79d1d29566759db3746f4f96da7a4a6ee5819646ddcdee4a1cbadd0be13701e7

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260714-ev9cbsd15m
SHA256 79d1d29566759db3746f4f96da7a4a6ee5819646ddcdee4a1cbadd0be13701e7
MD5 2c39020b66fccdcefdf12939a5c33c92
SHA1 bceb4e34606a3e0bc116ef7077262d49990e8e07
SHA512 7c2b2f195114793d860c8f583d14c83640069f219fd7439618df7fff83c1d602ccdea562ee89322dbfef634c226ae3b114ad1a86302ccb25c0979bc064a09c98
SSDEEP 24576:8vrHWdZcy2s8DWxr9QHzd6TMV87BbkjCMvGdLtjp8SXdo8ke5i5Xh6wnBLTHTAck:Es6QRQTkTb7mGVtjWS1SZBnHTAsi
TLSH
T18F75AD1277E58035F1B36731693A931899BABCB29839840E73DC662D2F70691CE74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3320	alg.exe
3172	GameInputSvc.exe
4596	GameInputSvc.exe
2536	elevation_service.exe
3388	maintenanceservice.exe
5204	msdtc.exe
2004	OSE.EXE
4392	PerceptionSimulationService.exe
5032	perfhost.exe
1100	ReFsDedupSvc.exe
5140	locator.exe
824	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28cf7219e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	GameInputSvc.exe
4596	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2712	2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	3172	GameInputSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1100	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeDebugPrivilege	3172	GameInputSvc.exe
Token: SeDebugPrivilege	3172	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4596	3172	GameInputSvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_2c39020b66fccdcefdf12939a5c33c92_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2712

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2536

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3388

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5204

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2004

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5da0bba3650114a3bb282fffdc47143cd1745f19506ef4d8806eae480210b04a
MD5 893c741647be591e7c515f6379f1183f
SHA1 e1b0db2f6b9cbcc534bd4270cf495157e0924247
SHA512 8c719313fb3a95e5492d49491b10cbf4725f5f8ddc533e3f7293a852128d33a8b7f95f84b5b709a537af68c2ab662788e63c645a62422631049fb3511eb97ef8
SSDEEP 49152:8b+632BuPkFKRrdE6oh7stBhuXjfS4LWxniWS1SZBnHTAsi:m3q6gjBRcNzAz
TLSH
T17ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 87d8433b414ebfb0b779efde4cef95eaa3c75dac4aedf550aa35a1aee9a228b0
MD5 826533187c2f3ad6ef1216a6d87644b6
SHA1 6f254ab2ccd171b3c0d366b0c9f5e9ec2a5385be
SHA512 0c3b987c9b6df75f8b0eb4d874e0a902645a832845f6b851d80e626633b84819b7916f010004321cbc8d39cbca1a5d91a0ab631dd46ad6382e00ee1f9bba2681
SSDEEP 24576:TXYGEtczAMp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:itc1WS1SZBnHTAsi
TLSH
T1B505F128A7E009F9EC574239C9A18405FB73B8518764E78F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c0dab5a5494cc5549fba17265379130769c11c1d3ad78baf2c13ea67630b0bda
MD5 f7cf0e0dfa9001dfebbc2ab1f49d45ca
SHA1 252261bb40d3493e9b01c75ef4e9c10f4fb326cb
SHA512 010e778e0f60eee9b63701ad0bee6ca834d0ac06c10e79ce29a83136ccccb088f6a9b38c5615c4b0972d6b3059f12a5baae5ac84464bd74ba87ebaa590f959d2
SSDEEP 24576:003e7VJ034xOrMUp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:0tVJ0IoBWS1SZBnHTAsi
TLSH
T1DD459E15F6748735D073C0B9C5D2A68EEA7230825B308ACB4286D77C7E677E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bacec1c187e1ae78125802f8a75ba90ccbfb475899fbe0f08d7c82229b7e2da4
MD5 d86dfde6eefbee8851bfa53ed4c29fb0
SHA1 4009605b8508428f90b34bbb97c467fbf295ef11
SHA512 7d16727b981f399b68ab02c19c06bcbf44e044ed8a9f12c5ca2efb8479fbd1235b63508ba1f8f985806018e0c28465ec15624aea715ed73ecd0c93972f9009d3
SSDEEP 24576:pAF/ezSC6vUyD/aqgrvW/6q8wyuFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:k/ezSC6vUzPvuHjyGWS1SZBnHTAsi
TLSH
T138755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 e15333772e53ce2e850ca98f659bb3e21e01dbf591f60f0e662bc5a740ff657c
MD5 803145d5b52cbc56418c58bf753af6b0
SHA1 5351242758f509b1becc53899ac3452ae5a59945
SHA512 48b96328a4ba2aedf3630350a12f3bbf3d854038568507ae84b7a9a1cabd50af27231c4f7c957ec715fd9461cde09ae22d875c95bd4e3bbd7a27ce70dd340e92
SSDEEP 24576:zabIPVoMvv/l+dYp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:zaKoMvXl++WS1SZBnHTAsi
TLSH
T1F1559E66F5748331D073C0BAC5D2AA9AEE7230424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 d8afbc1fe2e2255cf16dba5692446af8a09495a6cdd4d51826090ba00717ded1
MD5 d40b11a2ef569c535a044bc8cfa655ad
SHA1 9d4a69b50d8cbfb4b55e095d294162df070e47dd
SHA512 75beb2e0b63b9fd39f9b681a4503b264f7c9a189aa0c0f847ac91f54de2dd4b596b5be525a68105bbd0cca15bccbbebfc75309918a36ff51b9b9400619c86d7a
SSDEEP 12288:+g+p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:+g+p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T192D42309CF648E70FAC40A3135784C4DBBF79761CC6E0B0D06A8BB4E66762DDDEA6542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 84b427ff49646267f0b678d6a2291e1060f2ea6d66638ee218150519676be45e
MD5 5403be264f334bc32805f4c859ac037c
SHA1 d94a1dbe7dff6283fa1c9ace12886b9ce531391c
SHA512 7a29f08757d4a89a2251d971310fce79d9b1fd60935357fa3cef29a4fba43e978f11da2a70088941d256e2a59879f45501524a744daadb2cee58399e7e7b5e77
SSDEEP 12288:geBNUbTVO86U5p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mT:gJIU5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1A115CF3BEE28ECE1C27A4D795A518600E7B274318F6293CBD164830EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 94e679ed44a41f2c4023ba1e9f6a6e6d98739f57a94613ed814e529e4291665d
MD5 668fb8f6d7de1ca147162f65e96898cc
SHA1 efcfee2d0ef0ff49428573a6dd06b7667acfc271
SHA512 0e92cf1c90157edf88e31552c866f1b1d20e13e860b638af5b2a422c905af16602d711651b33cc61959788f46c994f2ad253045e223fa5b3aa4a491d33b4f7b3
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJJ9DN5JCNRV3THf:5QvGAdlCEL8c/JRNW5CycNzAz
TLSH
T133367D656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 e26ed327d7acb4c138b18c02f05910ea71fd403daf00128053e945806b88b680
MD5 f91b03d15f3a5b316b15a64be2732aa1
SHA1 a4eb16a6f468e102296d7b669f6f05d9fe110924
SHA512 d6043e937f7eaff80e6e903f8ed732f00bbf27053c61ec7022d8e11f8afb8634e740463140ddf0e4432b6f31b28db5d3dc8bb07e5dc727a439507b30b7975719
SSDEEP 24576:ymewsAjFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:5ljFWS1SZBnHTAsi
TLSH
T15815E031EE74D436C6BB0D722B35C70A647D7A204F611AC7E3E89E8E59302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d3df1df372c60e424732e83c5b70bb353cbb68c2760a28a6ac70aab7049b5361
MD5 dc2f0c8be96a3b3eada36cca322bbafe
SHA1 191bccc9397bf6d0ee072cfc6f5cce91851e1d2d
SHA512 a466cff6b48ea71c8962a43447bce1b84265d8b3f3faa1a6ff666af4ae5a3e5afae1f383b4c21e98e51558ed981bd41ab3b0739deca2ae6a23a1ed1453da57d7
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyXLldPlbuJH7T:bUEtQevvqc2W1cpV2XL32P
TLSH
T1E3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4dac6e640d77c9d0a34ecbc85364231702f1d6f62bd6b7f972c45fc0fc00a06b
MD5 54fa0d3b30ad1b68621e84a3fb04c830
SHA1 c6bfa7a01350caba608343849743dfbd5c8ccf59
SHA512 1ce8d5cff94f22d7716fe1537cab3a0650dc38d41f3800534270ff271f8f842231a8942b2a9a27f8079828592f8fd84397c6bd7aa1f9eef3353cfd6fa25a2fa6
SSDEEP 49152:wPbRquA/m2yL5zMfFiV+XenmE3/z8WS1SZBnHTAsi:aoq1VjnmXcNzAz
TLSH
T128D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 40f90d0e64507a0804d4a5fc2eb05973507acf7637e94bf395f6d5b16b0b95a2
MD5 181d08f93ef11baa0c5129afc7994e9e
SHA1 2f036e163bfd9c19beae6fbed789ec4a2f62b664
SHA512 fbb4feb54c9b782d7d7a4a81184d306e200e6bb6f5273622b971042362c838278f22701c80901d0850df746d17360911337e5d2092cc443312668d5e996f6a94
SSDEEP 24576:bAhGLvcFoiwtA5l7S53qfp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:bAMAFoiq5afWS1SZBnHTAsi
TLSH
T1A0459D81EBF945D4F5F3AA78A9B58471EA76BCA65E31C20F2160D10F1E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 611138fb998f8f9bad6ce4503189746d4830fdc3c8f5f5596db780cc2a6d207b
MD5 7700a623e14721c14c14c973f6290543
SHA1 f27b655555313b2229f3310d17609915134887a1
SHA512 e969b07ea88ec0f193353454b7676a1c5cf1076ba3282d8b19c55793e79d81be2ced32c007bbf5edd97c4849f3631ef22807f9e1dc1cb376015624424fb4adbf
SSDEEP 24576:UwusOW8p8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOvWS1SZBnHTAs
TLSH
T19C05F14967A40CF9E99642398657C436F7F3B8122A25CB1F0760C75B6F33365AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 68d84fa104ceabc926b965e402c7b915606845ee03830ccf0804460d89461e2a
MD5 ebff18b4407f184dc1606b217a7fca64
SHA1 d449175525af6e11960ad90af402c8ad00069b6c
SHA512 7304413e27a43238d95a916a44a6ace795d82be7292a5c616d7e6bd1a5cb396399aa55111fd350b7061000f29ce20ee2232335bf7c3674208925041779e64d65
SSDEEP 12288:7VA1IVgp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:RAu6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1CDE4124D57E455F8E1C60239A9F44809F7B370629B3A43CF0664479E2F33AD95E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 09bbb4395042a01e2b863febd7744a1a53d6fa2c445582c6dfe4265dcaed256a
MD5 a3148fc6874b6d9730a1ea4ac82a0aeb
SHA1 c5dabe9b7d890807a9d588c66846e248a58ae165
SHA512 79be653de95178b1534c753d3c2153cad5e04228a6495be88598dc479e8a4e31b4da9814c237f5e5e134e0a9e9d2c87d3839c52157831b425eb76ca1df4356b8
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ul:uQRQyi36YOcP8Lvw2gAf+PN3FcNzAz
TLSH
T1F4667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9e94999dbc32d0f532f9504e828b12f35584de5bbce90989556fc2a921d59c1a
MD5 980d4a007260e5151703a59c2244d396
SHA1 73635ebd5910ade9238dbf6a92bdbda449080043
SHA512 e76a332c0b4da571d82c0b25ee9eca914f27166f0897c2ac4bd8890df07f1c38a9e57b4e3eacaaf6b8b69ab14d7a6e537df20a3db5dd121139f594fe552defc1
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U8:uQRQyi36YOcP8Lvw2gAf+PN3McNzAz
TLSH
T142667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9e64ff10291a7903083cfbe0fb1013f54ecf0318674ecfd0c23573869eaef371
MD5 a0ac8cce930965f464bd5818dcfa9041
SHA1 20ce0366ef988316e08affe63ba2c5e9e04c4058
SHA512 49e057b5040afae4542b837b2e50b13e8289e134ef457c2bc8829f1b93bcbe721da64757c76b4f9d832337a6561b1f28122a0de54ba5550e98b8cc5d8e1112a0
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0Ep8SXdo8ke5i5XC:m68Qg55nhMeWu7PNU3/xWS1SZBnHTAsi
TLSH
T153B55A33B2F200A9C44DD1769F4A872196D27C71CFE1E3DB8515720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dad323a888096d738e818a10d649e19e4b653f2d101ec70ed36a2743522d010a
MD5 3d221ad4830d35f66ed1ca5da52df9fe
SHA1 f37078880b2534c1d237b15752f4fb351bec0d8c
SHA512 367250f4bb5586c33da1bb678181db1980ebf74d327ad4385c51143582df6aa08c3b61f8e9021dabc1a08e0ca2310611064ac100f508215f950b4f4dcb40ae38
SSDEEP 49152:H3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99f:qy5112gYy5azzVv569nLKnhZmcNzAz
TLSH
T1CE168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e4a53773f895198adc2913fe0b81699cbf9f25538ed14bfefb0e70f79ae7221
MD5 2d71dfb0bf835503f80e2ee7e8ac6594
SHA1 bf4672508f795f5a876c9cccd80c932eaa936bc3
SHA512 aaad4cbe0b496fedd1d8667987db4b47035cd16940af40f166c1fd78376d75e7c042716ee12780cf97fa4bff73385d61856e3107b0ea1ec819e82ddf62bc2333
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xXSWS1SZBnHTAsi:wmifPbRSScNzAz
TLSH
T174B5BE13F29901E8D05DC178875A9632EA72BC460B34B6DF0A90B7962F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 780d7e401fc1529600b0f7173292311cd28b3c6ecf605970c80e774ec6ad8a5c
MD5 9ad29411f19e0bc627d3ae54449e0977
SHA1 e3b32125a39fffccf26e4e5f79c02198edacf50b
SHA512 44bf01dea311e3ade8817b1ea8a8c1aa0627c5cc7cf878fd88548ff10b0a45341de7572b7c449fc3f95fa7a357f8d073b27d11296121d5518f5b5019a54d2ab7
SSDEEP 49152:nSuZQIY0Be2K6RVtOnks6NMHq7WS1SZBnHTAsi:95dKoi617cNzAz
TLSH
T128C5BE03F2E940E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8081e58e18672fda156adcbde98f7354136c07767ae98532610d885256307b99
MD5 fa867592fc873a6d69f46f87cb1a797f
SHA1 5c761142bd7961ab93c3432619d847a71ed0b53d
SHA512 0cb1831c0c243b0bf1b47b2ea7bc7f47470b3030baab2d3473de32474b462edd55b3b1506e7d531dcfdd30b547a759efe41058a4fcace537840d9d5f9673aef2
SSDEEP 49152:ad2Sn8EApI0figTgiDn0AP5w8WS1SZBnHTAsi:kX2iyphVcNzAz
TLSH
T14BA5BE13F2D900E8D05DD174C7568632EA62BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 fb23078033d04b98685383b857308b8e70e7ab88c720c2bd0e6cdb0a2c41ccf4
MD5 829549b89c5184311405afdd0696e7e5
SHA1 750ab7b0504dd55deaa94b52bdad68684a2326ed
SHA512 b381a21b441658c5bf7f9b079030fd0eba5dca73b404c1ffbd9187b4f5d427dd6db97ae1b4d8428f0fa684bdb8932378890836e4e40b3aed671a426adb3017cc
SSDEEP 12288:E5p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:E5p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T13FD4230DCEA58E64E58406317638484DFBFB6362CD6F070E179CAA0E7B632DD5F62981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 57b6c1d3a78d4c7a736e00c7ac3d46014a5f549f9e0c56a584cacc8a7a4878c1
MD5 beed8854054c15c6264a9d1a20dc3d4a
SHA1 3074cf2cb6a774c1d73b496f7666c6cbc517de38
SHA512 3d7e5f6b0b6b716146fd4c03d28a96cf42a48e81411d1d9aef24fa5f5ba4fac454d1a3454d8de9bc652bd7e42dba297e78a27183b7d8b1c3c6cae7bc0c21c13b
SSDEEP 12288:2Lp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:2Lp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1BAD4230DCEA58E64E5840A317A38484DFBFB5362CC6E070E179CAA0E67622DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 c14868a89d66f671527009f919ef50913d4c9632b307d3402dbeb178cc1497d5
MD5 4968e13e4008c3e9893372bfa8c1e898
SHA1 25e06160500b243fd866ff71ac5563a560602ea0
SHA512 b0dc6989b338aa995681305eba54548e6d66c6aca2bc0636324c8110f8419727fb551298ae54db3a7e75c3905d89f73c220a79731b7fc21f371fa0fbefdf835c
SSDEEP 12288:sIp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:sIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T10FD4230DCE658E64E5840A3176384C4DFBFB5362CC6E070E1B9CAA0E77632DD5FA6981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 8ec0bb54d19a7038f0e935dc5b1cee569382de2cb6bdd675be6040f21708dff4
MD5 57019c2b21b800ce30fe63ec8310f7d4
SHA1 c1e87d0d9fad2fe34d227d300f2704d89118d675
SHA512 0e6540fe5475e08a6a7ceb9b9b2e00b5b4511627420a262c9d21a736879f656fd5c05f16856605df2e4de5bd3321a8867d05d87e94f21b682f8297ec175a7322
SSDEEP 12288:plsp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Ap8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1ADD42309CFA54EE4E8844631A974480DFBFBB362C93A170F0B545A4E2F7339C6E65E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 3a6a6a3a17044cfd805a975a0b2488a9d6f97becd255c0139510bbc38d87e4d5
MD5 0fcefd1772faaff0e311b9bf161af0e7
SHA1 db2765ccef05f8d8a19477fa4f822a5885598d82
SHA512 a8adb145720bb69587a72330412bd8ec8c27275cff77f651f970fa7a5a02c44bea92ef3b3b02426a4b1aa5776a71525fae58ee65f4b6fba2b42914514d3e9faa
SSDEEP 12288:rop8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:rop8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1AFD42308CE658E64F5840A317A38484CFBFB5367CC6E070D1B9CAA0E7B632DD5F66991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 6c24a161f80cfa9553929897256b44069827812d4ccb6bfdd3543af5ea2373c8
MD5 3753ca102cd5109753310e65607641e0
SHA1 f7d72f8dc0bc62d4402805e3f214b5a69797d6f8
SHA512 c7813d51c6875bddf6db67ae7967f5e8049d7b0eb79a3ea67cee4c7d0de2d7e8aafebe0d92958f89ec1974134799cfc155c3abc8f15e3e91c37a3cdde0963847
SSDEEP 12288:oyp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:oyp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D4D4230DCE618E64E5840A317A38484DFBFB5366CC6F070E179CAA0E67622DD5F62991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 9905e42eda5c1cb40f458083487eaed5d442fa105fb74bc7cadb6d50d9c825ed
MD5 6b52363ce9ce23f9de7f8659125eb5e8
SHA1 660731ce44caab72644bd21b6ac45e8e1a32506c
SHA512 782bd5d31597dae82347dd6b3dc2b83e499639b6b9627813db24d8f8923b6dec3e09576d88adc80b35e37521a845a43bc79c29235fb51e031fc5f2e1f3327f82
SSDEEP 12288:Z3p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Z3p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T198D4230DCE618E64E584063176384C4CFBFB5366CC6E070E1BACAA4E77632ED5F62991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 6cdc4d81f5a9400a23e3fa14107c6d12e2eb35b66f977f26fecf6dd9bb44cf39
MD5 2f05b1b9909a95d2727a7f01dc18f93b
SHA1 257a0d8094c99ede992ec2b6e890fa27d8c7b080
SHA512 4206dcfab618eed73d46fd25edd11b9a9d260e107b9afb00f16ea009f8a73072be39b48b938946f304c29f0d968ed3808cfdb631a41b07d5ff9bba84e3d7d2c9
SSDEEP 24576:HZMKzF9Sn6p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HZMKzzBWS1SZBnHTAsi
TLSH
T1CF15F199B7900CF4EC97423EC924880AE6B27C564A74C71F03A8365B5F333A51D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 a27cfaafa116942ebc7b60ea7dcbe39df9662f2a4b6b19b58dd0c859668e6942
MD5 e0f08db252f5cf6021a293c6da19db1e
SHA1 fe0b0ffeaeefc8cac1989f576ec68b8550b01906
SHA512 9f715759ffc736c41db0b779bd13c6c65517cc5da01210064a31f0597a56bdabd8d3455e3a7c918de6de9b9319880d76a4178fd7adf887d14a0f0375e05e1649
SSDEEP 12288:oIp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:oIp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T192D4230DCE618E64E58406317638484DFBFB9366CC6F070E1B9CAA0E77632DD5FA6981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 859f58e279182f47be54cb978535bd932edd27f5621e8003410f9cce2da9aef6
MD5 e17d1521ad2ebf8fe66703a8e30059cd
SHA1 f3357035da76af05425654cc5acd62c38f4fc7cb
SHA512 e8a1b6e8ea9ecb523a6e10100424cbf0922ed7c7c5ea07bc7fce8af67a8b19d7b39bc2592e289682e44ed32c5a94eafb3925834895f9993658459a3f5a7c7f44
SSDEEP 12288:Ogp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Ogp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T18AD4230DCE618E64E58406317A384C4DFBFB9366CC6E070E1B9C9A0E37632DD5F66991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 a457299b7af4f4ead11386afcda19992c7749d0010d3dcfa18df30de2439718c
MD5 c7f45d7c2c099ccdb273df5e2fec7296
SHA1 ca08e9a65add491a67b089ec3faf30953531295b
SHA512 a91378823b75f443dccd7633e9f23feb5dd251a8caa3c6a90f03b07866547f5ce3a4c410ad30323892c54323b4a3bc2a9c583be1e841682b6c0b8848ad5c5dc2
SSDEEP 12288:CnPx5L8wp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:2xywp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B4F4120BA7A125F8E1664234D9640D09F7B7B4324B358B5F17A4477F2F233989E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 b278ada9d7004256771a1bc1c18dbb1f0945fd5dc71841a21621cf81ea9641d9
MD5 185d439b50363e5667e9b63d9cd141ad
SHA1 6fbc83f935485cbaef196ab5e21cd9c58e8ff9cb
SHA512 c86e5d9f05a3f405ec4f0ffe8130b75b61bd47bf46f64fd9c15355f343d8fd64fe9d5c9f239109cea923b2133c96473aa713860a37a5400ca995ac744874b69c
SSDEEP 12288:Ufp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Ufp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1AED4230DCE658E64E5840A3176384C4DFBFB6362CC6F070E179CAA0E7B632DD5E66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 dab91d858ba6f6a4237eca78645fb8a6389700a6099b26c849765835a0353ff4
MD5 e25aabb5b72053d32b0f91f114142956
SHA1 c7257287ac074da6f409cb6cdf1678806778b8ea
SHA512 91b1c11a1da6e39f971becd8f53e39854954bf174322052942d1aff8e67e461f165329beb077c7ac619f8581089aaa8f3f78ebb131e53f03adfcfd26d8f39c97
SSDEEP 12288:4Hp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:4Hp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1A8D4230DCE618E64E5840A3176384C4DFBFB6362CC6F070E179CAA0E7B632DD5E66991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 de486341c0eff34da9826d9ee12467466917cc175dd1da976b8a53e809a0db70
MD5 b364937e16f99cd8e1c23cc157b7aa15
SHA1 b4884339e3931610cfdc8b0e0aa2c10b3a540309
SHA512 e1e6d697e24f02c5d7ccc4719ef6797435f6853b0226d9fc0ffd1cebe4f627f5a61564c1ac1f548c1f7dc63569149ae2cdd4e54dcbfe16ffdff0560b7f563add
SSDEEP 12288:rnPx5L8gp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Lxygp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T127F4120BA7A111F8E1564234D9650D0AF7B7B4324B358B5F17A4477F2F233A89E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 6c90d2890bbdb580de71720666a50d97476792086838d987d5ff1a2631649442
MD5 1374e4a041327ebb9411e9e18b9e7bd6
SHA1 05af22fd2e6db750b6648148f4c9c9963656f1fd
SHA512 3736f4491010ee78d9c66a27fbc57891dacbb18692ae1790e1a63f9fa986228bc03dedc0fc620ed64c5dc2fca13fa11e7d5f8add6b7e1a48f54bbc54a61239ab
SSDEEP 24576:KThaLe3z0zxtp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:KT8LejqWS1SZBnHTAsi
TLSH
T1CE150298B3504CF8EC97423AC925480AE6F27C5A4A74C71F07A8365B5F333A51D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 ca4243e941d67cd3d898dc7626703464076f8a2ce60d5854f84dfe262f639b8f
MD5 2e20afa085000be413b84c783345a515
SHA1 ed1042cb316f114be5c63b9b78a26b7f6530236b
SHA512 a54c6065b28a8c0c4927ed8b6c4bd3d2ed6ba2c75871b74563614b98147f2da8c55ed5843806fec04b4d3e7bb907559a6c62be0f109158f576860f7e248dcfd6
SSDEEP 24576:g3KdGCHXy7NZFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:qKdGCHXyxLWS1SZBnHTAsi
TLSH
T1E635CF90F7E404E8F0B78A3599754501DAB67C6A5B31CE8F03A8665A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 3d9576490d2ad0e81a2cb1487ef6e661eeaeecf1b492d7d58618d78ba64691a2
MD5 3e1d5295f31a50bc81f7c7607f4bfb9b
SHA1 e3ecf2530ee9b036e0c89ffc2b0f5ddee7490b4f
SHA512 0327744d2f26e3399320f52632bf7533c474b167bccae4057f284bd1d718bf20488c764bb812fbad0ee37f73ad66e6c0a247282d7030b735ca37da3ed5a297f3
SSDEEP 12288:WDp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:WDp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1A4D4230CCE658E64F5840A317A38484DFBFB5366CC6E070E179CAA0E6B632DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 9b143a33cdd25c33c9066683208e8224fd7b1ce16f1bbc71ac153a8a5977d718
MD5 93de78457448f9e04ca16d78fac85371
SHA1 091a2241b157967fdfdb13b19ee09dc9423e066f
SHA512 3e31aba08adcfc7278c075874b32e252230a9cdcb14731dce7cd1d3fb4baa0900058adf3f4ea3311b964503b736d54d53ae3a66ef0242e3cb545d0b820ca3f81
SSDEEP 12288:W9p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:W9p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T165D4231CCE618E74F58406317678484DFBFBA362CC6E070E17AC9A0E6B632DD5E61992
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 ea5675f63e2f52180696bf8e40d525d109c96317306d40ff1dad778c91e6e3ac
MD5 313dbc2a328477f99f01c4523b2c01e0
SHA1 6064c2fa465ca666d86cc12007591191a5f94cb4
SHA512 80d93749a1de9014c6cd1b8e7cb78ba7183a0dd2e67700ef5c8255689a49612bf3226730c4b2a8ed4b2c9b01c9c69624d364d081a2f52480a7c1040cf6f387d9
SSDEEP 12288:l2op8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:l2op8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T14CD4230DCE618E64E584063176384C4DFFFB6366CC6F070E1B9CAA0E6B622DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 fe05c391d531c3058af19e81de51553520727ae7decf58ddd6257e1b4489b1b4
MD5 2ccfca624c328dabc424b6c19294b1df
SHA1 189123c8919c113fd0efe84d838f918e9a88f92b
SHA512 2eba9d0613de0200b9e4e58f9ce30b519a0ea168b7b60e5dbfb9c8a0a4844086c9b2fddfafeab14d6cae22c9e93471ee74c55fa67ba193c87cde5c0f00354eaf
SSDEEP 12288:2ap8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:2ap8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T171D4234DCE618E64E584063176384C4DFBFB5366CC6F070E1B9C9A0E6B632ED5F62981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 7218a83e2464e8b904038f0e0d8349dfb729721198a1a9e1a617cb39a0c4226b
MD5 be9923c4ecb5b4fa37a9792596abc484
SHA1 bf9fa82e9fe78a67c93be3729aa3fae5109c7882
SHA512 06d85d9c0985f6e24ce4a6cf51764ce359956d535d700dc56a348a65b7907398bfc8387d46867c9fabc7b501602afde91ad60340c93d258543bccc4137cbe29e
SSDEEP 12288:0ep8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:0ep8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T19ED4230DCE618E64E5840A317A384C4DFBFB5367CC6E070E1B9C9A0E6B632DD5F66981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 105c16cf186c22d310cfa2a269e39192f27b0593886c43ef8f5bdbf73f73f570
MD5 a0eb7c273dcf9d2c0f1368daee0c86fc
SHA1 bf1a85447053bae10425f8b5e94323da568fe6d2
SHA512 b372808bd9f12b03987a6353572849037757c5da6de9291926fd2d154ac3eab250f2b48b62d378c44e7035b2eb31bbd66befc0507e05a02a4d05ae358183a933
SSDEEP 12288:Dmp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Dmp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T151D4230CCE658E64E5840A3176784C0DFBFFA362DC6F070E179CAA4E6B632DD5E62941
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 7a0b81fbcb881311b6d2e71ed80dee1cfdb29424497892faab74a62e657f9905
MD5 f743238d193155908370a4d9394bbcfc
SHA1 eae9a233a4c86c7e56bd42c5b5adb926c01f4114
SHA512 6fdc27116bd7df0aad58178c8c86fa1985a51b3c49327f4de3a6e73a0cb0884efe37b0a7069e3c6268ed480fe11d7e58169480d999ad541fc8c1f6888078fb80
SSDEEP 12288:6cp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:6cp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1D6D4230DCE658E64E584063176380C4DFBFB6363CC6F070D1B9CAA0E6B6329D5FA6981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 7428f443a018915d4a692a2e35789b87d7cbdb7bbbb34fbd87d194403e547a33
MD5 8278a1d574b240a5de379b2958efdaea
SHA1 8db88fa3a13fd80d69484c241c4a4603005f85e0
SHA512 8ead092ff84fc39187e1374dfd9e8dded35f0671d0f9b1c97104606e3846342120051978d15d4be2d72e78691d09186dc27c9832158787dbd825e6eff1f4ed39
SSDEEP 12288:/Dp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:/Dp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T17AD4230CCE618E64E58406317A384C4DFBFF6362CC6F170E1B9CAA4E676329D5F52991
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 28a83eb209725c904e20baaaa96b3135dafd66e0f9c2fe7b268e5eb51745f6b6
MD5 0b4ec3aae26e0f3b8f92f960e4c6e2f9
SHA1 6eb0361b30c516a2c385054dae476f50e58f44c2
SHA512 f617a26e334a46fb38b5018fef4ec338031bbfccdae16ec19e190ecad9fd1ca999df50748cfcd39bd2d6e73873d263afb93fd53d3fa971369e91e994b8a6dcc3
SSDEEP 12288:7bp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:7bp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1AED42309CE658E64F58406317638484DFBFB5363CC6E170D1B9CAA0E6B632ED5F62981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 56d7071116fe0987498b78222808ffa2e91a3e6cee31737576b3cc10e6aedd74
MD5 c159e195d7973448842cba6176cb4fd1
SHA1 6c916388d71f7d4139cc550cfce8576929dd44d1
SHA512 48fb7012948886af521f833631242c1860c57c72bbca0578583568e10480accdad1d1a4f90236ad46ca407ee1820249f0c9cd963ab93f1ffc4762b2b0271026f
SSDEEP 12288:z0p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:z0p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T19DD4230CCE658E64F58406317638484DFBFB6362CD6E070D1B9CAA0E6B632ED5F62981
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 ab1ba073f3ec89699ae851077a2b46a94199ca81b544abb9d64e38334e42cc08
MD5 acefb9f83c3032eac9718d4f4fa36a93
SHA1 545b0c34136b15b152855e143ccb03972b26dbdd
SHA512 db9de33213933f4e68e161b29b77727403aeacc882ee9674763208a516f0175ee9cab5a8a75f2692979c71cf6470e23e1c449779cde52319e2263a371a78a649
SSDEEP 24576:jYwvtk9RX6wkyAIkp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:9MnYIkWS1SZBnHTAsi
TLSH
T19835D029EBD848E5E1B7923C99B7460AF6B178691B31C3CF0299536D0E33ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 b2b47ad38549c90659f2f74f853b7ba70a388991b7eae2643243831edbfea59f
MD5 c1d66c6351f56c6526cc5b0e334199fd
SHA1 b1c65708810f4bbfed29ba140819c9374d82d152
SHA512 e87bf2046182efc26eaf826a59d3a7794656b0c62da87e70db722d3c8d39beb6a67b0ae658b8afad4c8cd65aab34cb09da1c88cb22e5897930491cf92e15c21b
SSDEEP 12288:7usfbp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:hbp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1C5F40109C2A446E8D09E1235DB644945F7777D2287E2938F13D0F93E1F762989EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 5c2b0399b007d6d76a48289823c320be3f394684d42f820a539f64a1fb70a621
MD5 e18a271bc7f028c2e5057ce75907684d
SHA1 77dbdddd5537116fb9f700e667606e597d1302e3
SHA512 b3eba95e3fad3c2e9dbf9cec34ceefe8a3d036cb990e0269bd3204be6b414a579e85ae9922546bafdcfb6701bba004feab05f628ac17d39c562aa48410504eec
SSDEEP 3072:iokdkdxlz+PZk7W1wiJq7pz9M1n446zQPFkBgfbFGjg:9AJ5
TLSH
T1DBF3318A852FC4FB74238A87C3795CB44593764A535E491932CFC2EEB641903CA2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 b6efb97421c1919beabfde67ef546c3c1d0d685113f5f39dea99bd00cefc32e7
MD5 cc33d5862e9ada1fa996c777eec40413
SHA1 0e834ea605ae0179fbaa95bd6aefa5f6e0daca59
SHA512 117818e1b9e83215e9afacc75e4c2c15d12213536a517f583cda873f2ba184e241763fc7a65b924e9c9770df377e975856e056799fc275ef8279ecab90755b8e
SSDEEP 12288:ji7Wp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:aWp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T185D42319CB658E24F8C80630353C880CBBBFB375CF29474F5658A64E76726DD9EB1A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 aa670878845621a1b6f8daf27ad50606e26d77ca983b6f86956aecc4a976bd9b
MD5 afcc1eefe7127a50b23d67f97d5b8849
SHA1 bff0acb74846b7e820ddf5d9adbc1de5238d554f
SHA512 2b4485262ca70427b7bcb1778bf95285e176476b2a93b74621f104e8e51434784b7fd1fef25c2b6d835f513c592f75310681b5aad5d579b527a4591ebc12efb5
SSDEEP 12288:20GFp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:zGFp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T14EE4232C8AF149A4D46847356434480ABAF37371CB2917DF0AE4E63E9F626EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 39a7be0f2ebfca71bc2fc6492be613e1202a802defb164ef8f371f4d3a575b42
MD5 f13d18b24227ea9d2a02055e2f1798f6
SHA1 071bb4e4064fe1a2dfb20ca2f3542a153f036a85
SHA512 9b28be9d0f9604582084fff0edcccf2ff11ec6b26b68bf89c06ba590cca183b5b763f16ce9ffba2184d7332c49593addd915706aa3dfe7b98366a1da2b32aba7
SSDEEP 12288:d+p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:d+p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1C4D4230CCA658E64E5840A3135384C0CBBFB9371CF6E07CF1698A64E27636ED5F76942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 a41a7e24ed0c7b30fbadfbe047b4b4a48f37f81bbdb569255b55e4e7bd2c9690
MD5 39d1f34cb0521609747d6697bbf07ffc
SHA1 3bd5e2674ca9a2881f7e64f48ed5f3a5be8847e3
SHA512 9166dd51b09b3ccbda09f738ee26d6084dacd4320f9254f85ad673c034c5407527c576b2678ff6fe4e5824ac9453623ce39acf325dba20edf95a8d55a64d35c5
SSDEEP 24576:pPUr+NQZp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:pJQZWS1SZBnHTAsi
TLSH
T19605F11F66A80CE5E676A13D8955860DF772B462471293CF02E0817E5F63EECBD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 250605ac2ed177d010b42ddd929a96411ea8374b99cc9d6ae2304bbc801ed5b2
MD5 24975f3139d64b8981b7a693e5cbc936
SHA1 23723ae0e9e6edfacf6937e7c2f305d5f01f26cf
SHA512 343f0016e59d9fe34473da52f60d3b934c32093a996e6c745e33671b4d34442646121b5ec3fa53a41cc69a6cbcfc7da9e86ed10cc9979003c09973cca7197feb
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYWS1SZBnHTAsi:JG05lO43b1cNzAz
TLSH
T1FCD5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b265b44b91040f2a34d271e5127bd60ba0f9638a23da15f923d6bc274c7d536a
MD5 e1e0a77455bcab5d6cbe2ee994122bc5
SHA1 88adb57d7377e144552f90eff4c577cc29053913
SHA512 4e235e0cf715e0aa47209a6d93d1dc45af5a65dbd5f801fba4a6168e361c8b541fb2559bc021d23f203d6973eaa2ca1fc482af1a4cdc66cdf64d3b14b2c7e332
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkRp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:cNc/zEOVHFCWS1SZBnHTAsi
TLSH
T18D858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 3356b1fbe8f104a359f66a8a8aae3d692edbd0c0334df5db5d7698627d9ecdf8
MD5 828d8fde51fba3f5c8a763f653180572
SHA1 824b1028d6f97e38e3036543b0290ec2c741b780
SHA512 45b7eefed6ee0b10cf162e6a12539ff4063256bc336310e547ee0a17ec50debec83d75d26a3c8e13eae0812627465d324c6618ff15af15f97b6b8e0b0e00c1c3
SSDEEP 12288:/1Hck6j5ZI7Jp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:b6DIlp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T136F4F15C637A01F5D0AB903A96920405E6B2B171C7261ACF0BD8C57E5FA3EDCBE39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 fe81eec5e879d267559e7154505c3424bebd08d90811d272db1384e1de38957e
MD5 a0b829675ebc748d16e640de5b0cd2a4
SHA1 b197b01a8927fddd7f58219af14d5eacb16c3506
SHA512 841a0d75e37dd015bf677b33b345de0ed0d2e08c8e72f4ed8f1c943b8bae7542fcc33999652c65c6a81b3b3dc5fa6c9c93ae4f3db2797e7039ebb9c4fcf155b1
SSDEEP 12288:8G6ky7p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:dty7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B1F4120887A449A4F9A90634AA754448BF76B9318F2647CF16D0E72F2F327DCAD31F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4ba84e7ff15194cdc36838b5235da0a10ed450c3c797f733d59d28277e2b7165
MD5 bcab02d22f45f055025fffad7d27a636
SHA1 b9c7b2e37a17bbb26a017bba09601b7c286e94ca
SHA512 96f72d250ea54a29d0755fe5d8a0a8c751c55a716777d00866e75f0f54a3dd8285c11cb81e52a924751aef0eb22c14bb8724e9794db5d39b9b51f849432b399d
SSDEEP 24576:1TkNvNnaFeYhJNtmZBm2p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:1TMwBtOm2WS1SZBnHTAsi
TLSH
T12455AF2EAAB846E4D1FAC6749D238516FA727461073253CF5390C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 558c83b7a1150874c151b1efc5cc990f8322e5ba340aacdaf4c411b257ee8cbe
MD5 1105354cf67e0c03eae9dd438547f2e9
SHA1 2259ab0dca114f2c7d8c49d4e7c16ba3f93adaa1
SHA512 a9d03fedf143b80a9aeac95eda95bc321d12ad992758feae15f47f02f10660900afc2ee5c50cd47b45fdae1031b42f3bc29582e041767b66c845d40c2315feb4
SSDEEP 12288:xyS6b3IkxjbBzhzp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ4r:j6Uqjphzp8SXdo8ke5i5Xh6wnBLTHTAz
TLSH
T171F4120D87D048F4E4680230A9748019A6B6B9724B7A57DF36D8D67F4F32ADC9A3BF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/824-141-0x0000013819B50000-0x0000013819BB6000-memory.dmp

Download

memory/824-169-0x0000013819B50000-0x0000013819BB6000-memory.dmp

Download

memory/824-147-0x00007FF64C810000-0x00007FF64CC26000-memory.dmp

Download

memory/824-146-0x0000013819B50000-0x0000013819BB6000-memory.dmp

Download

memory/824-170-0x00007FF64C810000-0x00007FF64CC26000-memory.dmp

Download

memory/1100-124-0x000001FB75E90000-0x000001FB75EF6000-memory.dmp

Download

memory/1100-123-0x000001FB75E90000-0x000001FB75EF6000-memory.dmp

Download

memory/1100-166-0x00007FF74EF70000-0x00007FF74F6B3000-memory.dmp

Download

memory/1100-290-0x000001FB75E90000-0x000001FB75EF6000-memory.dmp

Download

memory/1100-291-0x00007FF74EF70000-0x00007FF74F6B3000-memory.dmp

Download

memory/1100-122-0x00007FF74EF70000-0x00007FF74F6B3000-memory.dmp

Download

memory/2004-90-0x0000025B3A520000-0x0000025B3A586000-memory.dmp

Download

memory/2004-89-0x0000025B3A520000-0x0000025B3A586000-memory.dmp

Download

memory/2004-88-0x0000025B3A280000-0x0000025B3A3FD000-memory.dmp

Download

memory/2536-60-0x00000123A87D0000-0x00000123A8836000-memory.dmp

Download

memory/2536-61-0x00000123A87D0000-0x00000123A8836000-memory.dmp

Download

memory/2536-59-0x00000123A8530000-0x00000123A86AD000-memory.dmp

Download

memory/2712-2-0x0000000002FB0000-0x0000000003019000-memory.dmp

Download

memory/2712-6-0x0000000002FB0000-0x0000000003019000-memory.dmp

Download

memory/2712-0-0x0000000002D60000-0x0000000002E2F000-memory.dmp

Download

memory/3172-25-0x00007FF786800000-0x00007FF7868C8000-memory.dmp

Download

memory/3172-121-0x00007FF786800000-0x00007FF7868C8000-memory.dmp

Download

memory/3172-28-0x000002CE6AC50000-0x000002CE6ACB6000-memory.dmp

Download

memory/3172-27-0x000002CE6AC50000-0x000002CE6ACB6000-memory.dmp

Download

memory/3172-26-0x000002CE6AC50000-0x000002CE6ACB6000-memory.dmp

Download

memory/3320-14-0x00007FF7C2530000-0x00007FF7C2652000-memory.dmp

Download

memory/3320-15-0x0000026663E50000-0x0000026663EB6000-memory.dmp

Download

memory/3320-17-0x0000026663E50000-0x0000026663EB6000-memory.dmp

Download

memory/3320-108-0x00007FF7C2530000-0x00007FF7C2652000-memory.dmp

Download

memory/3320-16-0x0000026663E50000-0x0000026663EB6000-memory.dmp

Download

memory/3388-75-0x000001C0D71F0000-0x000001C0D7256000-memory.dmp

Download

memory/3388-67-0x00007FF7206E0000-0x00007FF720848000-memory.dmp

Download

memory/3388-69-0x000001C0D71F0000-0x000001C0D7256000-memory.dmp

Download

memory/3388-68-0x000001C0D71F0000-0x000001C0D7256000-memory.dmp

Download

memory/3388-77-0x00007FF7206E0000-0x00007FF720848000-memory.dmp

Download

memory/4392-101-0x00000162CED00000-0x00000162CED66000-memory.dmp

Download

memory/4392-164-0x00007FF630390000-0x00007FF6304D9000-memory.dmp

Download

memory/4392-99-0x00007FF630390000-0x00007FF6304D9000-memory.dmp

Download

memory/4392-102-0x00000162CED00000-0x00000162CED66000-memory.dmp

Download

memory/4596-37-0x0000019EB3630000-0x0000019EB3696000-memory.dmp

Download

memory/4596-35-0x0000019EB3630000-0x0000019EB3696000-memory.dmp

Download

memory/4596-140-0x00007FF786800000-0x00007FF7868C8000-memory.dmp

Download

memory/4596-34-0x00007FF786800000-0x00007FF7868C8000-memory.dmp

Download

memory/4596-36-0x0000019EB3630000-0x0000019EB3696000-memory.dmp

Download

memory/5032-109-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5032-115-0x0000000000A50000-0x0000000000AB9000-memory.dmp

Download

memory/5032-110-0x0000000000A50000-0x0000000000AB9000-memory.dmp

Download

memory/5032-165-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5140-130-0x00007FF755B20000-0x00007FF755BCD000-memory.dmp

Download

memory/5140-131-0x000001B145720000-0x000001B145786000-memory.dmp

Download

memory/5140-132-0x000001B145720000-0x000001B145786000-memory.dmp

Download

memory/5140-167-0x00007FF755B20000-0x00007FF755BCD000-memory.dmp

Download

memory/5204-80-0x00000223994E0000-0x0000022399546000-memory.dmp

Download

memory/5204-79-0x00007FF6BD020000-0x00007FF6BD139000-memory.dmp

Download

memory/5204-81-0x00000223994E0000-0x0000022399546000-memory.dmp

Download

memory/5204-161-0x00007FF6BD020000-0x00007FF6BD139000-memory.dmp

Download