0a0963403595f38827cf2fb0a57ff6ce2cb44e0f2e86318631903f326910a5f3

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe
Size 836KB
Sample260720-ctep8ae13z
SHA256 0a0963403595f38827cf2fb0a57ff6ce2cb44e0f2e86318631903f326910a5f3
MD5 fab068d1671736481b55d9880d9b4c00
SHA1 e7e1d73839f092dcded4b53a1997ca7acd39a83f
SHA512 56c2c62ef2ffbd74d3224e4f1fc0df8933403224244f8d85fd23f3491175038283f330a4a2841636c4eeb5dd1f239bd3432f8991926e432260c2f5d2ea90647a
SSDEEP 12288:XBxk3npArWaMU7WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:XBe6fMU7WLEkgXWHiYKbfZB1v3adCMW
TLSH
T15105F11A77D80CF9E963C17D89528606F77278490730DADF07A1017B2F237A1AE3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2556	alg.exe
2164	elevation_service.exe
5140	elevation_service.exe
2896	maintenanceservice.exe
1596	OSE.EXE
4444	GameInputSvc.exe
5084	GameInputSvc.exe
3228	msdtc.exe
248	PerceptionSimulationService.exe
5376	perfhost.exe
4400	ReFsDedupSvc.exe
1204	locator.exe
2920	SensorDataService.exe
3600	snmptrap.exe
3020	ssh-agent.exe
5520	TieringEngineService.exe
936	AgentService.exe
2152	vds.exe
1668	vssvc.exe
1616	wbengine.exe
3188	WmiApSrv.exe
4224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43f31b8b8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\GrantUnpublish.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\GrantUnpublish.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	GameInputSvc.exe
5084	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3852	2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2556	alg.exe
Token: SeDebugPrivilege	2556	alg.exe
Token: SeTakeOwnershipPrivilege	2164	elevation_service.exe
Token: SeTcbPrivilege	4444	GameInputSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4400	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5520	TieringEngineService.exe
Token: SeManageVolumePrivilege	5520	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	936	AgentService.exe
Token: SeBackupPrivilege	1668	vssvc.exe
Token: SeRestorePrivilege	1668	vssvc.exe
Token: SeAuditPrivilege	1668	vssvc.exe
Token: SeBackupPrivilege	1616	wbengine.exe
Token: SeRestorePrivilege	1616	wbengine.exe
Token: SeSecurityPrivilege	1616	wbengine.exe
Token: 33	4224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4224	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 5084	4444	GameInputSvc.exe	96
PID 4224 wrote to memory of 4796	4224	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fab068d1671736481b55d9880d9b4c00_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2896

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5084

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3228

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:248

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5376

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1204

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2920

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3020

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5520

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2152

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3188

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ed5569fc00369e9250f7fce68207216a7ed44530f8bf28e160fc2c83cde44d4b
MD5 897f4cc730cdae162cc3043d07085410
SHA1 44030ebca338580dff2bebbb135dd3e152c95eb0
SHA512 5222c3033a66209366acac5fc31d8b4900d15506c4640bfbf4b2bd50aa4fa8e9b7dd85e1ecf48147a8066b492f071bd6507c7523aa2c9f4ecbbbbb797e03cfd2
SSDEEP 49152:Vqn632BuPkFKRrdE6oh7stBhuXjfS4LWxn6cfT1S1:B3q6gjBJcfT1Q
TLSH
T1A8D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 0560a4ba70ddf1039a24e52c8585e70ed58d431e96692c5b084880d4302143eb
MD5 4eb827b968e76114861163ebe8b8dec4
SHA1 fc9e8c2c59315955b6fe278046d663003fba9f3a
SHA512 6fc2f7bd5ae841e24311062bab1d95eba5406201ae317a3e41efb8b8f6b58c395c4de319a95f9744f4f19d6854a3b14db7f0a5cbc1f279e5506ae95f0aa1c849
SSDEEP 24576:lXYNaDczAlWLEkgXWHiYKbfZB1v3adCMW:LDcVcfT1S1
TLSH
T1C405012973E009F9EDA3C17DC972C512EB3278954750E79F03A488661F237985E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f0c9cb4f923e759407685018ec4082822615ea215696a21291eaba85bb06e873
MD5 0e5f4d6bb0ed2fd4e8a070eeca374a51
SHA1 72cc8a1218549a437aa4e89bc641fe179d02faeb
SHA512 907621e8ab287eb2642341d581f696b66be0021421c9a626be5629563a7cdf1f5608f7bce8903179dcf40a997585e7a0b6399c69760cc2939d52f58dd36c0bc1
SSDEEP 24576:l0Ne3jY0donOrMeQWLEkgXWHiYKbfZB1v3adCMW:lHjY0WOtcfT1S1
TLSH
T190359E16F6748335D073C0B9C5D2A68AED7130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c7bd239949a40d76d6dfd21c47d80e86bf80b9a0460c3d99a0721d2d256f6cab
MD5 d5194f5b8e2bcebb5866d842f908272b
SHA1 1471bfce8951b891b9d6c6592f95cd36f69368ec
SHA512 1e94b88d85ae211abf9a266c03071accba96ac4342e3263711c6e8846ed9500ff101f723aa2f703f4290c9a639076f7e787e88359ffcd2ff26296ca272990729
SSDEEP 24576:NIycezSC6v/yD/aqgrvW/6q8wyuKWLEkgXWHiYKbfZB1v3adCMW:3cezSC6v/zPvuHjyIcfT1S1
TLSH
T111756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 11c2eaa8ba1d99245b17641f18d0e0aaa7f40c2fcecbf92183d8bd7399b0e1ce
MD5 e290f0b58371287efdca495a0024f16c
SHA1 85f9b3ac532ee3e944cc19145c94ecf2ba4ad427
SHA512 af06f3ec9eec61b558618a2560cb4e82480f59f7ccee1ab8e7923ccc570046139ae1603a989faee185180146d73bb6b2083e363bcfab515063f6375e5518fdba
SSDEEP 24576:7AbDPbx80Hpl+dmWLEkgXWHiYKbfZB1v3adCMW:7ALx80Jl+NcfT1S1
TLSH
T10B559E66F5748335D073C0BAC5D2AA9AEE3234424B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 5e2056a66797352b994b175873e5c2922747680df71176935b5bbbc3b25dd7c2
MD5 a16c780f70b4dce8221af43dd87665da
SHA1 2b2fd200c4f33ff931f7c82afc4c3b4beca1b3a9
SHA512 3e4c60894c5c30382f86fb8ca05902fb37486a7e296fd604eb278c264ceefa9170fd40c8273fa90e09fd470dc2f7564715c5f2a18aaca6c5bdc56a9ea2f2948b
SSDEEP 12288:QwVcWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QwqWLEkgXWHiYKbfZB1v3adCMW
TLSH
T13DD423136654269DEBC1E57A5333C8973B7438D48B00B96E8B72649739B4A0BEEC70C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 b54599c75885c6edde16a1a09f16101ac2645ca74a9cab332432f72b6fa09528
MD5 3ddbf1cf73dbba3755447408215d016a
SHA1 b1c04f8dd8cf085aafae9314f1c747594c1b5626
SHA512 542819f1d6ff99027ebedbac2b990c8bbd368fb7047b31d30f9def8e7ef086a0d0adf3cc98a86c13df137c3637bfac0bcf4cce54c06338e297036d3cdb157f75
SSDEEP 12288:0eBNUbTVO86UDWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:0JIUDWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1E315DF3BEE28FCE2C27A9DB95761C600A77274704F11A3CBD175820E9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 aa228f83f6e02fa7b8441d0d83fb4c89f2e97bf893becec559ae2bd09941f771
MD5 05a838d156a6140f46113862a15ee4c9
SHA1 98a8741ee7cb3cf5bcc3e069446f5cf9eff1501f
SHA512 ff3b21a42a20fcf268b9372050acabc1a963e36258025d16607122dda7f49d8f629efbde2fb3e91c8d1aa0d830bd54a6a0fdade97d73e9fd0f81d86e0d8803af
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THp:DQvGAdlCEL8c/NRNw5C0cfT1Q
TLSH
T132367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 7168068657d72b01f23ac6031a6b90bd21e881671e4cfa0c63e1819dea23aa8f
MD5 8680a1f604d92d6b421bbe3106ee3fb6
SHA1 5d54be3c2bf3a4defef5dfb3a3c86480efaf0f67
SHA512 6d46d83f24f04807fd2903dd6f4e06fe7aa5a9327e083e8cce143d4ce195abedbf462ee66a5add9df30b7ea323e5391958eb9b7ec48fc9f1ec23d2f5d11b4fe0
SSDEEP 12288:JIwSfxL/2Dc3bDLLmt0LDQewsAjmWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkK:emewsAjmWLEkgXWHiYKbfZB1v3adCMW
TLSH
T12A15E031FA74E036C7BB0DB61B36C716283C79604F512AC7E3B8899E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 783c4a32f102b9f7650ed55e177e74957b0dee55e099af6d16d3b04b8d1fdee4
MD5 8c88f09fdd2402395bd3bb49dcb62e3b
SHA1 8c441d0f8a372f05dc165ebb2fb41dfa97849704
SHA512 ba9301e6ad2c1ef5e0bdea41c4b9f5a268a77781a65e89cc2f858257e38b21e04bc7fc05b57ce03a3af23cbfe53cbb151744fe540f6325cf1f852104369e40ea
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHRT1:FUEtQevvqc2W1cpV2X132
TLSH
T12D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2687a1754c584d5dc80899a24b0a3a1d1512536244b19e5deb5f814bbdb4008b
MD5 c373dc8d5e1948fac96f205d868bbee5
SHA1 c67ac0b146d3c0ea304405e40cf91db80782ba7c
SHA512 111e25a2b3721c9dc21a3588afec976d961164a5b56e2931410178a5dec9f37e8084b1ee401714c6c13f11fbda7956b3ce08583d570f0a05d6df7a697037c32e
SSDEEP 49152:erbRquA/m2yL5zMfFiV+XenmE3/zgcfT1S1:0oq1VjnmTcfT1Q
TLSH
T18AD58D1976B882E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e8c1f7bc88dda2c13e686fafceacde631dd527fbc7285d609b05046317493e49
MD5 ef264528aa184df627f3d5937d8d7d40
SHA1 ea416859be71dfce144d42d33e2403e99034969c
SHA512 cc07f570aad4e2bbd70761d9b31c83e03072727bb9f552ba814a303fa4cac3ba6941f8318af7e55c716d6c355aad585bfc8d02e029d9db4a7c58ce3769ac0b37
SSDEEP 24576:BAhGLvXFoiwtA5l7S53PXWLEkgXWHiYKbfZB1v3adCMW:BAMTFoiq5+cfT1S1
TLSH
T165459D81E7F955D4F5F3AAB899B68171EA76BCAA5E30D20F1160C11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 24a677dfbc7900abaff585e004326b19a1140efadbdcaeb189b5c9fa412c368e
MD5 2661a084e5a091aabf135e3d08348015
SHA1 caa9b5869be953e8c5a7c26c64c91ac7d2520deb
SHA512 f9ed0733fedd9fe169c3eed307316e2d49d698c049dee577b5b61e2d58ed2ae4bc7e3747dc88e964303032ecdcfadaf2e3a1522835533c293366ce7b7c7d7dbc
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CRWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6I:Owu+OW+WLEkgXWHiYKbfZB1v3adCMW
TLSH
T10305F10676A41CF9E9A391398667C536F7B278512B20DB1F0770C65B2F37321AE2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 757870000688d2e99231337cf98daeefeefce5c2a41cccd08313e65deb72c2d4
MD5 0bbcb859c263032c99852f0a0d045abc
SHA1 42f6377c8711a821255b76467503e6dae2413409
SHA512 f007112c8fb4ea1f6a3acb39e60b3c4b94f601d788c463995f588ffa3b129e5fa181b5a3fbf121eb5a819bd5fe7659f88490eb262d06dd44688acadc20d7d46d
SSDEEP 12288:6rC1I9voWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:CCutoWLEkgXWHiYKbfZB1v3adCMW
TLSH
T19FE4121633E421FDE6D3D17DCAB28A46EB7134A6572053CF067140A62F62BC65E3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b1e75385d151038ca0773c88630dce899b72174afe14288f5eb6c0bd0b5645b0
MD5 3aa0f870d93a0dfd8a231b21bfbb16e6
SHA1 b55bfa5cc2e1d2ac0b781c9550d19ba8feff4d45
SHA512 95e077f28f77b825549e77a91edc90e651a143faaa6375f9654252f6591a52ca4216ec2ae0442221b0bdf431f919cbdec3213a628a10b45ff2fbf94b6b3d82f7
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U8:mQRQyi36YOcP8Lvw2gAf+PN30cfT1Q
TLSH
T181667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 eefdeab85cb38a1d9b46e30cea8dee40bf2e1b109e75dc5f2ee193e8df97b5d1
MD5 2cef78aca5a41d9daee39a0c17421ac2
SHA1 0754fb49bc9083bf99de416d3d28388154209b57
SHA512 12e62aba07b1880b7e4de1003397333da7b00aa2c7f09e52167f927bfc998e3a884d95a2e1d434a5963a0ac2cbe6e49cc2b40b61d0ba7b2ee48e6e582c61c806
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U5:mQRQyi36YOcP8Lvw2gAf+PN3ZcfT1Q
TLSH
T17D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 99bd01cfeba51ab2b988f14e388317fc598df033616007fb8d377fc9096dc15f
MD5 20af01627038792cc6400b5bba8da922
SHA1 c3073195834f06b6cf15fce6e808cc5800563c1b
SHA512 7893b8cca1ed1288fd1d3a1f3ce6ae6b319a4ec2d882958ec98c59d5141d9dc4599e2380df6656a2185d2a21f7bf4d583df377c95d07aa3c6ee090ad26cab18c
SSDEEP 24576:mwvy8f6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0HWLEkgXWHiYKbfX:T68Qg55nhMeWu7PNU3/vcfT1S1
TLSH
T1EBB54933B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4675a6c124a62f6135989412bcacce1aeddb3074a128e486613bdd3a2bc23360
MD5 1003d882d529679ae907911ff9983e6e
SHA1 501130327a1796a03f40043bad6cde995d657775
SHA512 aa9e8941f302fe8c7c7fea581aec1a90de06125523ef5aca2969e23593259e708cc5aa2d4cb70e5c82e7080944a51eb76773d16573fa4e21540466f507746369
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99K:yy5112gYy5azzVv569nLKnhZjcfT1Q
TLSH
T163167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 957d770a03c13004a37aaf128d0ab6148ec1675bf2769ba0a49228ea7871beb8
MD5 30bcd1c46c55b10e1c0c42f425e293ca
SHA1 1817e0c0ee48cc010bfa12a29d1871940d79a9e7
SHA512 066412fc099d30c5b0af8eb8be9dc462ebe7d5945ac14728eedcfbe4672d3eb8b9d7f6984aceef20d344fe21458567c8d2881e1ddbca4e0a2cd26a7de32a258f
SSDEEP 49152:7G+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl+cfT1S1:6u6JmTxd2d+cfT1Q
TLSH
T13CD59D13F1DA01E8D05ED478974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d91c322289517fd25055c936f7390fd0a8120ca026d264f0c796e74c947333c7
MD5 2c8d01e827dd48fcc0aac5a6ad2ce131
SHA1 9daca58f78eeb8e06c2d217a854d8badedbf073c
SHA512 f4c789ec33f3fb26433a378365cd6f7614ecedacbe1d285b42e73cf3db7898be03f0e62bba6101ee01a68bb2f1faeb281b55ec2d8358b70b546268d4f73d5471
SSDEEP 24576:ShvdE1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx34WLEkgXWHiYKbfX:r1hpsNoJpF1A6UU44CwH7R4xpcfT1S1
TLSH
T15BB5BE13F2D901E8D05DD17887569232EA72BC460B20B6DF0A90B6962F7BBE46F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a53fefc8d2df5b7957d1a267b114f444bdf5cba60335cd2ddf99bf2408bb4eaf
MD5 73d41b6fae4bf3943a110445b06c5710
SHA1 40ebdf88de08615099547b9170681a0a05d0ddf7
SHA512 7877a4044f6d1e8d075255a54f676f62ea1b267428e00d62544111671a4ea2a2643c06b2f07530e3b833075a2f199e335846ebed941304ebacefb919e0add6ee
SSDEEP 49152:cSuZQIY0Be2K6RVtOnks6NMHq2cfT1S1:e5dKoi612cfT1Q
TLSH
T15AC5BE13F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7d21c7437ba4af2417b5d031c0d7bf3288a48ad2dfdc812d86db5e2647eac2db
MD5 5d8dea6ae049b8bce07b97c380987271
SHA1 ab4b4de2115bedbbbf457e9373effe2e1e87d8c7
SHA512 0791c9bd86d87066a5f80230cb829dd3dbbd307da6d161cee5194d1a823cdfd7ada056661b298b7b3a19799e87f871502f05c4b87b042a873ed99285159760f2
SSDEEP 24576:0K7avFPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLwWLEkgXWHiYKbfZB1vF:0KQSn8EApI0figTgiDn0AP5wdcfT1S1
TLSH
T176A5BE13F2D901E8D05AD178C7568632EA72BC150B34BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 379be8fb44a998a9a78599cfd77fb7b49f8f73a79ffb23aec30dba7e0251a139
MD5 6b9caf2719908ca9effbf87edad88250
SHA1 4a553221980166ece062b64d012e164bf1e5ca4f
SHA512 84bf6b495902c0d03e7b2a20601be2e94d0c099ee611a1d8f8e28bede8fb5ee812888eb78a091d819609fcaa19f016de84830267af0ff70f8c03b7a4af85b1c2
SSDEEP 12288:H3cWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:H3cWLEkgXWHiYKbfZB1v3adCMW
TLSH
T10DD4231275961B9DE6C0E5BA9333C5967B7834D9CB00716E8B7650433AA4B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 2e4644b587289d75da2fdcd0729cb3e0dc6ef3c31566163a83d9059b811245c3
MD5 2889f9b103a6b46034eff8d95c5051f9
SHA1 60c2b122d861085b6632a268a38480dc826366c8
SHA512 54a0d23063e7fa90a45acdece6d3084542b898e6937ce7aacde46e4747c0522c61d46391c6fe9695bab2b59366545101f31a2b7599bab322c312e1dcbb5e9d24
SSDEEP 12288:9jcWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9jcWLEkgXWHiYKbfZB1v3adCMW
TLSH
T111D4232375561B9DE6C0E5BA9333C5967B7834D9CB00716E8B7650433AA4B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 14135aeae9d5f09214215fd9514329db5c924f48c9dd31cc35e632477239b0ad
MD5 80c4172483e2ada091072758bde11b3a
SHA1 b64029a3c1169da40bf6bf4c2ac357073308dd3c
SHA512 ed1aa90cd23c654a130d415387312f47e094c6a2dd6e169d5badfd19db75fb52c48ef99fe6a8e7c9f1b28e9bc4bb14ef6b553f9bae4e7c016cc8754b99e52755
SSDEEP 12288:fRWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:fRWLEkgXWHiYKbfZB1v3adCMW
TLSH
T159D42313755A1B9DE6C0E4BA9333C5967F7834DACB00756E8B7650423A94B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 03f2d90c596f5bd1aed334d4b29dc33f1bba52a58091371395560e9ea66d011b
MD5 af664625c6e3cd35aaef52a6906f090c
SHA1 660f25190117208d55efcb89ddfcd2e66c614a53
SHA512 2568cc7ce0f1935e046177da88be1eeed3213a97a8105276e5cae3a3cc8ee0cef4b7a7015fe0567f353e466cf65e5cc64a601c8004bbeaf21bbd906679b370a8
SSDEEP 12288:OlyWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:1WLEkgXWHiYKbfZB1v3adCMW
TLSH
T186D42313376A16DDE9D1E179C233C556BBB838D9CB00766F8B2104572FB0B06AE862D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 f9cab9eaf87edc45eb9db685fc1392f218034a82aacfeea05ecc0392946e3802
MD5 d4d959fae24baed628a9112bfb9a8fb6
SHA1 506dc283b40685094f254d86d75b339b361a0c53
SHA512 2081d85182267eac9529ff92810fd364c641f80716be283d06f8da07d6b529e1f43416650ef9abfa2ff64409140cf918cb2d6f4d874b55707cf9a0878ff5d1c2
SSDEEP 12288:OoWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:OoWLEkgXWHiYKbfZB1v3adCMW
TLSH
T133D42313755A1B9DE6C0E4BA8333C5967B7834DACB00756E8B7650533A94B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 0ed7e04a745b4772e2fa78a9bebd2f6ff2b9927500564367d2729e29d16e2fd2
MD5 73918529b567f6923fa328b140689e54
SHA1 82963a53e8aa68dfc608345224c8f4e7d3ec3368
SHA512 f1e430642c0489702ea3a6ea833c78b512b7866aeca346b6b3ca32c587517b16723881f012b880414a22698f5156c87e72cd33ede742929bcd1e6570f1588ede
SSDEEP 12288:tLWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:tLWLEkgXWHiYKbfZB1v3adCMW
TLSH
T17BD4231375961B5DE6C0E5BA9333C5867B7834DACB00716E8B7640433AA4B0B6ECB0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 b422254ba2ee0ec27a0a9a346011086597c9c57fd5ccecf2b4e0b6f5b84141fb
MD5 42c09d07872652f7128be51ecd05f4a0
SHA1 321ef3795145314744d346c19bd5497b9376231f
SHA512 e091c1e3860c89e96b8b01d9f4ef0272667a359e78db38a61aacc9c7039602eb57f0c62c0e803725b9f57b46e324f9b833721e167c959628acbddfe36d06f9d5
SSDEEP 12288:G7VWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:2VWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1FED4231375561B5DE6C0E0BA9333C5967F7834DACB00656E8B7640433BA4A1B6ECA0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 b9515e4f5d023333396ddd5e6370e1d6b23dae37e3c5cbc9e85b1f3de5e56727
MD5 f72d5393bdf420bed25bfc8ebf501a1f
SHA1 71b31abe0e1635299c9ce29bbcfca5ca49fddcf7
SHA512 b1684eb1b5319ca4f6abc5465f14873e2267d7500247962aebf48145bfa3219562f3daf0b52de19641993a2401cad560ab9b1897eae426828371c94d9de310f3
SSDEEP 24576:BZMkzFXSc4WLEkgXWHiYKbfZB1v3adCMW:BZMkz1jcfT1S1
TLSH
T1D2150255B3901CF8EDA3C13EC9268906E6B27C5A4B60C61F03B435672F737611D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 204c7a13a3f47180e93a2c32eef4b332048759e0f9eda1ccc11eb471f8e45d4e
MD5 be53ef18fdade829c4ee021a69266d21
SHA1 d9786cc0ead7deaab75a27c65c42de854e5f3240
SHA512 5bf9c0de848673074ce669802b9e03d08f14911f948ef0628bffa4d162646ad76a1bb7150d12a3ce847c9c6534a86c8ae11c5fdbb27927889cc37a269227353b
SSDEEP 12288:79KWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:5KWLEkgXWHiYKbfZB1v3adCMW
TLSH
T134D4231375561B9DE6C0E5BA8333C5967F7834DACB00716E8B7650433AA4B0B6E8B0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 364995d88c6f687e1e4089d71819e7beea844b8ebf98afaa9bcc3fbd7f557a6f
MD5 a347a0b14b42f565e6036d543549caa7
SHA1 62e2b67b9f292733cc71964fd52eda48f1670220
SHA512 b373b235db88c7cb11f8f98b2e03ba8ff6ad2db2f12d68654686e0ae11c604647b47d99563fa93c017be24f55d281c415a76675c978268972874bf21396b1092
SSDEEP 12288:n7sWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:7sWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1CFD4231275551B9DE6C0E5BA8333C9967F7834DACB00716E8B7654423AA4B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 2c4ab1876756187398ab5f758320c176f68d3882c195f517d66132ecdfdddd21
MD5 cdb0830c2a09c21d72f8c9b4a7336f82
SHA1 1aabc7d61bda959541b6d2bc28651b3b8cc282a8
SHA512 442f02b77f528c6e71065f0a5f2c62c2288a243f00f351a1c1540f2b2ea5b2a22e34bb5a160f168a970639ca0e7e859f9499d7b7711ecd764ab8cdfbb0441b3f
SSDEEP 12288:wHPoNLPYWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:EotYWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1FDF4121773A131FCD1A2D239C9724A02F77538B64B209A6F07A006772F63751AE6F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 343e7dd0deb253bc5cc031ca56a24499e7b93fc194268932daa9bf30d208838c
MD5 5c48799614afb06367dc0bf7b9c84e3d
SHA1 d02b2b962cfbddbfa66eff4c4bd58f88fac3a9ce
SHA512 9361b841da3d6ab409e438b90e2a16af51755aa1da5422369d90c7998befdab8708433846064a37df5546582c839d427692f33bef58f809667f1efc8b9ef32e2
SSDEEP 12288:lrNWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:tNWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1A6D4231375561B9DE6C0E5BA8333C5967F7834DACB00716E8B7650433AA4B0B6E8B0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 ca9b44ae548be9aa5d0d3f31ef2b48e4084e0d5b97c02a7d43dcf2865fc9031b
MD5 0c4f93cf148e3e5c58c54a8b1f013541
SHA1 ebda9ede43abb17dfbf7a50d14f45696a4174710
SHA512 b95f5cc25bde202aa6c6b3641e7688a66f9a6fd1fbdd73b7ee4d3d26d19bdfc8fca5e58f860e60c123f65c2677391e71ebe117a25cddb175e07bd1890c66bd8f
SSDEEP 12288:SWLWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:RLWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1C6D4231375561B9DE6C0E5BA9333C5967F7834DACB00716E8B7640423AA4B0B6E8B0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 1e27bb5d48ddbf6d689f804e1ed3d5ef9f184e3a582b15e1312230a9308215db
MD5 49cd1e419f4625a2ab4b6b23cfe7183c
SHA1 ac841dea4152d7b67dd28a62d024f4e6e6c35e46
SHA512 26a108f1d44222811fb50f85e170b0cf531b15e0406e61458a324235b6f1f1dd5f35a8d0b8b0cfef208426e97b6bd4a02fb990ea4fba6887c905411f6f6ed365
SSDEEP 12288:ZHPoNLPCWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9otCWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1E1F4121773A131FCD2A2D239C9724A02F77538B64B109A6F07A006772F63751AE6F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 0657b8d0fa9465e05f889d21efa53cc4a23c1acdd78c2717bfa3fe1ebb538f67
MD5 7df8f7fa51175d66e6a456697c1c37e8
SHA1 de0bf0378b5cc2d8ef5e58d8b1c45fcee4c85eec
SHA512 70efd99ac4e52142ea7a4e0bee90aa444ff46fbb20dafd94f5f7daf4398697d0c891fbd3265fc49c33ae6fae08947c7fcb9de695e8ade308e940673197586745
SSDEEP 24576:cTaaLC3z0zzvWLEkgXWHiYKbfZB1v3adCMW:cTBLCjDcfT1S1
TLSH
T1AE150265B3901CF8EDA3C13EC9228906E6B27C5A4B60C61F07B435671F733615D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 2cfd13100ed1c798251ca0664be0aaff6c81a4013ae4fe453865deb2f2d00ff6
MD5 12ed8b511fc4eac300ae725cca89fcae
SHA1 a0079411d1a5c9e173dc20057dfbde66d68b81bd
SHA512 88d7512ff9c7bf671e74fc1cc887a9436784fcf2b5fe530692ed821531521e89a49714e4266f80d635d10af53a19ac9bff022543bb0067db70058c6c7926f9e2
SSDEEP 24576:P3BdOCHVy7PMQWLEkgXWHiYKbfZB1v3adCMW:fBdOCHVyDgcfT1S1
TLSH
T1BD35CF90F3E414E8F1B3DA3589768512DA767C9A5B20DE8F03A4255A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 7e07ddfcaa46467df4921d8f62e5a31dc8978da0286297a16607e35c2b7aa65d
MD5 140416c08e8709207c8f3e1f3026d010
SHA1 3c167700765143c8781fdc50452406012d6a3703
SHA512 97cf8026ddfdee3e4cdd86832ba5e3fa3cb7dc25a3c4dd538d9c68d295a93528fe7360a43ac1e31aa5255e4bbb1eb5442a9ddd7c5d6955ab04742e53051fe50d
SSDEEP 12288:hzWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:hzWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1DAD4232275661B9DE6C0E57A9333C5867F7834DACB00756E8B7650433A94B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 dbb8a050bb15114e995f642387c87bfe692756a617f3e015e1eec7705601df89
MD5 46a6392ae9740dad1188d3509812b6c9
SHA1 29082cc249ff40f3354ddf25d5e661870f17f93f
SHA512 f598ce01875c89e8c163f85bfa2fda5888a999d0126b25b52a007a794664cc20f6afe8fbbda198150ead7350e72e936bab48a70d331028c16a771b49b1c7a299
SSDEEP 12288:IQWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:IQWLEkgXWHiYKbfZB1v3adCMW
TLSH
T105D4232375551B9DE6C0E4BA9333C9867B7834D9CB00756F8B7650433AA4A0BAEC70DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 30cecc588b34938cafc4be571f6ccf1c419f46f3c398dc0d9cb7bbea5f3f9dbd
MD5 6451a4166b45acc39b6cb8fad82d2f91
SHA1 8f9b6ec2f9d06f8c0662910b16d35e9257bdb9c3
SHA512 2039d60c38b75fae68fa9f348c0926d0d06e7df12675a618a77f95d7d0da404fadf32edb7bbee4b66f1b434890901c9b384c889452fc7ea12eeea65742e48b8a
SSDEEP 12288:gBoWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:koWLEkgXWHiYKbfZB1v3adCMW
TLSH
T108D4232375561B9DE6C0E5BA8333C5967F7834DACB00756E8B7650423A94B0B6ECB0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 77f18f51b1e1e55b543bd2eb005e4eef763620df301b133493ae3d3421e415a3
MD5 3ecff917dc0af4f3856dfcfdb6c7807f
SHA1 6612ac7db13502d31b1577d8c611eaf339c192fd
SHA512 69d03c23766f9a86942044c3bd5b99f5793ace9927fffaabbc4c90d27df19a8ca5f696b8f4a262a97dfd98272296af96961a0696b8afaff4a353f26e32518758
SSDEEP 12288:5d+WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:L+WLEkgXWHiYKbfZB1v3adCMW
TLSH
T1DFD4232375561B9DE7C0E5BA9333C9967B7834DACB00716E8B7644423A94B0B6EC70CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 fb58c79046ba23fa8ab278d6cdb6a7eda4efee32693dfce00db15f351985793e
MD5 2eacdfc64cbe7c04bf1c6f989b9e3f61
SHA1 709f1fbf93ae40ef6b7f2b3bc78af672e7243fe6
SHA512 fbff10f3c3c007979521fceb1fcbe6731c0ef2a2c5505d71187a389da329e0988d208051fd5fcdfb3084ce58d7ac5d0f1f60f7fdf1e8bc49cf8bb625e7f9bdde
SSDEEP 12288:uN5sfmWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:dmWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1B4F4011AE29812E8C19EA179C7228A41B7373CA587E0E3CF57D0F43E1F756419EDA643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 0e54ec0deb982d143e7281a949d4f81e3e5aea2313ad38e055fa1b80ee0d3269
MD5 f42f53781491fbce032d1f0fa0ab0a01
SHA1 f093c4549e8e3fc0907d72cc847206cd79a7202e
SHA512 3121b80ee08b6eabdba01aa3c3200058fd69f7bd3f4258f143c234c67df03fc065255dda0b6448536f43febb7683f3f2e0a95cbfa91f4e8eac4d807487cb696c
SSDEEP 12288:Bu7vWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:YvWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1A6D4232377591A5DFAE0E5795237C5613B3C30E88F00A4EFDB2250863AB0F469ED618B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 08ca373dbeba2dc8b33eebef7e783e8bd42a06093edc53dc2980b198b4f25634
MD5 7e03dce397a51d716c8307c220688bec
SHA1 91a79fe1fe9bafa03ea8f71f65fb2b07fa1d69b5
SHA512 3caaac6f9cbaceda9dc34b8c75ade891ce29635ba6f53bd5a15dd8d5ffac3efc587baade782e328295ec1cb3547edfde7a1d489e80fb392d5ebb514660f36b7a
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYsWLEkgXWHiYKbfZB1v3adCMW:Dgb4mBIBhGF+cfT1S1
TLSH
T16A65AE1E22EC02F5E0F5E2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 5400514f77031ef100f7ccf2a9550d88256708fe458504656febfc8ee3e1f763
MD5 7a470d8bbfa85606493fd592a5681aa8
SHA1 9782e14eb4938cd33cb116880daa3000db0b7d4b
SHA512 671696a91bd9560e3ab672d5a209300efc2bd431d8d942dbb0d668c4bae31f2dbb9487cd8933ca84c3b0957fc15b35c2b768fe6fc28ec88cbc9655d97098e957
SSDEEP 12288:R9GhGWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jGhGWLEkgXWHiYKbfZB1v3adCMW
TLSH
T163E4232A31B636DCC9B1D2798132C5537A7030E08B0075FF4AF190766FA4AD57B7AC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 8f70291f6b60fafb7d1f7ab54b5bf3295c210370b3101df3bf4e992559bc69ff
MD5 d3a7a30846b0af765435d80996ddfb5b
SHA1 ef5e1f676bc6fc11d05b2814de08cb786513e418
SHA512 0ea37c408661cdee30b3b67adc5788de7f821cfb5faceacc17943a134c447a5d7156e591cede97790f4ac63ba5abc4fc29e8800bdcd413aaa18894e9a4b32133
SSDEEP 12288:P6WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:P6WLEkgXWHiYKbfZB1v3adCMW
TLSH
T19ED4232231552B8DEAD0E57A5233C9523B7830E5CB0075EF8676505326E4BCBAEBB0C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0d63187c27858e84a75e0d0c879e7d68db107969536ec4f77b1447e0167eda6e
MD5 b55531a1243e9b41af3223cc423b3542
SHA1 aad1012993f8ec5d07df35e55840b2907a4c3d76
SHA512 8ff12ca0ffde19e17e018e8ad9ca9e84dfe3c31a00ed5df72a43456acda4640f7500c6e16c442ea9f91dae6a5e521d570f1b2f9ae109abaaa6b47f7d10d40385
SSDEEP 24576:itZ8i8FKJqH1Mzria7/m5WLEkgXWHiYKbfZB1v3adCMW:qeFFmqVra7/HcfT1S1
TLSH
T1E135F12576E102F5D4B7D1388A528663F6B2B4250360FBDF07A88A521F23BD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 d69b82f3038dda789b371a2b6245e56397b20c973c43fc8f517595764f147ee5
MD5 9e1029e6a0645e18846a7666f4750b92
SHA1 937a1522a2de9d3ea62db486e44121802c7eced8
SHA512 379cfa7ec0d30b3fa4caf87a621040563e266e50b9e0dbae4c94abc031e0213b4fe65480ec514b56e58a731d45f4c13c3e70bc661e31349a957da9c8682b2182
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjeCBcfT1S1:pG05lO43bvecfT1Q
TLSH
T1A9D5C06E62EC11F9D1BBD17CDAC6860BEBB23415032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 c0899935e2a5362c2d04888baf795180640ff4e0906d33dd882a568c6ccf3b6e
MD5 78efa48c5caed8454836b9b51ca71e95
SHA1 a6eed8530ca31151a709c488e5f9018acf18086d
SHA512 60ea9816ffc70409f1e7788eda074730b20ab0bcfae00ab09f21fb22e4315dba1fd7c12ae3fde82834416e05e5c4221e4d6d5e0b902e56eed165c9dcec3585cb
SSDEEP 24576:0Da5POZ3dpbWVM50JicR2hG0lasx2+47eidnaWLEkgXWHiYKbfZB1v3adCMW:ga5POZ3wJt2pasx2+mJcfT1S1
TLSH
T16E65BF5EA6FC01D5D5B5D17DC683861AF5B1342253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0856b3213632b0844ebd9805e8242f0c51c928a79f301e619ac9078498028dec
MD5 65a2a45c98325cc46d8ec490bd568be2
SHA1 6222bb7af1a425d74e2fccf7b22681f09dfe72f9
SHA512 9d2d50d7f5a6f396fa1699e7861c02200995a2601c2a45fda4934a23915d8df872ed95de381015c5032764f55ead379e4ccd0153f1d86ed9fba29d1ed3de2946
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkiWLEkgXWHiYKbfZB1v3adCMW:8Nc/zEOVHFQcfT1S1
TLSH
T18B858C2623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 f69ca38966ebf116e79fda7b0da489208335f2afb59598eb65272e690e268ea1
MD5 32fc1250034463bd2cc1c67202ffaa20
SHA1 6c466592226be7c130f977380b0d526268860628
SHA512 1e75dd38e22d2387ae7b09a0f1572551b236337d35c493db77dcdd4ef7e94bd456310cc5a9734bb5ef9be9ae64296b7ccd0d6b59417cc3a43669f03a46e5cce4
SSDEEP 24576:4JnJPbzB4SqWLEkgXWHiYKbfZB1v3adCMW:4JnJv6SbcfT1S1
TLSH
T10A15D03DD2A810E8E4B7C2B4811A1A5AFF31346D2F1169CB19B4D4353F52FE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f7fb41b9e5f5e73958cc9ebe73c9be6e844534e4f1fa6639593bbf7f6c5c4c9d
MD5 f38ceb0847b889141fad86e34c806a47
SHA1 a1027a4345e550ae0753077174fb468b17abc08b
SHA512 73dcfba69bfbe50c489ed3181f78634bc416952f81c5db0a3412e005646df5656c586f2235e4b01c5ed3be2186bb676ddc34db7baa2cac9de4907e3dd5db55ac
SSDEEP 24576:wCLHGL0MoeVtFumTijCmlKQWDk0WLEkgXWHiYKbfZB1v3adCMW:wCLHGeeV5ijCmlDWDklcfT1S1
TLSH
T106A56B05A7EB5184F8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 1f48216e1e82a86e5ecae9caf4dbb8545cd6cf70db3955912438a44553c5cecc
MD5 573de1b0877b7fdbf12d0c256ed67859
SHA1 a81e9bd365dca76bd099a0b0f417230c6b8b8ccf
SHA512 4ac8816fd7848213f04118f36f8ac4433c521f8713e9caf40ebf0ec6d44980d4606e22c54d5496b86f15557ad19c887ddcddc7082aee41b86e394c1a031df289
SSDEEP 12288:Q1HKk6j5ZI7C+WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:y6DIO+WLEkgXWHiYKbfZB1v3adCMW
TLSH
T191F4011D337A11F9D1A7D03E82534502E6B270B1C71169DF4BA4C4BA5FA3ED8B93DA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 231ad8fcd6a658f7a183826b1541f92b811c777f5a07a77e686273e7363c4a68
MD5 a7056bed58a6282ac574f5441e20f640
SHA1 b79b202f8f73cdc82ea39d13b2996086a24bb460
SHA512 feccb66e3e5508740c8497d71e2cb844c9f2ebf3c7c87bd70b887c369d3eb95aa8234abbd370f2400b6a0a2e3aec88ccdd7d27cc7c751ed3f952f0a692cc99db
SSDEEP 12288:qG6kynWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jtynWLEkgXWHiYKbfZB1v3adCMW
TLSH
T17AF41201639425D8EAF5D2789A33C1A1AF343CA08B0062EF46A1E53F2F75BD5AD72747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 2a5ca9fc222fc5ff180f3fa90295efe9e9918eec30f57f22e717efd83133e912
MD5 b4b3371e78af6868ecddb56115b71383
SHA1 f1a8fbe83902bbc2ccf151aa9060e026d2432fcd
SHA512 ed7fd956d30e3274f1af05264e876218c70f44050cdcf346d26fbf90b6ed1e993506ffa33c8d9a51d4de1ed08a9b3c95100df610d5dd6237dfe51e6d116f6d9a
SSDEEP 12288:OwwWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9wWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1F9D423267265369CDAC0E5794233C692777430F48F0035FF8AB294722BA4BC66EB6487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7e9fdce9efc942af609384f118587e5dfabf055ce416309cba12c860594508cb
MD5 a07943f6f5d0a6dcb49f83ff3800cc80
SHA1 43f8cac0c44f08ea247c0cce05326bb27bcc02e0
SHA512 d1335d8ba7483745b8a1258bad86c83efe34d1fc21bbd2b7216c715c6dade74168213c06b15b655bb07555b2e4a57ab8ffa16967c3e6e331954b300b35e789ed
SSDEEP 24576:fhg59oTfaidZ7WLEkgXWHiYKbfZB1v3adCMW:pgYTrZqcfT1S1
TLSH
T100559C1D73EA05CAE2B2D239D9325493D633B4315772D6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 7bb07c1b57a0fadb997b95db996d267c227801e4682f18b05fc54046ad624417
MD5 533c5400b50b5d5d57a67300104ccf0d
SHA1 9e89f136fd036d7c62f49bd8dfe7c6291099ee01
SHA512 b8b62cfd7a7007a134ef8adadf5c196e1793d81e17ee5813b4ea8fedc583412deaad1b6999cdd1c321fa7edbfada66d5654b0b2c50f80186bd0550fbcc712a05
SSDEEP 12288:QpJcm8CNiWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QrcmRiWLEkgXWHiYKbfZB1v3adCMW
TLSH
T10F05F11EB2AE00E9E1B3D13C89528546F7B33070570163DF42A1C67E1E67AEA7E39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 59094ed9db5a77537d6cdaf291b651ac6fb1845b91b6369ba9cb945698b30605
MD5 c028aa07f0dce81878a1846b5f29b9bb
SHA1 6c44936ddb99c1d82ccc938480863c8c69d8d6be
SHA512 35802d42ed4e1396533ba8bb01f00c76f395d19dd6e9e8eb415ceb322298dabb28fce8d472d6651000ab4959fed8cf35e0bea2b8d39b029edf2df23a7a8149f0
SSDEEP 49152:MDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3UcfT1S1:J3Upow8sBBcfT1Q
TLSH
T1E2A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 1d775b1e52fb54a54f7112d76645b0dcda9968815d5f96ed65df47110e5790a2
MD5 a774e103ec13a883dbe33aef22fd0f60
SHA1 0cec4d272700b94e21a8b6e14abb55daeb71619a
SHA512 56aaa01ba1a8ae46e0afa95696820fcf27b820355f17a6693ca12ed8e5c3a0501f94c5193413a740e60ccddffebe2c9dd47e8e189940bf4be1f436fbb8736968
SSDEEP 12288:oHvUrBFrEjwaQGWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:oPUr+NQGWLEkgXWHiYKbfZB1v3adCMW
TLSH
T18505F12F22AD18E9E676E17D86528609F77174A20701E2DF02E1807E1F67ED8BD3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-356-0x00007FF73DE80000-0x00007FF73DFC9000-memory.dmp

Download

memory/248-261-0x00007FF73DE80000-0x00007FF73DFC9000-memory.dmp

Download

memory/248-263-0x0000029E78B80000-0x0000029E78BE6000-memory.dmp

Download

memory/248-264-0x0000029E78B80000-0x0000029E78BE6000-memory.dmp

Download

memory/936-337-0x000001FEF63C0000-0x000001FEF6426000-memory.dmp

Download

memory/936-344-0x00007FF7239E0000-0x00007FF723D00000-memory.dmp

Download

memory/936-336-0x00007FF7239E0000-0x00007FF723D00000-memory.dmp

Download

memory/936-342-0x000001FEF63C0000-0x000001FEF6426000-memory.dmp

Download

memory/936-338-0x000001FEF63C0000-0x000001FEF6426000-memory.dmp

Download

memory/1204-291-0x000001AED6FD0000-0x000001AED7036000-memory.dmp

Download

memory/1204-376-0x00007FF79AA30000-0x00007FF79AADD000-memory.dmp

Download

memory/1204-290-0x000001AED6FD0000-0x000001AED7036000-memory.dmp

Download

memory/1204-296-0x00007FF79AA30000-0x00007FF79AADD000-memory.dmp

Download

memory/1596-55-0x000001B8F9370000-0x000001B8F9431000-memory.dmp

Download

memory/1596-56-0x000001B8F9590000-0x000001B8F95F6000-memory.dmp

Download

memory/1596-57-0x000001B8F9590000-0x000001B8F95F6000-memory.dmp

Download

memory/1616-372-0x00007FF605030000-0x00007FF605536000-memory.dmp

Download

memory/1616-367-0x00000214CF5D0000-0x00000214CF636000-memory.dmp

Download

memory/1616-445-0x00007FF605030000-0x00007FF605536000-memory.dmp

Download

memory/1616-368-0x00000214CF5D0000-0x00000214CF636000-memory.dmp

Download

memory/1668-358-0x0000027B4D730000-0x0000027B4D796000-memory.dmp

Download

memory/1668-359-0x00007FF77FC10000-0x00007FF7800E0000-memory.dmp

Download

memory/1668-444-0x00007FF77FC10000-0x00007FF7800E0000-memory.dmp

Download

memory/1668-357-0x0000027B4D730000-0x0000027B4D796000-memory.dmp

Download

memory/2152-349-0x000001F70AD00000-0x000001F70AD66000-memory.dmp

Download

memory/2152-353-0x00007FF60C470000-0x00007FF60C6FA000-memory.dmp

Download

memory/2152-348-0x000001F70AD00000-0x000001F70AD66000-memory.dmp

Download

memory/2152-443-0x00007FF60C470000-0x00007FF60C6FA000-memory.dmp

Download

memory/2164-28-0x000001FFAE8E0000-0x000001FFAE946000-memory.dmp

Download

memory/2164-26-0x000001FFAE8E0000-0x000001FFAE946000-memory.dmp

Download

memory/2164-27-0x000001FFAE8E0000-0x000001FFAE946000-memory.dmp

Download

memory/2164-25-0x000001FFAE740000-0x000001FFAE801000-memory.dmp

Download

memory/2556-11-0x00007FF622BE0000-0x00007FF622D02000-memory.dmp

Download

memory/2556-13-0x000001C50F7F0000-0x000001C50F856000-memory.dmp

Download

memory/2556-12-0x000001C50F7F0000-0x000001C50F856000-memory.dmp

Download

memory/2556-61-0x00007FF622BE0000-0x00007FF622D02000-memory.dmp

Download

memory/2556-14-0x000001C50F7F0000-0x000001C50F856000-memory.dmp

Download

memory/2896-45-0x000001BD8EF40000-0x000001BD8EFA6000-memory.dmp

Download

memory/2896-44-0x000001BD8EF40000-0x000001BD8EFA6000-memory.dmp

Download

memory/2896-43-0x00007FF6A56D0000-0x00007FF6A5837000-memory.dmp

Download

memory/2896-50-0x000001BD8EF40000-0x000001BD8EFA6000-memory.dmp

Download

memory/2896-52-0x00007FF6A56D0000-0x00007FF6A5837000-memory.dmp

Download

memory/2920-438-0x0000017DCF220000-0x0000017DCF286000-memory.dmp

Download

memory/2920-299-0x00007FF6C9F20000-0x00007FF6CA336000-memory.dmp

Download

memory/2920-301-0x0000017DCF220000-0x0000017DCF286000-memory.dmp

Download

memory/2920-300-0x0000017DCF220000-0x0000017DCF286000-memory.dmp

Download

memory/2920-440-0x00007FF6C9F20000-0x00007FF6CA336000-memory.dmp

Download

memory/2920-386-0x00007FF6C9F20000-0x00007FF6CA336000-memory.dmp

Download

memory/3020-319-0x0000011CD0740000-0x0000011CD07A6000-memory.dmp

Download

memory/3020-318-0x00007FF6928D0000-0x00007FF692B72000-memory.dmp

Download

memory/3020-320-0x0000011CD0740000-0x0000011CD07A6000-memory.dmp

Download

memory/3020-441-0x00007FF6928D0000-0x00007FF692B72000-memory.dmp

Download

memory/3188-446-0x00007FF7DE380000-0x00007FF7DE4AE000-memory.dmp

Download

memory/3188-378-0x00000206DE300000-0x00000206DE366000-memory.dmp

Download

memory/3188-377-0x00007FF7DE380000-0x00007FF7DE4AE000-memory.dmp

Download

memory/3188-379-0x00000206DE300000-0x00000206DE366000-memory.dmp

Download

memory/3228-250-0x0000011D67B60000-0x0000011D67BC6000-memory.dmp

Download

memory/3228-249-0x00007FF70C230000-0x00007FF70C349000-memory.dmp

Download

memory/3228-347-0x00007FF70C230000-0x00007FF70C349000-memory.dmp

Download

memory/3228-251-0x0000011D67B60000-0x0000011D67BC6000-memory.dmp

Download

memory/3600-311-0x000002053B020000-0x000002053B086000-memory.dmp

Download

memory/3600-309-0x00007FF6AE710000-0x00007FF6AE7C3000-memory.dmp

Download

memory/3600-310-0x000002053B020000-0x000002053B086000-memory.dmp

Download

memory/3600-437-0x00007FF6AE710000-0x00007FF6AE7C3000-memory.dmp

Download

memory/3852-20-0x0000026AB2380000-0x0000026AB23E6000-memory.dmp

Download

memory/3852-3-0x0000026AB2380000-0x0000026AB23E6000-memory.dmp

Download

memory/3852-2-0x0000026AB2380000-0x0000026AB23E6000-memory.dmp

Download

memory/3852-22-0x00007FF62C6F0000-0x00007FF62C84E000-memory.dmp

Download

memory/3852-1-0x0000026AB2380000-0x0000026AB23E6000-memory.dmp

Download

memory/3852-0-0x00007FF62C6F0000-0x00007FF62C84E000-memory.dmp

Download

memory/4224-387-0x00007FF61CD60000-0x00007FF61D09E000-memory.dmp

Download

memory/4224-447-0x00007FF61CD60000-0x00007FF61D09E000-memory.dmp

Download

memory/4224-388-0x0000025A59280000-0x0000025A592E6000-memory.dmp

Download

memory/4224-389-0x0000025A59280000-0x0000025A592E6000-memory.dmp

Download

memory/4400-366-0x00007FF7A3EA0000-0x00007FF7A45E3000-memory.dmp

Download

memory/4400-282-0x0000025AF2F80000-0x0000025AF2FE6000-memory.dmp

Download

memory/4400-283-0x0000025AF2F80000-0x0000025AF2FE6000-memory.dmp

Download

memory/4400-288-0x00007FF7A3EA0000-0x00007FF7A45E3000-memory.dmp

Download

memory/4444-326-0x00007FF6A6B30000-0x00007FF6A6BF8000-memory.dmp

Download

memory/4444-232-0x00007FF6A6B30000-0x00007FF6A6BF8000-memory.dmp

Download

memory/4444-233-0x00000240D0920000-0x00000240D0986000-memory.dmp

Download

memory/4444-234-0x00000240D0920000-0x00000240D0986000-memory.dmp

Download

memory/5084-335-0x00007FF6A6B30000-0x00007FF6A6BF8000-memory.dmp

Download

memory/5084-242-0x000001722C750000-0x000001722C7B6000-memory.dmp

Download

memory/5084-243-0x000001722C750000-0x000001722C7B6000-memory.dmp

Download

memory/5084-241-0x00007FF6A6B30000-0x00007FF6A6BF8000-memory.dmp

Download

memory/5140-37-0x0000028D01C50000-0x0000028D01CB6000-memory.dmp

Download

memory/5140-35-0x0000028D01C50000-0x0000028D01CB6000-memory.dmp

Download

memory/5140-36-0x0000028D01C50000-0x0000028D01CB6000-memory.dmp

Download

memory/5140-34-0x0000028D01A60000-0x0000028D01B21000-memory.dmp

Download

memory/5376-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5376-271-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/5376-276-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/5376-365-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5520-442-0x00007FF7B4000000-0x00007FF7B4194000-memory.dmp

Download

memory/5520-329-0x000001E0BADD0000-0x000001E0BAE36000-memory.dmp

Download

memory/5520-328-0x000001E0BADD0000-0x000001E0BAE36000-memory.dmp

Download

memory/5520-327-0x00007FF7B4000000-0x00007FF7B4194000-memory.dmp

Download