015c
SHA512 36decde26712cf84d368db22a56e66d5c13bda7c920f68b61a27f03f664e9e68bba08e1ef2e9c7dec4f508e3054be7ee1b7c7e5884d41823115fa6925caa0344
SSDEEP 24576:RAhGLv8FoiwtA5l7S537RS0rA1V389Xuls1XTSv58s4Zwcu:RAMYFoiq5EV38BXTSl4Z
TLSH
T19045AE81EBF945D4F5B3AAB899BA8171E976BCA65E31D20F2150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 2500ba6254a08a0832c92d3c3924d68152260d10e48194ae11a5ef3f3944e750
MD5 af4d460828e77b102a9b32d948571b6e
SHA1 ce41e1cb0b06f415f104f928ed3d916ceea43e87
SHA512 ed02f1bd40ce9d5252ae95a124af9b1c4414000610eddb7b95f3c763ec11385459ddfa959042b56c3dfc7be7f894a62794cf0a0adf55f3b86240e3c4a9d8a5ec
SSDEEP 24576:uwuuOWXS0rA1V389Xuls1XTSv58s4Zwcu:uwVOvV38BXTSl4Z
TLSH
T10105F14676A90CF9E6679639C55B8132F7F2BC023731DB1F1360C65B5F232626D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 319f85704ada90dfcc977cc2330ef36c8a003c265379446c483944500bf47001
MD5 2f80221b44e060d7bb3e53ae8cea5558
SHA1 418a60edff1af7ccc6f881ee70799c8e22ee2082
SHA512 55308477415055dc9a93eaaca288a7f8b039e95562fec7bdd568d5d0ab8d2aa7a1cb648bedd9932f0a09b7e46805cf1864eb71807c5ff317229e8db405b8405f
SSDEEP 12288:lVJ1IWlcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:bJu9S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1DBE4128736E810FAE2A7E67CC8ED0542D37278123376A3CF112552695F13AC76E36726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 dace945e046741917ce88d3328fe259023273fbfafebbaa14ad908b6aa05f483
MD5 3234bde2c3209f0465780bd4d2b4c063
SHA1 aceb84090cdd7a2556541183b75e7579d13bdb77
SHA512 ccebe44ed124033c2eb8cfe06cc3dfef507101967eac4cd0675c80e6b72017b6b18028735670c51f61738868fdb6b73df9f9b33e7c64513eb1ad374893b000fd
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uh:rQRQyi36YOcP8Lvw2gAf+PN32ONT
TLSH
T113667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3dd9b696729ad292d7f9ef8913cc8e5716caf5baa0790db08ed3c555eebc8574
MD5 6db77f48e900d473e9196e7fb01b8b2d
SHA1 16a7e95f11428d27d841eccf5bd6a98256374783
SHA512 a0c6b12229dde5482aca35276f66b2bb52223e3d0c7d1ceae936b0abe6d09254aaf200647111011a7c9f5ffe3e4a7d12bee28bbf2b64678cda8f8130b6586d87
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UX:rQRQyi36YOcP8Lvw2gAf+PN3EONT
TLSH
T124667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 289bc65d2cc41e42569ac040b784cf4e475f5916e72aeb526115383d210ded59
MD5 14fb26e0bd1940e05c620047a2b006b7
SHA1 3712331e9bdda662b1621cfc1df65aece84ce187
SHA512 a84cc907152cc483182cae3913597199f69d69e53b1b1e6ef82ab3231c49b26368d0cc781958cf5365b84ce1365b2a3d977bfb89cbfa1b07930f01f4b8e1558d
SSDEEP 24576:ewvD8f6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0zS0rA1V389Xulsk:868Qg55nhMeWu7PNU3/tV38BXTSl4Z
TLSH
T11DB55A33B2F600A9C44DE1769F4A872196E17C718FE1E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e1f7c83cefb5a5e425f3c0ff814b04ad5d80043d3bf1d55a01babe93f0372b38
MD5 7f6d121204b41e2c7ff97046f37d5677
SHA1 9b719bd30136a5ba9e431723ea8b3fd8f2f271bc
SHA512 58e4f3416816c1d07513749c21befed54404516a0d4315f78cf870ecae59b1b14ffb4311ff6746d1d32617e8c4d90292464fbad64e654827867f9a1403351db9
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99i:vy5112gYy5azzVv569nLKnhZsONT
TLSH
T168167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e2b0d44f40f6c67ac6174e1a876c9c07cb29d2e1a6ef08305b47d71ae19c22bd
MD5 34846564a0c9e680d6be1a9d977f585a
SHA1 2d8bc6b05b952886d796cecbe5f29b3ef3dcff87
SHA512 231ebdfdd1c0b0d6beb38824919fa2abdba285d842d3761eceaa93a68b6ed1cb603cf11b998a6655fc9eac895f76985d4c7d723c6f0e60eebbeced7b5a048441
SSDEEP 49152:fB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6V38BXTSl4Z:hu6JmTxd2d6ONT
TLSH
T1B0D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 77b0f36387b28d3e93714fd6c91312944615aa450bc7781eb795d687b843122e
MD5 939184c9811f743716707202a35484fc
SHA1 3d3ba49a867c07f6a97e32e2a123e4e13bc68a98
SHA512 78e477b3284a96ad7a97520cc26c19b26bd50172a159592c138d94ba9a55bf83c72201faef83df6f0c0988d0fe2ac59474e370a6ab9ba5468c4f12035c00a248
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xeuoV38BXTSl4Z:SmifPbREoONT
TLSH
T19CB5AE13F2D900E8D05ED178875A9232EA72BC460B35B6DF0A90B7961F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8b49c2f9574f8acb259d479bc82e3d1c845638209e52c8f4c63db8e6f2af941a
MD5 4d3c09a5d26d287abd1ef95e8a103ac4
SHA1 36ce7f0f882bb1ae721d5a4aacf8dde08f267619
SHA512 c457eae4251012ce76fd64e169040c6eacb6a18610488163c54912cbe1be4410deeaad9a30da079575ad887ba69116fac92f545a108c28955acebd4a3b3c977b
SSDEEP 49152:ySuZQIY0Be2K6RVtOnks6NMHq9V38BXTSl4Z:s5dKoi619ONT
TLSH
T119C5AE03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ed983a5b6758d162f19f3c636aa2f85459851da0f23328caaae1df1f7cc8c27c
MD5 bda10039affa2a925678615de33251a8
SHA1 70eaca7d8d3334b49a118a62d53e34255d1b50d2
SHA512 e7b24237d9cfa4e7640336db860f0c892a75b29f6d1fc950f47999d919b65203d1efac8f144720113c83e114da0086e328af39102bda218dca651877077a94c6
SSDEEP 49152:oJXSn8EApI0figTgiDn0AP5wCV38BXTSl4Z:TX2iyphxONT
TLSH
T174A5BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 5f8db42c6b1ac052deb63680da1e3407edc694f3f7b9678e1e328f118587ffa9
MD5 f9f6ff782fec74dc600885e12ae0a28f
SHA1 0a099cb604a96b305dd0eeb82f8da6c7eb26a77d
SHA512 b35e4d309f5ddb6fc373cf7f8df06dc0dc5d07b96803b407dd4ab88da66eccbefb39bd80d2b461b46451a3c48c0cc2a743c2dcc9f14bf31443bb28bb20441e80
SSDEEP 12288:qrcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:qIS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1CAD423836DAE04FBE317FBB9C56E0593A0753D0373B6B40A621A7414AF42D9B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 ec8dec84ed71a43f2a66f781795d7a0e0af2f8fcc8c692d352feb25d6dc13958
MD5 84907c7f9061b4276c282723bf63a72e
SHA1 4bf75bb3c9de10cc408534c6b7f81029421754ad
SHA512 8ca7a7da103b39d4ea4f33066ccff6ae249b9298277ba7ec86ee9515cafd28baaac909b292c2ee4b6e40230b26e807deb9bc3b3951fa8caa31a86812899531e0
SSDEEP 12288:oBcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:omS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T125D423837DAE04FBE317FBB9C56E058390757D0373B6B40A621AB414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 5dcdc1894f7b769b00c9f49de46242294f534a0cc82019a6ec3f47edd371a374
MD5 37a77143fdef8ef903fe31200ddf9275
SHA1 890e97f4429a86c52a067562a707877853753b2e
SHA512 ae6f0c774a49e86e7ffb8077a78bbc8730e404c2b837f1c95e9139a357ca31aac2a604746f0d47ba419fb0e02e036337c792d07698b73eb4200fbb2c60d9cecf
SSDEEP 12288:+pcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:+uS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1CFD423C37DAE04EBE317FBB9C56E058390757C0373B6B40AA15AB414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 89f08b3b5bd3ade029947621edc00ef2cecc0010fd30afb0152d5179ce9853d5
MD5 0c64bc230d1a9c89e72e61c58aadb46e
SHA1 67dacaca112276fa230110b2a082199b850b3a33
SHA512 4528aa143fd9c4e7b6baabf08ef8b56e0fc6de46c5b095a5983c1cec872219448db199f7e9b0dda0cc5dedd447b65f67f7b11e15b98e893fcdc4be3cf20b1409
SSDEEP 12288:0lBcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:dS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T104D423833EAE00E7E367FBB8C96E0153E1B17C12B372B60F920564595F52B972642B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 d0a745f150fcba71ca77358271cce05a4034ef7ecf78cdc9de91f6607fac8e9e
MD5 3297d0246b1ec146443a0bd39639c096
SHA1 a00241c9d5ffb72f54b40aa41d546a55e4a9f4e0
SHA512 9be40264048c03b01dc46476157607d456805ee9d38fa6f32700ca369be7e2763d7e177af59d123645e04bc357bbc5c0cb65514bf177a258157cc9a1bf016a39
SSDEEP 12288:dkcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:dbS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T11CD423C37DAE04EBE317FBB9C56E059390753C0373B6B40A611AB414AF4299B228775D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 852da4005197c8b7da01c328532275322c69c5fc645f2d8b97bb918aa057d50d
MD5 c0c7d1de15720a58c2289ebe8defbbf0
SHA1 139822bdbc6a4f4095782e6c05b5ea1eab3406a2
SHA512 9ccf441b1997406a4b529e5fa8aad94d5ff2d9dc24169840bc88e3c9b9c5d2989c751370b8ee6b4777ff4bfc49779cd280ea780840d30d6e6786ffafae1f7ad2
SSDEEP 12288:OBcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:OmS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T17BD423C37DAE04EBE317FBB9C56E018390757D0373B6B40A625AB414AF4299B228771D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 bb0766edfc8c5f09febb017d8fbfa2f7a8c5018585822e9d4b4a14b39e66d50a
MD5 0a29bdaab66c9609ec529f2d98d58273
SHA1 b9719e2b93c1ac5de3d5c68d9b3f36f4b0803ed0
SHA512 b2b982c0924fb299feafedfb92471e558823539dcf91c0e666e03de66d5f9840624f0dfb0cdc0b61804e5438d81a383e52e1028b24f530e32a310212a79988f2
SSDEEP 12288:f2cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:f1S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1FAD423C37DAE04EBE317FBB9C56E059390757D0373B6B40A611AB414AF42997228371D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 ba92ae02d4488ea6c693f3bd44f21496bf9927537227a8079e505172d0611394
MD5 98bf65b6a0a1cd0fc7d42207b32b7145
SHA1 a0d37b195e2f090464be66fc20d010a22b6632c7
SHA512 4d0523dbef5d09aed91a6d20086e3103855fe8b2d1c8cd2a57bb646cf23cc3c6a248b79507fe3ffbd91be5fb137ad18320a20e5f57df73fe1af0bf37a1d8ba6c
SSDEEP 24576:RZM7zFsSnYUS0rA1V389Xuls1XTSv58s4Zwcu:RZM7zm/ZV38BXTSl4Z
TLSH
T1E7150296B39408F9ED67C23ECD294906D2B27C161770D60F13A436265F337A21D2EF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 ad540352b1fad18b6204ce27da9f095ff422687ff2d49f7685c37f45e23ddac7
MD5 326c23d45c8c7de28357f4a757188856
SHA1 a74ae4615198b239211eeb8ad669dec8b473b42c
SHA512 114e46c9f2de95397dbbe34daa2d79b076bbae029e5cd352f685cf5f4543ca0e5d54f004d37766c9a2f1880896adb4b3a3e34c86e1ba9024f1290fbb8f761b65
SSDEEP 12288:OqcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:OBS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1ACD423C37DAE04EBE317FBB9C56E058390753C0373B6B40AA15AB414AF4299B228771D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 da46ef3cb1a273b7d412ba1edb34faba938c0d723fbd32ba77acaea69bb158cd
MD5 6a76b85ad5ce81cfe355deda7910f11e
SHA1 36f5ac60e6fe2bb78f223909f1218aabf6f37d3b
SHA512 88278acb08f9a1b3edbe0a715a6d90321ca98d0d016cc735f2103e2467f48662528e5e169b9c0914329f605bc50fe21d1acf632f6f9b7da14da00e61f5f30425
SSDEEP 12288:YwcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:Y/S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1B1D423C37DAE04EBE317FBB9C56E058390757D0373B6B40A611AB414AF4299B228771D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 739e4cba22bdfa5fd561ec58a097bdd55fd973e71043f5c61c13d943714d35ba
MD5 a8968919c0046ddbedaae59b3771475d
SHA1 b9e674aec28fa849c7b88f280979f5df80f83685
SHA512 682f31aa18c0de800f790e92b3f710cd27d82ddf2b62e12282015f3d4bdb066a29758041b5cbb28e240957ada45ba7b8e650e2726c2116c894cb2e27d74a4222
SSDEEP 12288:waPz5LuvcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:tzUkS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T194F4124377A520FAD277D278C86A0A03F37178322770EE1F536456766F136926E2BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 1b2e723a53b46185675e4e10f0c9d41dc9a0e780130d283e3facdbacf8214461
MD5 82ed729aedaed53d5300f04f8c19a032
SHA1 507d3dc21435b59e9147b8a15401da1d1f756fc1
SHA512 6eefcf08e9687b85953c20c50268d7a18f7cefcf634d57fb006ff3fc108364189ec5d0b9a969754d3e22d788d118255f51bcab6856477090fef2543a246a2136
SSDEEP 12288:eGcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:eFS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T186D423C37DAE04EBE317FBB9C56E058390757D0373B6B40AA10AB414AF42997228775D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 b1a026382fb41a4f19b03856d32cf2270a32cb0d1993be2e4acc294eaf2933aa
MD5 10be6f3457c6879d0d387fb0663c93f4
SHA1 06c381555e90160ce2e78e8c91d0d19cf0243a87
SHA512 6f6597494256214515932ec99fb9a9d787389ca64bae5aaf0a1c3b8164c2fd5e81a03a994fab3acd74e08c13516f9da733ce23445758a9a8d447665be911f75f
SSDEEP 12288:GCcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:GZS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1F4D423C37DAE04EBE317FAB9C96E058390753D0373B6B40AA14A7414AF42D9B228775D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 373083be879496b678920df3232bf4ffad5d0ba0ff682c97c48d12efdc5dff27
MD5 59b60f50a9c5b373cf8fd9d85afa07cb
SHA1 606ddf15013df5a6d69415689ad51a0e8d8119ed
SHA512 f0d7980fe3a98929ea911198d0c9e214a23a1677b9d990ec457a2f2ba7b04ae4acef211d7ef0582c7a3a47c4b544cd01d68faac5e75e60812ae0e00d49238d83
SSDEEP 12288:taPz5LuccS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:szUTS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T120F4124377A520FAD237D278C86A0A03F3717C322771AE1F536456762F136926E6BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 be7333aa02c009071f77628533ce3a1f74344475e96f7a0fe474b7f9bfb46b6a
MD5 45f1beb54954b9d95c970cad996edb72
SHA1 da107b53bba342da3d2d54905766e17cda4e887b
SHA512 497c0f70749d2673b80f954e48fcdefc30c79fc5db592c3df22c8070a52ff204190fc36408848b8ba0901e57e0b4eacf9da63fa869fa003fe1fa193618ecb4bf
SSDEEP 24576:sTOaLr3z0zEMS0rA1V389Xuls1XTSv58s4Zwcu:sT9LrjzV38BXTSl4Z
TLSH
T1CF150296B39008F9ED67C67ECC294906D2B27C161770D61F03A836665F333A21D2EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 a507f7ce25c443fbe3567b9f46c708a9bf0d89872d1649c42b95ac3331fe2bf8
MD5 79f5e102bd27ca18e661d1831d442ace
SHA1 2602bc0b3e7e1cdd2ab1d50a629654e71ebde7e4
SHA512 30c154e9c62803dc6d78be95e6c1b86e44455a8ebe1a0f5260901b72ef0329a3cff6519dd068c3cf97feb31fe71f91d9119d23a1dffef22176a8387e69d45349
SSDEEP 24576:i3odmCHTy7O+bS0rA1V389Xuls1XTSv58s4Zwcu:EodmCHTyKfV38BXTSl4Z
TLSH
T16E35CF91F3E800E9F1B7DA35C9764512DAB67C5A1B31DA8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 0cadc1462484f2124b162178aa01663af0c3b078a89f62cf2a08a3f98c78e2a6
MD5 10dba4635fee913a3ef57162c9c19f86
SHA1 01eca5821375981bfe37629fb0b3d2830507b5fc
SHA512 7193b2f3d8dbb35467d2816c0db63dd25eb496359e6a60c34e07ac4f6e5485b27ef166e2c3463f90d666b796762eb660449a3f8a09b45f3975cca16d6a2aecee
SSDEEP 12288:cLcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:coS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T190D423C37DAE04EBE317FBB9C56E019390757D03B3B6B40AA11AB414AF42997228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 d7e0009d12775907c229ce8f437c6106f6df0470a09c9b2b8f462472c50ffd8d
MD5 a58f5f07fab0b143b366dd603b68b012
SHA1 f53f0fa2279481b061feb065a610f9c0d16b4e70
SHA512 e07ebf8fccc428ce9f994c23e55611df661f6ca20a138bded794fcee7d1e4c8e2ff9c063b300241d4b78ce739fb6d8e893e4a62f428140e0d251144577e4045f
SSDEEP 12288:cI7cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:cpS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T133D423C36DAE04FBE31AFAF9C56E058390757D0373B6B40A625A7414AF4299B228371D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 eecf93974bae1301d69e27940c77b8145b744cee0a14c7b640750f6b8e0e3e2e
MD5 259f461e6a5742540ebb513c50a4b837
SHA1 0d4dd54e37b38ee75401a9ac741d16dcdb5ae791
SHA512 52b96ed3b6a97841cefd382a98faee53af81386a9680f15ec1635274917b7fe6343d86a471dbfd9ecef04a7062a6785896deb0945bcbfcdfbb6734d03dd56b5f
SSDEEP 12288:fFccS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:fpS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T108D423C37DAE04EBE31AFBB9C56E059390753C0373B6B40AA10A7414AF42D9B228775D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 02fe4a5e2cc9e6ce07cd23f73f454d784567dc3a781101fc0f83cd77afd04e5f
MD5 2fc507b9dd067dea3cff4f4f501a0de2
SHA1 68e9b2d0839ef2e6fc8eb80c8bb6e12471604e3d
SHA512 1136cb37f6bcd97abc7f71c8e45ab9d16ab46b1c3345b32cac06622bfa2bd103e6e53eed193e038590e090a0348346908ec231f518e25a3620cd1d953902f68e
SSDEEP 12288:ArLcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:A8S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1C7D423C37DAE04FBE317EAB9C56E058390757D0373B6B40AA11AB414AF4299B228375D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c7476783eb5322a0888c316c49bffa47555f6f73d9221b00411607985ff60cd1
MD5 5caf2fa907fbe395cce53dd3a199cd08
SHA1 52ebf44f629dd1284c5a612114f456bc5f308f33
SHA512 a8ddce30741de81815105d8a151ce51a1ad6d015e234fe4069f07f5c17104ac32e8d15a477c6d8c24c8698ab4ff6b9046d0bd25c0ca8200da4ebfafaa89bf715
SSDEEP 12288:rKsf5cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:1+S0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T144F40146D29800E9D16EA279C75A0642F3337C22A3F1E38B52D0F53E1F766916EDA707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 9aec983cfe2944511125b5d2d1080f880f79f69f3791ff2c3ba110ef73c96b6b
MD5 cab1797fb4e444b242763d9e2036b015
SHA1 e0aa512e660eec12053c8ffa0606482a4e152af9
SHA512 a8c76948a2acab02e54c1e66ea2df3158d23092b636b3f9453b20e81de746322d18db7f709717e555386d3e4ade5cd1f0a34729b997ffdd63d4b7c6d72c759b2
SSDEEP 12288:RR7vcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:XkS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T19BD42383AAAD08E7F33BFBB8C46E0113603979127771F40BA1057554AF52DD76A82B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 64ae2c03783d186c1a9d7ac603b900b8d15390f2aa0093705a6e08b9b1f1b6a1
MD5 9503d52571bb5b0e81c03e2f8c3c6cab
SHA1 59acf48f8bb59efc4fdca0dc4a8bf250d4731506
SHA512 8b625523c6fb692eb0cb27b262d44861d5c4cbb87976678b8195f923fc28617944822a4893eff6f5ad4263790acc7267d1624d7032a5d6ef2ed201026005f61e
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYrS0rA1V389Xuls1XTSv58s4Zwcu:Sgb4mBIBhGFXV38BXTSl4Z
TLSH
T12865AE1E22EC01F5E1FAE2B8CDAA4417D6B278161731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 68d95cb1b159e0cbf422bf28ca06bc99f367a1246fde86be7f5a920af150468f
MD5 b7946928093d54bfbc4fa6d84e237aca
SHA1 eef123187ee104bb5ae0d67e04563072ed6865a3
SHA512 5ee816b5838ae21b2257c342e465707cff9427e94ea7d6cdede64a49ff0dcc1f8e716e5c8c05f6e5fe15802c639bb2b9fb09cbb578c0c23e74b56ebce663bdb6
SSDEEP 12288:KKGGcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:pGFS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1DDE4129B39FA10EAD23BE7B9C46D0053B4B138217335B4EF4095A4749F429E2327AE5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 b766f64cab2f1503b66f5643829f59d350c04ad640f522c5b7d63c283caea2e0
MD5 565a6b6b0e3c29187a90add5850388d7
SHA1 850df8178343c28ab1db6b316f1680caafff8ee3
SHA512 bb506774dfd1b376c5f7ffdad337fb8b145d5b58f56c37fc0a2a7dcd117a154566ce0b668c0a62aca1c47a03797161af6f084f54c0adc038b6ce3f4b258c7eb2
SSDEEP 12288:iXcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:iMS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T124D423C369AD04EBE327FBB9C46E05536071781273B6B8C7A00AB0549F429D722B771D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e03ab1c21b5c12d34ff90dcfd43219eb45471a3436d6cb066e0119a33bcca485
MD5 4e1551160377d72416f62ede26496126
SHA1 e989dd9816934287e024d0962fe28f9197ef9454
SHA512 9638e7475d1e6c34c5959c316767c3b1daf3d5fb1a8e6adbfe786065157a64ae2fd9d5b2c8731eae119221369de42e2d706330e0336c1db86ebe582efb3e1047
SSDEEP 24576:ViC8i8FpJqH18zria7/mcS0rA1V389Xuls1XTSv58s4Zwcu:8xFFPqVba7/AV38BXTSl4Z
TLSH
T15B35F16276E501F1D47BE138C9860663F6B2B8211374FBDF06A88A511F13AE50B7FB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 2deb05729b8c72d028889e1d471364d10aa411ad64ee3dfc79b1ff3fe8548d4c
MD5 b9167ca8588d8f87f218e1dc9fb7866a
SHA1 adbb84e656135467c4f2c079cb49c402dd6f3083
SHA512 bf1e05ba2357061a12aafd51b3efe65e53bb320a7ed5429072b9d462b3e08beaa74c0e9485565d0c2cbdd09b5ccbbacc4af9d7bc030711c8d16bec472952f2e9
SSDEEP 24576:vPUr+NQKS0rA1V389Xuls1XTSv58s4Zwcu:vJQHV38BXTSl4Z
TLSH
T13C05F15F26ED18E5E67AE17CC9864609F37178621312E2CF0290817E4F53EE9BD3AB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ecc6cff9ac66c077c497397549938de617a14df399e80c2793c5d0ebcecb98c9
MD5 62e10cb573fcc151a98dacb88034236d
SHA1 57c92373feef377e64e6564d2ac176243579f8f2
SHA512 9537830ac2c7a47e452bdd95354f1c2c817787451e683cfe1762755c6494f7b0c605fe1fc3c5385ebcf963baad78ab838284a9652dd49fc4a9e3e8942984ab62
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkV38BXTSl4Z:/G05lO43brONT
TLSH
T118D5C06A62EC11F9D1BBD17CCAC6460BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 9316eb107fe9f09e8270dceaa75e6a7c92f0e5b94c9140fedcc328da8618fe15
MD5 3e8f320de06affa8f7dbd3caca9d72ea
SHA1 1eacc9c998632c005147205654108215343605a3
SHA512 4e7e5551415df9d3645e1f1a4e04f0bb0eb094658a04c2517e3263f4f763d616c23f23210a4776dd6c4012a7cc81f10e7158e51776c56b254b04286593d54930
SSDEEP 24576:aKa5POZ3dpbWVM50JicR2hG0lasx2+47eidnaS0rA1V389Xuls1XTSv58s4Zwcu:La5POZ3wJt2pasx2+mFV38BXTSl4Z
TLSH
T1DC65AF5EA6FC00D5E579D17DC583461AF5B1342253329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1872c15e7a3814a3252eb6f969a0dbcfa7b39454d0f46f69f882d1801c72b0cb
MD5 b9ee65430699f4d7ebf99cb6c9aa3672
SHA1 2cd9be2af0e2a155600d5193a4158be1da617d85
SHA512 ecbae38600bda553fb6fc4395f97b4014ce75d96e923bd72ebffe0ad4ebfcdc2969ae057586359101d38d5f09aad6a20e5ec0fdd8492b3bb1d0888b7f6a8cd1d
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkaS0rA1V389Xuls1XTSv58s4Zwcu:TNc/zEOVHF+V38BXTSl4Z
TLSH
T143858C5623E901E4F1BBE1BE897B9546FA71786513309ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 ea3f2d0173e7fcad091cf6f4f635aed82cbf96ff127efdc51f09115e8f5a45c0
MD5 7339a41eb8c060884d4167b329b72442
SHA1 5d3779a842a5715c05a13e98e29c855e1b1d7214
SHA512 7861c181588b06ee208b82de4ce9f7ced9764daa4e4d37fbb64876af2e2b5642250e7ea9f820c4429337ecee4647b82299c08be2c4481b5e5938899afeb504bf
SSDEEP 24576:iJnJPbzB4SES0rA1V389Xuls1XTSv58s4Zwcu:iJnJv6SJV38BXTSl4Z
TLSH
T12315E07DD2A810E9E4B7D2B4815A1756FE31387D3B2269C719B4D4343F02EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c54145b077f722133306fd777c6778993657782ae526f9eceaa5c17f7defc856
MD5 1976cf09cb82a6350fd7aa6b4d755742
SHA1 d5b578ed130a1c7950cb2ab02907f00f79969170
SHA512 938d2a8046cc269437f40a3f3c2d89928b638d3dbdd0f8cc1bc907fc2281dde3e28f9981ad9ba10b2038f4f9c23e1a90a84c92430de526bd78fd1bc53ac0ea3e
SSDEEP 24576:BCLHGL0MoeVtFumTijCmlKQWDk2S0rA1V389Xuls1XTSv58s4Zwcu:BCLHGeeV5ijCmlDWDk7V38BXTSl4Z
TLSH
T1AEA56B05A7EB4184F9F3CAF5CA2694169A327C509B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 3b86c45af1ff8de97ad67b79a45100b56f29316e35d796b013e170ced46a9ec1
MD5 9f098fcf7a743620f4e363f0a204bb56
SHA1 2beae5174631f3659a73ee56456150558b31b495
SHA512 cf96d8b13c5f7ef512963fb87f2b824d77839c92dc4e3cb8a2e7a51c14e8b6fc7001f87782d9dba04eb63fd40f99b8ac07b69cd6136733f636ed8cf69299b037
SSDEEP 12288:K1Hck6j5ZI7+cS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:26DIpS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T16705015E33BA00FAD16BE03DC5870102E1B2B471A36269CF0694D5799FA3ED9B939F41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 3b016082fd12fcd5f297bc64e40217b16e70883957231c81fcea86d58ab6a1e3
MD5 63b20db1e72057676f2ecca9f75dd5a2
SHA1 face96aed21757b004dcf5565c5364bd563d3664
SHA512 a449898088981c92c8eef640721cd2ebf20d03fae83796d14ba7bbf718d5f136fa6d1223859e52899df1bede2dd2b1e3527d6313279b0366142a747338331bb6
SSDEEP 12288:LG6kyvcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:qtykS0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T1B1F42242639800E6E77A9678C97B019299317C217731B2CF5190F63E6F32BD67932B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 5829ab8fe51bed55ecdf046784b57f4f679d43a138346eb50432b4376d0e5bc8
MD5 b11d85a9505116c6f1f4021f5ebb3461
SHA1 68e8e4c03e52d079d22c71fc76f9a1384cc99eb7
SHA512 7a9c78e087cf358f25b00d3435b91b099b23bca2c8b25bcf909b06d9d9714240f9d7f5412ed3f67c7dfe2bd77a1b64e3c2a1dda9bfeb77fa89dae76db73aa478
SSDEEP 12288:RdPcS03bA16oQg2N9XulQnDdjXf76zMGEK58sopZwcu:fES0rA1V389Xuls1XTSv58s4Zwcu
TLSH
T11ED423C76AAD04EBE726FBB9C46E0653907178223376B4CB6095B4349F429D72272F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 a60c79c2aa3a688a17f706a171434697aeb85de93b3549f839bef2b8369983cf
MD5 8e37d35661451172d4ff940a4fe670f6
SHA1 3d4d9cbea4fd1dbfa5c3c688ed71722c498ad05c
SHA512 b4ed3d4e6f3a9db16c74d659661313558a971afca84d6d094a6384a2a4a8d42182d060e737902cf80c354bc4484613ba12513b8f37d958dcdae780f018358e5d
SSDEEP 24576:P/goLoTfaidZQS0rA1V389Xuls1XTSv58s4Zwcu:HgnTrZtV38BXTSl4Z
TLSH
T1C6559C1D67EA05CAE2B2D679D8721493D633B4315372D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 2fae77b95de6a38198fa3907933b7022774c1d148bc21d5a437b799aabec6b68
MD5 57c159923191b5e5f4164da695baf784
SHA1 3c35d5c2829f32b0a2dff8962745f01aa47ac896
SHA512 0ff9d627686b47410a6d5979e1dc1dab06316138e1d09979272751a6e3ec8e7d5fc53051c11df0b7c153f2f6c71be55ceb772435b280a55983278a891043f00d
SSDEEP 24576:crcmRNS0rA1V389Xuls1XTSv58s4Zwcu:2cmRsV38BXTSl4Z
TLSH
T10A05F14BB6AE00E6E2B7D27CC84A0542E2B37431236267CF02A1C77D4E579EA7D35B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 e2593d517fd2478bf69dd4e4cbbcf7c67ec6e78cc0e41bf504bf9296ac006e44
MD5 3de4e99177a07af473cd036243eafed0
SHA1 bc345bfa4682acb8ce674355f408f9061863a64d
SHA512 11b7a6d5165401e801c4e2f58d67eaccc43990a860b1497036b14c26fcb8c18a09f6e88f4a2e7f878389edb027d9d4e5cbf8323130a23420a145965fe8739fea
SSDEEP 49152:NDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3IV38BXTSl4Z:u3Upow8sBLONT
TLSH
T124A58D3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-355-0x0000020F2D0B0000-0x0000020F2D116000-memory.dmp

Download

memory/1336-354-0x0000020F2D0B0000-0x0000020F2D116000-memory.dmp

Download

memory/1336-353-0x00007FF64F140000-0x00007FF64F3CB000-memory.dmp

Download

memory/1336-448-0x00007FF64F140000-0x00007FF64F3CB000-memory.dmp

Download

memory/1604-382-0x0000025071330000-0x0000025071396000-memory.dmp

Download

memory/1604-381-0x00007FF60ACB0000-0x00007FF60ADDF000-memory.dmp

Download

memory/1604-383-0x0000025071330000-0x0000025071396000-memory.dmp

Download

memory/1604-451-0x00007FF60ACB0000-0x00007FF60ADDF000-memory.dmp

Download

memory/1964-393-0x0000024EB2200000-0x0000024EB2266000-memory.dmp

Download

memory/1964-394-0x0000024EB2200000-0x0000024EB2266000-memory.dmp

Download

memory/1964-392-0x00007FF70EE70000-0x00007FF70F1AF000-memory.dmp

Download

memory/2108-252-0x00007FF7336A0000-0x00007FF7337BA000-memory.dmp

Download

memory/2108-253-0x0000016D8B7A0000-0x0000016D8B806000-memory.dmp

Download

memory/2108-330-0x00007FF7336A0000-0x00007FF7337BA000-memory.dmp

Download

memory/2108-254-0x0000016D8B7A0000-0x0000016D8B806000-memory.dmp

Download

memory/2400-449-0x00007FF679EE0000-0x00007FF67A3B1000-memory.dmp

Download

memory/2400-363-0x000001452FE90000-0x000001452FEF6000-memory.dmp

Download

memory/2400-362-0x000001452FE90000-0x000001452FEF6000-memory.dmp

Download

memory/2400-361-0x00007FF679EE0000-0x00007FF67A3B1000-memory.dmp

Download

memory/2760-341-0x00007FF702AA0000-0x00007FF702DC1000-memory.dmp

Download

memory/2760-342-0x000001AC2ECD0000-0x000001AC2ED36000-memory.dmp

Download

memory/2760-343-0x000001AC2ECD0000-0x000001AC2ED36000-memory.dmp

Download

memory/2760-347-0x000001AC2ECD0000-0x000001AC2ED36000-memory.dmp

Download

memory/2760-349-0x00007FF702AA0000-0x00007FF702DC1000-memory.dmp

Download

memory/2800-322-0x00007FF77A2E0000-0x00007FF77A583000-memory.dmp

Download

memory/2800-391-0x00007FF77A2E0000-0x00007FF77A583000-memory.dmp

Download

memory/2800-324-0x0000020304AD0000-0x0000020304B36000-memory.dmp

Download

memory/2800-323-0x0000020304AD0000-0x0000020304B36000-memory.dmp

Download

memory/2948-302-0x00007FF617D90000-0x00007FF6181A7000-memory.dmp

Download

memory/2948-447-0x00007FF617D90000-0x00007FF6181A7000-memory.dmp

Download

memory/2948-445-0x000001D2EEFE0000-0x000001D2EF046000-memory.dmp

Download

memory/2948-303-0x000001D2EEFE0000-0x000001D2EF046000-memory.dmp

Download

memory/2948-304-0x000001D2EEFE0000-0x000001D2EF046000-memory.dmp

Download

memory/2948-380-0x00007FF617D90000-0x00007FF6181A7000-memory.dmp

Download

memory/3176-450-0x00007FF60B4D0000-0x00007FF60B9D7000-memory.dmp

Download

memory/3176-371-0x00007FF60B4D0000-0x00007FF60B9D7000-memory.dmp

Download

memory/3176-373-0x0000023972FB0000-0x0000023973016000-memory.dmp

Download

memory/3176-372-0x0000023972FB0000-0x0000023973016000-memory.dmp

Download

memory/3308-47-0x000001C0AFB80000-0x000001C0AFBE6000-memory.dmp

Download

memory/3308-46-0x00007FF72E490000-0x00007FF72E5F8000-memory.dmp

Download

memory/3308-53-0x000001C0AFB80000-0x000001C0AFBE6000-memory.dmp

Download

memory/3308-48-0x000001C0AFB80000-0x000001C0AFBE6000-memory.dmp

Download

memory/3308-55-0x00007FF72E490000-0x00007FF72E5F8000-memory.dmp

Download

memory/4332-244-0x0000021B07450000-0x0000021B074B6000-memory.dmp

Download

memory/4332-321-0x00007FF6BBD10000-0x00007FF6BBDD9000-memory.dmp

Download

memory/4332-245-0x0000021B07450000-0x0000021B074B6000-memory.dmp

Download

memory/4332-243-0x00007FF6BBD10000-0x00007FF6BBDD9000-memory.dmp

Download

memory/4380-6-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/4380-1-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/4380-0-0x00000000029D0000-0x0000000002A9F000-memory.dmp

Download

memory/4380-7-0x0000000002C50000-0x0000000002CB9000-memory.dmp

Download

memory/4444-294-0x0000027AB2C10000-0x0000027AB2C76000-memory.dmp

Download

memory/4444-370-0x00007FF65BFB0000-0x00007FF65C05E000-memory.dmp

Download

memory/4444-295-0x0000027AB2C10000-0x0000027AB2C76000-memory.dmp

Download

memory/4444-293-0x00007FF65BFB0000-0x00007FF65C05E000-memory.dmp

Download

memory/4712-311-0x00007FF6BBD10000-0x00007FF6BBDD9000-memory.dmp

Download

memory/4712-235-0x00007FF6BBD10000-0x00007FF6BBDD9000-memory.dmp

Download

memory/4712-236-0x000001E995D80000-0x000001E995DE6000-memory.dmp

Download

memory/4712-237-0x000001E995D80000-0x000001E995DE6000-memory.dmp

Download

memory/4768-58-0x000001B217D10000-0x000001B217E8D000-memory.dmp

Download

memory/4768-60-0x000001B217FB0000-0x000001B218016000-memory.dmp

Download

memory/4768-59-0x000001B217FB0000-0x000001B218016000-memory.dmp

Download

memory/5072-30-0x000001A467980000-0x000001A4679E6000-memory.dmp

Download

memory/5072-28-0x000001A4676E0000-0x000001A46785D000-memory.dmp

Download

memory/5072-31-0x000001A467980000-0x000001A4679E6000-memory.dmp

Download

memory/5072-29-0x000001A467980000-0x000001A4679E6000-memory.dmp

Download

memory/5076-444-0x00007FF7F0150000-0x00007FF7F02E5000-memory.dmp

Download

memory/5076-333-0x000001D6222E0000-0x000001D622346000-memory.dmp

Download

memory/5076-332-0x000001D6222E0000-0x000001D622346000-memory.dmp

Download

memory/5076-331-0x00007FF7F0150000-0x00007FF7F02E5000-memory.dmp

Download

memory/5268-367-0x00007FF682D50000-0x00007FF683494000-memory.dmp

Download

memory/5268-286-0x000001DEC6A50000-0x000001DEC6AB6000-memory.dmp

Download

memory/5268-285-0x00007FF682D50000-0x00007FF683494000-memory.dmp

Download

memory/5268-287-0x000001DEC6A50000-0x000001DEC6AB6000-memory.dmp

Download

memory/5288-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5288-352-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5288-274-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5288-279-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5484-40-0x000001B9A6660000-0x000001B9A66C6000-memory.dmp

Download

memory/5484-37-0x000001B9A63C0000-0x000001B9A653D000-memory.dmp

Download

memory/5484-39-0x000001B9A6660000-0x000001B9A66C6000-memory.dmp

Download

memory/5484-38-0x000001B9A6660000-0x000001B9A66C6000-memory.dmp

Download

memory/5548-266-0x0000022263C90000-0x0000022263CF6000-memory.dmp

Download

memory/5548-340-0x00007FF7B4E00000-0x00007FF7B4F4A000-memory.dmp

Download

memory/5548-267-0x0000022263C90000-0x0000022263CF6000-memory.dmp

Download

memory/5548-264-0x00007FF7B4E00000-0x00007FF7B4F4A000-memory.dmp

Download

memory/5828-388-0x00007FF66ED90000-0x00007FF66EE44000-memory.dmp

Download

memory/5828-313-0x0000016AEC8C0000-0x0000016AEC926000-memory.dmp

Download

memory/5828-314-0x0000016AEC8C0000-0x0000016AEC926000-memory.dmp

Download

memory/5828-312-0x00007FF66ED90000-0x00007FF66EE44000-memory.dmp

Download

memory/6004-15-0x00007FF678640000-0x00007FF678763000-memory.dmp

Download

memory/6004-16-0x000001A00D900000-0x000001A00D966000-memory.dmp

Download

memory/6004-64-0x00007FF678640000-0x00007FF678763000-memory.dmp

Download

memory/6004-18-0x000001A00D900000-0x000001A00D966000-memory.dmp

Download

memory/6004-17-0x000001A00D900000-0x000001A00D966000-memory.dmp

Download