fc0388ae8bfc99fe9a1cfc441a182159efa4b8b94243f76d94e7d43d4d3543bf

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260720-czktesft2t
SHA256 fc0388ae8bfc99fe9a1cfc441a182159efa4b8b94243f76d94e7d43d4d3543bf
MD5 d9723902f35a1e5e024b69f405853116
SHA1 641d454016c4a0fdf3f906583e86ae7e94cda5f7
SHA512 3a710bfda89d5f54cba406a13b92524eb1487b9f4a181e2c03bc43ae24d71c5455ac3596aea024e9ed33e1ee80b2feb4851c85b65d07d541f9177596a1db8d1d
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJpU+qXAh9/ylVYj8nUGZukB3D/L:zul13qcQFTIOZeZUY3/y3YIzB3
TLSH
T14D45E01ABEF1C032C06341308D6AD358A1B5E4B148264897FBDD675D2FB06D39B39BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5376	alg.exe
4296	elevation_service.exe
2812	elevation_service.exe
4284	maintenanceservice.exe
1980	OSE.EXE
2652	GameInputSvc.exe
2604	GameInputSvc.exe
3416	msdtc.exe
1932	PerceptionSimulationService.exe
4112	perfhost.exe
3760	ReFsDedupSvc.exe
844	locator.exe
3028	SensorDataService.exe
3688	snmptrap.exe
2784	ssh-agent.exe
1372	TieringEngineService.exe
6008	AgentService.exe
928	vds.exe
5024	vssvc.exe
2992	wbengine.exe
2984	WmiApSrv.exe
4432	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\93032bde5387db0e.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2604	GameInputSvc.exe
2604	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2188	2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	5376	alg.exe
Token: SeDebugPrivilege	5376	alg.exe
Token: SeTakeOwnershipPrivilege	4296	elevation_service.exe
Token: SeTcbPrivilege	2652	GameInputSvc.exe
Token: SeBackupPrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1372	TieringEngineService.exe
Token: SeManageVolumePrivilege	1372	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6008	AgentService.exe
Token: SeBackupPrivilege	5024	vssvc.exe
Token: SeRestorePrivilege	5024	vssvc.exe
Token: SeAuditPrivilege	5024	vssvc.exe
Token: SeBackupPrivilege	2992	wbengine.exe
Token: SeRestorePrivilege	2992	wbengine.exe
Token: SeSecurityPrivilege	2992	wbengine.exe
Token: 33	4432	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4432	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4432	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2604	2652	GameInputSvc.exe	96
PID 4432 wrote to memory of 4832	4432	SearchIndexer.exe	113
PID 4432 wrote to memory of 4680	4432	SearchIndexer.exe	114
PID 4432 wrote to memory of 1440	4432	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_d9723902f35a1e5e024b69f405853116_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4284

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2604

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3416

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3760

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3028

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2784

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:928

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5024

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3024 3060 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3028 3040 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a6e489511515dc11b2f55b79f986cab0e340b661b6b6642ec48dd5fca6237c6f
MD5 81d4637a61f79e860b78620c9ede146f
SHA1 78c51f33c18af8116f5cb2e78973e4c9227308f5
SHA512 77c7952df95451df17f0932546f272f0135a58200cf43526c5967775965647ff3453cea05bddddd58bf2d92c64a08d8b3418534481df3b536451df9940261e3f
SSDEEP 49152:6b+632BuPkFKRrdE6oh7stBhuXjfS4LWxnRUY3/y3YIzB3:s3q6gjB/Y3gYIF
TLSH
T1E6D58C03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 4c520a65fed161efe8e79b80ee8e7110d194ef2cc54d63a458e7bfa8d8f68801
MD5 21c7347819790a63bd65f01fdfb7428b
SHA1 72c25428ba6b1858f56d3e0d77be9c6e3f2083f2
SHA512 7ae8b21a41962a63a8f98e1696b01bc571f146bccfc5719a6557d6497180ccc1b27a95d4a64355bf73b11a3b5f762fb59e50756ef83dd55664c2deeb78d8b8f2
SSDEEP 24576:mXYZwtczA7U+qXAh9/ylVYj8nUGZukB3D/L:ktcCUY3/y3YIzB3
TLSH
T10D050224B7E408F9EDAB813DCCA28515EA33B85047A0EB9F03E496655F233D45E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ab3ecacc1bfcdc78a3a3893ed0443928d60e9b1acd575d8865b095278e863e29
MD5 0f09e6e8e526360cb4315b069605e216
SHA1 01e8ce5e6c90c8bf69a6509522694fa9dc497834
SHA512 0aea2469c6cc1c87a5bd9d6dc7efe373918f4593b78ab3132332728e8aaf34cc31613833d442122e84e11799144684cc30f04fe28328eab6e864f0d39d03fe7f
SSDEEP 24576:R0NeDjW0HnxOrMeU+qXAh9/ylVYj8nUGZukB3D/L:RzjW0Ho3UY3/y3YIzB3
TLSH
T1CD359E56F6748775D073C0B9C5D2A68EE93130821B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 ef0d667ec4dba0cd7a8df3c325e748759ad63e50613a37c74b42b699f401547b
MD5 131dc3a007c2b6d03dbc4b1f0b18082e
SHA1 e9f7df62483c0409902c02b762b222d4a4364b21
SHA512 0674c450dd7b7ed400330d25bb5370609ffe3311f44cd81b0da6b0daace674e9e45cd5a59d231b450464a06be89091606e93b33191b3f896f5410014d8a58772
SSDEEP 24576:pIK/ezSC6vUyD/aqgrvW/6q8wyuBU+qXAh9/ylVYj8nUGZukB3D/L:H/ezSC6vUzPvuHjyKUY3/y3YIzB3
TLSH
T151756D15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2bd197b5d86ca428628accbd2d3b3860fc1b39a2d85e0f6c4edeedf497cf3721
MD5 b48c758c3aae5a8f3f49e5e2793c67e1
SHA1 9bc40a8a95dbfd0347a959d9a47039e6558ee071
SHA512 aea1f614be21370d0bb7dd1bbf1c935757d18d8650f57989e96cd5ad1fbf3fbb4b5e11e739edbb40a12620fea19b8e3effa2ef0088ed66dcf998d143045fa311
SSDEEP 24576:7AbHP0M8Av/l+doU+qXAh9/ylVYj8nUGZukB3D/L:7AwM8AXl+SUY3/y3YIzB3
TLSH
T139559E66F6B48331D073C0BAC4D2AA9AEE3234415B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 52d7c01af8bc01ac450bd3c7c0eedbb1885fef0ddda563869193825d21c4a6d1
MD5 cbbe39ab59eca52131b780df2f80ea25
SHA1 e0513869aad3107c3fb462dfc471465ff56c0168
SHA512 2941d9f0702c0d344846e42fcdde1e736c3e8c75b8989cf949b7413253b61844f1eafc1edac9b1e4573a2b81d980b5257c32276c7b1faf643c12a64d5db47ca9
SSDEEP 12288:QEYUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:QEYU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1E9D423D1FBB41CCAE7DE893518D6624E78189D001FC8CCBFEED3A7C488607916516B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 e4a4f629983792d4bb404338add26d5f5851f3d9148af13367858719bd1371a5
MD5 368d9c10bb80cb0fee22a907d4d72dd4
SHA1 d54c6b5c98de6a4f42f8e09b8a0f73da23f3c3ea
SHA512 6f20431192082856486423430bd412b1e9e7f88777dd22aa8f886448f6ad1cb07dcc6c2f219e8a511062222aba7f3029e7612bb9ffc221a56ed51051cec13d8d
SSDEEP 12288:KeBNUbTVO86UHUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:KJIUHU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T11C15CF7BEE38FCD2C27E8D785A918200A76278304F51A7CBD165834EDE136E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a10cb93e7f5f0380ae45075155d5cdbabfa90c577cf2cd731b03ee397d15bde2
MD5 d76583084216f0a4f2186d8bc60db2f6
SHA1 7e8dfdb7c8fc3bf92514d36ab37346b22324a5ed
SHA512 d2e60e04122883527d9f681abc749278ee6fcb22e2082f02879eb4a3b6cf046e32b6fdb6b4df02678de6918b3afabbe38d2bc47675a6bb9d2fb474cae94072a7
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J6NRV3THg:XQvGAdlCEL8c/bRN25CVY3gYIF
TLSH
T153367D656BF880F5E0A7E138897AC5B2F7B678420D31EB5F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 7234ab003c091e21e846c98671406fca165d4d3cb91d841c065c9af86bdf844a
MD5 4e8337467e3f0ea39e0152b154df2882
SHA1 549a4ab632dfb44a372c18adc9f792bba1aab26a
SHA512 0a23c2e434b9c04c8ccc6d579c807e65b99e1c8d969fe4e5859efaba4353ed8cf2f8df68ae63466841c20d31fc9410528dbf08f303003f9ec5831efd4498177a
SSDEEP 24576:VmewsAjzU+qXAh9/ylVYj8nUGZukB3D/L:AljzUY3/y3YIzB3
TLSH
T10515E031FE74E436C3BF0DB61B66D71A242CB9200F9119C7E3E88A9D59602D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 acf818d37fb364b2e8ec2c37cea2ad64bacba1589f16ca44de2e7cf921e41447
MD5 ed111608541859ed621a63b18e49c804
SHA1 084622b5747c0d94c6d9c9771b79497febf5c262
SHA512 f6fee8a387346afcaa614408ccd583cf6aa579ab17ed14b523e7d119d59eb5a37b459576b1bb8dd5196e59727b9d05ef0a56eb69bbfc4b155fa7430a667b1041
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrtdPlbuJHvPIF:xUEtQevvqc2W1cpV2Xr/2vPw
TLSH
T1FE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d604851f4841a56ef0e571c1f6028945c471f8edf32caeba44c40ea77c549c0b
MD5 3debd2395c8008580653715175bff6fe
SHA1 3f42c4341df1e30b4008f731267afa2d5ae8af01
SHA512 3f16e088dd2490249c4a5d7945edbe7cd99674b7fe5f1a2b096bfb86d1859ee3b8854fa03e142a1c688a7927e6ec148886607a830dfacc31162fd9d8729963bc
SSDEEP 49152:eBbRquA/m2yL5zMfFiV+XenmE3/zKUY3/y3YIzB3:6oq1VjnmyY3gYIF
TLSH
T12AD58D0976B881E4D1F6C77886A2C647F37178154B349BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8ad1ccc26e2c80acaded4926f3f09f2287a95858a181415649d92749ed003e2
MD5 17b9868850a19944d0c4ff6a2a31c25f
SHA1 033e6045aaa804e969562d0b17d85880c8d669d0
SHA512 14763f5a1baf60fcc18d3777332dd76cd13c7bd7cd78ba898e330eb2b35f7559d583aa196b44449e29090bbad5d9f055c33d52b59960fdb3af63ba46ed3956a7
SSDEEP 24576:BAhGLvMFoiwtA5l7S533U+qXAh9/ylVYj8nUGZukB3D/L:BAM4Foiq5nUY3/y3YIzB3
TLSH
T132459D81EBF955D4F5F3AA7899B69171EA76BCA51E30C21F2160D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 68097b758eccbc26b16e31479a8636008ca21db09debb25fc7eecd60ed00b551
MD5 b2de55468ebfa87e016399e3e69823f5
SHA1 b1c8e5bf80dc53fa203689edea01aabe90ca9671
SHA512 1574eccb9ca374d04ff69fd93c9524a1599573273c089e69ee223af22343117ef17fb042a8e1fb745e57fce04ab1c0cc41d256fce79d4eabbc39179323e29818
SSDEEP 24576:Owu+OWeU+qXAh9/ylVYj8nUGZukB3D/L:OwlOdUY3/y3YIzB3
TLSH
T1FF05F18577E40CF9E9A781398587C136F7B2B8012A65CB2F57A0C75B5F233616D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 a6527f1411014ef3fffea4d7a6695c4585368b692d77b8543905be9f85c80d8a
MD5 fb061c5a3ca2e00d85a3dbfb146086fd
SHA1 deb4140487666c120ec9d25ff939c292768c68e8
SHA512 c148b1250ecb3788873ac451f08341e040c67cc23982f61e5ba1a7b38becaf3e03b6f61bd379b5fcca126425bd7df3d16d1dcf238e9b72c66107ba49a1545b70
SSDEEP 12288:6rn1ISlCUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:CnuVU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T160E4128573F424F9E2EB813D8CE25209E73178112B7587DF5AA243955F62BC12D3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f913e6a5c3524253e79d3e670ee9178568162a4becf646f54384e9c5fcfd1ed
MD5 b522b6a1b5571ec5161f94b58ade3acd
SHA1 84946e26680a71e170937d389bbec9382b2fb2dd
SHA512 3465d21b074f74aaad25ee03e81177efac93a6d52c8277ff6aa7aa7a0702ab4778bf53ccda542db96b8c26d8ddf3ee812ce30d425e108eb77cf0c987fb8e7b34
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uq:EQRQyi36YOcP8Lvw2gAf+PN3YY3gYIF
TLSH
T177667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1648bee56c1890dafa068d51078e890a6c04c7cd59793acc5eb914a93cd2748a
MD5 11eee858bb7db99dbef288216807bf07
SHA1 467f76c8c3d5249cc4ee0206a0794fc197cee443
SHA512 1081cf1bdd4d32ea79669710b4f3311adb768eafad3fb117c8f7173f2f8e72a5a8dab055fe42842491d3b6b64d4090313671ed5542d0999e1718d7873994fc18
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uu:EQRQyi36YOcP8Lvw2gAf+PN38Y3gYIF
TLSH
T1FE667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 99f77a019dc127a59f01d60b5cd81d2797831033c672e9855d7344a54ceb7e6e
MD5 c070910a8f6a33861971790f97a783af
SHA1 fd0bec62e8bff88c664e2e028ec10726c399caa2
SHA512 5eed168cca5a55309451170e59dc9c7601916da8cf408db6bc3bcc4329fbb2a3ff3821d9f0076c97ae8b6ef56696ac655d288b444baa5ce0618956d08690baeb
SSDEEP 49152:g68Qg55nhMeWu7PNU3/Z2UY3/y3YIzB3:athbRc/tY3gYIF
TLSH
T12BB55933B2F600A9C44DE1769F4A872196D27C718FE0E7DB855173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 36aaf842ee9cbe2d2640ba00c255d1c8b214c2e6ab9c9a0fe880cc113381c991
MD5 3cb3cd11bfd515283d1fbed96e1a8ac4
SHA1 dbe75992295393db15a7dfaaef590bdf67771f00
SHA512 60f87542a869b1a2f6960421ab3f34742132adda1780f4cd6c630643265bfc3edbf0d165fa126c0dab99d68e25e4f9d50a5dbcbbd062f959c95b33da260064f5
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99O:5y5112gYy5azzVv569nLKnhZHY3gYIF
TLSH
T111167B13F29900E8D05DD179874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cf5310881fad0c129f407b112cdbdef511bbd2e54e34859ea1bb40526b2688ee
MD5 b96642abc65a42ad5a73db2375ed47c4
SHA1 32253f89b7d0bfcb4e3ba7968f73685d46a2d82d
SHA512 80642ac33ccccb0abd7f9f59a2de5c7c0dcde06712323b7030588cd625d3e61a52f10e65f7bf0bbd7154b693b6517f85c8dd005eb5682372274a11ad3c2a74a8
SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6UY3/y3YIzB3:Ku6JmTxd2dzY3gYIF
TLSH
T1BCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54cde57109d6dd14a3a862e495cc0762006012d3b16e4a2bd3a8c3965184d072
MD5 957a2d9e9e27ee8c891bdeb2aba54d98
SHA1 f18257bdd9d4e9a83ec9ab44771b9aa9e96537b0
SHA512 94e3c95e7b80148db35956d76eee4464b1c3164c25d06e17260c3f6cbecbf8439830ba31514dfc36f516d7fd2a83ee7627f042838032409434f270c5691e0e06
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4x4GNpPu0sY73afmMg9:3mifPbR+NNVskMe
TLSH
T139B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e9976d74e417bf5c4c59f3b4d8cb399a274cbabe7e41ba4bc576ebdf225cfb72
MD5 1d571a5966ac852792fc9b21967f3b46
SHA1 5f69d29eaca31bf09b47754818524cfa900be47e
SHA512 1ccceec6a0f94fc9f8d741ba0f0a7cc0340dbfeb1eb417d6e81a6cbf172b68b71f7eb00d29ac3bf00e73b7c3888a8d27a1c560f00037892d88e3c875564e6b8a
SSDEEP 49152:xSuZQIY0Be2K6RVtOnks6NMHqgGNpPu0sY73afmMg9:f5dKoi61vNNVskMe
TLSH
T153C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3a38d5b68238213b8d3eebeb4081e69240e5bc6f744c4778b7c4b64f02e690f1
MD5 fb72e342a233a25ce49b3aaca4e9f55e
SHA1 d24f30acc632b057546a2da03702344fdbb6f300
SHA512 2bc10d6e643db7e90c948eda7d916e70328a38e9c8690aff2bc51f36500d91e9d1ff26d8e59947a30e608efab53e16b3f876921de8972efe5c20dc7aa9b88fd3
SSDEEP 49152:yhtSn8EApI0figTgiDn0AP5wNGNpPu0sY73afmMg9:zX2iyphVNNVskMe
TLSH
T135A5BE13F2D901E8D05ED078C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 a4f6846b78d602e69d49c2adff736fa9004355af6a69e471574adc3515c9818b
MD5 1152119943ae802bce02202a31c1c45d
SHA1 3e55298f5d6957aa064ed4f3f54ce1f932555e9e
SHA512 b198c6b9be6dee9a702e31103e44088142557dbb57cac0b04f7443a79253e437469f1dc1986ce1b0251399039e4ae210adab4f36aa9b89410cd224a97c89316c
SSDEEP 12288:j0ItoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:jptoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T1A6D423B078CD93C6DD1B30793DBDA38EBBAC641B81426502692DE2F93F7B60645047DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 9abe99b0cd1c4d7008ceb9a29174b4cda2963a67a92bb8da2ff714d05e43d300
MD5 40c83c617870dadbc3686fcecdb47f8f
SHA1 98193479d668ccb46dd9e8bbed6e2a8794a309d1
SHA512 402f24bfac17c8c0f898e3cc3b1331706c78bfb235354c735b97873dd63f4da33615bbd46dbfc519c12eaede40f165de62ec9e0e9f5de8c7bb6e6e978b73e077
SSDEEP 12288:dutoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:dutoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T19DD423B078CD9282DE1B30793EBDA38EBB7CA41B914265026D19E2F93F7B60545087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 340186e0fa26e816c4ee3bb41f4a7e417003a4f098452e35d98baba974995417
MD5 54ed5d8659085cacce36a074a6346022
SHA1 08c11ed6729aec8eb366fb152ef81168d296d0a0
SHA512 f4fee5e83d77ed1a53a0957f8b58f462c8ff284a74651af48fcf68117f6d3ce2010c3d1f902ad87bdc6c14e31ae499557f692b07195c300747010c56f3288025
SSDEEP 12288:bwtoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:bwtoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T132D423B078CE92C6DD1B30793DB9A38EBBBC640B914265026D1DF2B93F6B60545087DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 405b702ae14f22c05bbabd0633b8ba9308f3c54fa042224a4ac826793864fe29
MD5 3e48f9fb5fd20ab72f628f49da948e94
SHA1 f9f5042e6b635e05721b406f592a6d8622151162
SHA512 87b14df183995bbee457f3270dba7b47f39bd4cc0962df90ea04756e0993aa8512afb9cb8afa83e03ddc477e92f915bb9d00db80504e3e2b31ac0100f4b0aca7
SSDEEP 12288:TlstoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:KtoTppPu0IruWYxlY3aUCafoZp3MgPMo
TLSH
T131D423B035CD42C2DC2BB0796DBAE34AF7BCB8168212A60B5E1492F91F777048904BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 032f3e962be37e09fda869effffb1dbebb303f31bfebda51d1cafb61e77bea3b
MD5 64e1548e4f281d199ab331ef787cd9e0
SHA1 2277aea2ecfe3cb72dd96146c677a3d812cf4171
SHA512 47805063dfea3f8415e0049b5ec854cbc3c785807be4bf2d2c4a727fb8461ee814d3962f5303f713716b55c4ac2d614ffe818a572abd864752f26c4525cdb2a2
SSDEEP 12288:6gtoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:6gtoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T1E0D423B0B8CD9286D91B30793DBDA38EBB7C641B814265036D1DF2F93F6B60585087DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 fb2862a1fe5c48a8f3f7890e5700fa49e29fb1af2617452156566aad170474a1
MD5 67d336bd5e77aa5e2b896b8dff3ab3db
SHA1 a4524cc751da69e9fdfac1514ba89dee85d26932
SHA512 8c883ce6ae3a0153287a378df821c919da53b0c640fc5b87079f33fbf434deab74dbac721853090fa36bf041401e251e0685ab7e232ac35fab0972d97d4e142f
SSDEEP 12288:p8toTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:p8toTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T1BAD423B078CD9286D91B30793DBDA38EBB6C641B814265036D19F2F93F7B60685087DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 7a77ce07240feef9cf90f1b87b2d009d363e39598a339895b83d2c1c67bfdb7f
MD5 687af843eec2c9089c2a1024b2614e09
SHA1 60ff77656a29ff0b395e9e212d3f2a26a9a9e950
SHA512 97823380d91dcf115b9adfd31b2edefa528bf2e51c358d27fc52f5169950758e99e76060c68f8eef3a7a3cd37553ba685912702ce0daa44c029583d34a02aa8d
SSDEEP 12288:GPStoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:WStoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T1E8D423B0B8CD9282DD1B30793D79E38EABBC641B8146A5036D2DE2F93F7B60585047D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 800f577995f98f5c4e30f471b4560006b4b3731b1fbb1683ce3b7ac5746ed04c
MD5 de7f6c3ec8cc03a67478cdeab0cc4ec8
SHA1 d7511eaf5de65b255befd737958b582a43089bd0
SHA512 194e75c521488c2dabf0e5af9e4872a148d2be790eea4bbdab15625d0b2654cd4f9c4d3a92687502b925ab0e6da0a69bf52c1fc985aaf5f48263994ce950bb48
SSDEEP 24576:BZMWzFaSoNtoTppPu0IruWYxlY3aUCafoZp3MgPMo:BZMWzsPGNpPu0sY73afmMg9
TLSH
T1571501A4B39018F5EC67813ECD659606E6B2BC1A4660CA0F17B8367B1F333514D2DBDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 e3f8675d5d554d0f27b2b795c22008ba40c0275d1d6bcc13a9e7ad47620637de
MD5 7a53a4461af2b24da31fb9345751c242
SHA1 a468fbd48dedc4aa0ff1bdf137ce918e81258837
SHA512 a64cf764b35aaeee8fca9d079c5a184253696503780dc1239b7e8f9e499a3a859552e75b0af8069f696f6f4b2c7df229d980100894afc522834e7273148b7d99
SSDEEP 12288:7BftoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:1ftoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T182D423B078CD92C2DE1B30793DB9A38EAB7C641B9142A5036D1DE2F93F7B60645087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 960ec8bcb5684b373ec875ecb549dc4c8e82479dce0453516d2b4e33fd98080a
MD5 436465f6872ec1705e3b0c3839c6c8cb
SHA1 a7672e916f1aa0d99ab17cf8b4af450736850adb
SHA512 bb9d0e73d63e1cbfdb67c24494ba563466d3fca9f1f558889a1042d152bba308d9ba70360c65b1bb21ea7fb973cabdb295c0a48832c9ec24ef492df4eb8bbd3c
SSDEEP 12288:nXNtoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:XNtoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T132D423B078CD92C2DD1B30793DB9A38EAB7CA51B8142A5036D1DE2F93F7B60645087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 734bdbb6965133463d542c487990983b54f628c3e850ffa3ef65268ee4e17c37
MD5 a0e5da916153c2abb1515aa5e94ec599
SHA1 f07d2db8518f8e037b13c0f0eb2f391d69195d28
SHA512 c180a9b320f34966821aeb7a0f01427dbe8e2a928a0f1bbe52d43c2de81fc1d52b85f3c54f5cfc2750ad1ce995b471ab5143f8f12bff222b4cb6e8359783e0c0
SSDEEP 12288:xfPlQLK0toTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:xlD0toTppPu0IruWYxlY3aUCafoZp3Me
TLSH
T134F4125372D530F9D53B91388CA61706F7B9B83647209E5F176443BA2F277908E2EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 c2a8e62040ca48dfba82cdadce4a92e07325d9126ee9a466cc1f4f7f1551b2d1
MD5 cd63e88143579074049679ba1b7a9495
SHA1 4355a1fa9f963a3b3aba208b9b4d14aad6c0289b
SHA512 81b15c183c8b143139ce5b675055add9a1a515a8645fcb989118f7c478bf83b0e170d75e53546667685ae837751e1fadeab8ceca59d9ff904ba4ba5bddff902e
SSDEEP 12288:lXttoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:RttoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T103D423B0B8CD9286DD1B30793DBDA38EBB7C641B814265026D1DF2F93F6B60545087DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 2d8bcabdd3556f367723f856ae72eca067ba43b7820a604130f0adaaf474cca2
MD5 911ce580e8c91708f44beb88a9773fa0
SHA1 94a426aada8ba8c647ca482df44305b31643b391
SHA512 372ebf1ce0e795f1313e7eb82903b5c7f3e34d684e745806e24c4f4c9b8770910eab6367d68f3e5664665f654d92c1f42c676a45c142b384d005a672e76f9682
SSDEEP 12288:S6ctoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:pctoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T1C2D423B078CD9292DD1B30793DBDA38EBBBC641B814269026D2DE2F93F7B60545087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 0127e5b5e298d3504a69ecfa7828045d0755548854d8d122511078ad3354d2f5
MD5 da2632db33fdf3d5a269db5445ba7e76
SHA1 dcf789f04c45b2483b4c39229ae573a291cf0f3f
SHA512 129c9b0eef2563f9a1344b36f6e4d2025d172ee09a8c79792d902f957263a387c0effbfe45d0c6b47547abbef08472014e7e70907a03479b8b45744cd342fcec
SSDEEP 12288:QfPlQLKztoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:4lDztoTppPu0IruWYxlY3aUCafoZp3Me
TLSH
T13BF4125772D531F9D53B91388CA61606F7B9B83607209E5F176443BA2F273908E2EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 83419bc665797ce8fc33bee6b11b59d927105a2335dd16f0f64bbb8302181b9c
MD5 f26d4fe668203689af7ae0f628b178e9
SHA1 05e78c927a0a51f73b899d29377c4a933a2087a8
SHA512 b255333d3c69887b92b53534658dd372610cfb8d4e7ad65d96cc749ee2b310a5a7d3e8b234883ff199983c5c58ed780c0f76def75b34cb218d9d4f2478fdb28b
SSDEEP 24576:cTdaLG3z0zRSdtoTppPu0IruWYxlY3aUCafoZp3MgPMo:cTwLGj9GNpPu0sY73afmMg9
TLSH
T13C1502A4B39058F8EC67813ECD65960AD6B27C1A0760CA1F17B8366B1F333514D2DBDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 d36713c67f0f7f6a3383c6466df443a1cc23834c4ac93e7ea812525f78007d69
MD5 d433739070f4e0b0ec5027997ed7ebba
SHA1 17bf13f42bc245d529e96f6ce7de60eb28c0e13d
SHA512 2417762262d4c9a66907dffc07c62bf21c1aa3a14b96d2e72012341f8212a3eb859c77c7f35ca4782e3b546d5843f8c8473697db9d32d9a201a0e9525d3b9121
SSDEEP 24576:P3vdeCHQy7vyotoTppPu0IruWYxlY3aUCafoZp3MgPMo:fvdeCHQyDNGNpPu0sY73afmMg9
TLSH
T1E635C090F3E410E4F1779A358D765502DABA7C5A1B21DE8F03A8666A1F337D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 bd766edda5b6b548b6ce29c7d1854f1e2064639e7d7bbb2f8ef74e5472a56d3a
MD5 4f79a6330cb54e4f48fa4982eb25343e
SHA1 e01ce764a0def5e0e623f4c076459e8263961400
SHA512 fbfc74f7f24a6f5c8769125d8e27f10c17233d0205fc7201df3e48731b6deb01169a317aa398c0463ee2c131be696aa522bbbad62b70099ffe10f3a2ccfdf429
SSDEEP 12288:tHCtoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:titoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T18BD423B0B8CD9282DD1B30793DBEA38EBBBC641B814669026D1DF1F93F6B60545087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 cef7547b5317b269e0051c127c62b155b60250a41cce6f665244491eafc6c9ce
MD5 b091bf829683c085e5624db73947594e
SHA1 ff6e27e4b80bfab469c43ac7d6aff94d39036670
SHA512 0e7a3db558b96081fb31f7b6a33045e298f79e0b2d34b5ef5d766c07bb7c3806e21f877e7620963440314b109c21d44fbf538772de72e274f15eb8357b513f9c
SSDEEP 12288:nitoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:nitoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T10DD423B0B8CD92D3DD1F20793DBDE34EBB6C640B9142A9036D29A1B93F7B60685047D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 3608a817168db581b547e50726934d386647ac29f2b9be13053e3ba603a99308
MD5 d173836f7d2bdd021bc627cd9b4fae4d
SHA1 7ad2bd75bdddd364e3c242394ba98f9a86e73b45
SHA512 90119a42c16606517b9e99107552ac78f591aff1a110e6c197fb13d8bd7070004415eaa0d659855c333250975eba893e9638baf73892c71692a8ab536d134868
SSDEEP 12288:glZtoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:8ZtoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T101D423B078CD9292DD1B30393EBDA38EBBBC641B9142A5036929F1B93F7B60545087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 f3eb1851c516b10b1eb5a53de1d794984fc6d9a1ca829d4a4693252fc2596707
MD5 09229d87a6614367793f4b17308d29cd
SHA1 e39806976e6a204827da0378621233694905f12c
SHA512 40dc3b78177047a6ef2fd048898e4f9c615ae9d69657a355256454d6b1e7e7256b1d175a83d8d54ad31f71550bcf113345c0b170e32adb7e38e39d95104d17cf
SSDEEP 12288:5BktoTpLRjoou0s0AoquWYxeKKORY3pAE7/KafoZpQI8RXaOAMgPMo:PktoTppPu0IruWYxlY3aUCafoZp3MgP9
TLSH
T11CD423B078CD9292DD1B30393DBDA38EABBCA41B9142A5026D2DE1B93F7B60545087D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 6a73be1a2fe6fc792126caf7acee1035f144fe5f87bc2dc20014c6a970ae98a6
MD5 7b1f121f220da5d1b4b85d2f391c369c
SHA1 ed12f00a8052a9cb95c89ad4fd3f6f448b31b58a
SHA512 140f5d8912d4fc8495981954c86eef8ad146b0a06e23f6f2f2d3276a9b38b596bafc0939738310b9c22195bdc15b9da9517f63e62c6db08299f1018a1031ca69
SSDEEP 12288:zisfNUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:VNU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T126F40149E2A801D8C0AE9139CB864645B3377C204BE1D7DFA6C1F67E0F716906DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a63047d07be4d0b5a3344d68e672594f7782b8f737761fc38033d1722d0fcbf6
MD5 7b691d4a704feaa3d926634a38f34402
SHA1 79ab119072e131940bd9fea78138e737dc04eb2b
SHA512 247e580f129cf55784b65d4c3718899f1463533ba86bbb75bd9654a473f5524f2378d8c7947d602b238cd57806989caf5cdc8fffe2e34935d9ad730b55633b79
SSDEEP 12288:B07pUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:mpU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T142D42391F7B91C8AE5EE893508CA9229741DA9101F94CCFFFDC393C498607D12D26B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 efb349a5b7f61859872778182deafdfbef5acfca361e9477e380f72d6752393b
MD5 32c795cdfa100883098c54a99fc961f5
SHA1 b541ebd8bc0d70f92865a312797b16b4d763aba6
SHA512 7d7f03083f7bdf7ed249bd93351fc50740e4fb81b51f32bd91387efc8f76d6af3b2a9b7613df6d17d80b246a04bbdcd38446e10dec4f349cc2385db2aadf7b0d
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYrU+qXAh9/ylVYj8nUGZukB3D/L:egb4mBIBhGFMUY3/y3YIzB3
TLSH
T16765AE1E32EC02F5E0FAD2B88DAA4417D6B278160731D6DF1251426D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 e2614b92c1aaabe25814fccc954bb3b814a94876dc238b0757724064b35e931f
MD5 6406f06ae52721ea4b0e1f0f612bf56d
SHA1 c4e9ab8f34362992d1071231612af547a9b54faa
SHA512 0f763814dd8e7ea4ceab13e571be781b3bbeaff5f3eb9bc277e96b97bf91a734da28c7e41c28794eb165823f82657d27a92d02d0b4e1a0c2f527447b4f6db769
SSDEEP 12288:2fGfUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:AGfU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1F8E422A4B6F538C9C5BEC6390892925AB83075201F549DFF8DD2D3B58F507E0363AE98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 12291f8958262ce8e685b200424e0099e46b2a4497dde6b2c7b867078eb36b1c
MD5 8f235e1244531598c9764db8597b1360
SHA1 7dad372a8e8eaa50241929cb70e8083b96d7c8a6
SHA512 a5975aef73c054a56ae585a20665ec91c0df712112cab7ff4df1c16f8a15a3429f4871c6251f3afb729dd5529e90cc1df17ad67792beb1daf572d7040f7c988e
SSDEEP 12288:vhUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:vhU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1A7D423C0F7B95CCAE6DA893A08C3534D781899101F95CDFFEDC393C199907D1293AAA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9b863b457f1f4060c8802d0a2a3e17d0eb7045cd943cc5012c2af52b45f4026a
MD5 8abd30c0b3b4d1d04e44cf9e208e1331
SHA1 e38c3329e6d6519a3bed7af23a96b9ba92bfe4fc
SHA512 9f2e5f2c373f93776d7851419e0dae9974cf9928b9cfdabbfd8fa84200e886f375218decbbf3b04934328032d952aa98b79c1a26c082039781c05ace7972c86f
SSDEEP 24576:itV8u8FpJqH1Bzria7/m1U+qXAh9/ylVYj8nUGZukB3D/L:qqZFPqVIa7/mUY3/y3YIzB3
TLSH
T18435F165B7E101F5D4BBD13889824667F671B4150364EFEF0AA88B951F23BE10B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6335d5af8c30b04b894612fada992bd301d482328996c20b2c8a6b708cd56b1f
MD5 7e1509d24bcba5d20d44df6e82fae99b
SHA1 a8c36c26e981cde5ecf86d2756842246e4d6a220
SHA512 01abb5ddf9d04e2fcfafb0bbc0822c75086bae0af9bdfe80e100c807da0d85b66aaf728b1665b5fc6fd70aaf3db27bc8100758abb8434c557ed20c2ec404850b
SSDEEP 24576:yPUr+NQwU+qXAh9/ylVYj8nUGZukB3D/L:yJQwUY3/y3YIzB3
TLSH
T11205E15E62A91CE5E67AE13D8982830DF731B4611711D6DF02D1827E4E63EE87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 5d9f96d6ec78d8b56b857e131b093b75205eb4a2dcba0262fa238f0da1534e1b
MD5 0c6dcbc5bc8ae59060d3b72e37b89466
SHA1 ad9cce7ec3dafdc53965138c457433e42ea4628f
SHA512 d6f56cf96fce8f3ec71608b497d6d115baead4a92ddfed3d40d5f501044f31d1d4643129bceb8edb5f205f2c0b41c0c3076fa0eefb6c74fb0cbb99bd5c36b78b
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdUY3/y3YIzB3:bG05lO43bZY3gYIF
TLSH
T151D5CF6A62EC11F9D1BBC17CD9C6860BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 856681bd38620c64546e63d4ecd57c7ce36fa2e60ad3c171d4db529485157a13
MD5 cf80675372a62ec0d092b380b88ea9a4
SHA1 022ff5bc3d8d0194cc91b22ceabca7345bca3e11
SHA512 0364078c832650d3e6cc5cbd988e80822dcf7db690b98516097ad694201d61a6229fc0f0eaaaa5b4ad35cdf5c07ff30885943f53da1cea25565847d74701a384
SSDEEP 24576:0/a5POZ3dpbWVM50JicR2hG0lasx2+47eidnqU+qXAh9/ylVYj8nUGZukB3D/L:4a5POZ3wJt2pasx2+m8UY3/y3YIzB3
TLSH
T13565AE5EA6FC01D5D5B9D17DC583861AF5B1342113329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a087e478649fcf400533dc4793c8548d289493ac05fa9d8785c0636c82bf7578
MD5 0fab1ebece7afeaf6207b750bca4ddf3
SHA1 6bf5fd7eb94c6ba13965183a6d86c691c84e6570
SHA512 5d74596bcd7794f93df3f4d3ebde4187b1f3deefc4196c8d49932c90123bdb87dc85936ff3ec8ad8c0bb229b391595acfcf3adf89b128bd0e7e75d099a72c200
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkpU+qXAh9/ylVYj8nUGZukB3D/L:xNc/zEOVHF+UY3/y3YIzB3
TLSH
T171858C5623E901E4F1BBE1BE89779646FA71786517308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 189798923e0902a5c3b2eba2a000992cd3bb36e7d1139fa6618ae0cd0d829f8e
MD5 6706d66654b31db81903c8f7abac85a3
SHA1 6d61471b2836e5ea095fba097ed119c3395cd2f2
SHA512 d2fa206b9f1d55bc0aeb1bcee391e9c601c32df94768cecd433e53084494eb6d47cec5a33e05c09eeaf974b5aca368e74be1cb7ec60f3bbfbbd976c379cd98b5
SSDEEP 24576:sJnJPbzB4SuU+qXAh9/ylVYj8nUGZukB3D/L:sJnJv6SuUY3/y3YIzB3
TLSH
T19715E07DD2A810E8E4B7C2B4815A175AFE31386C2F2169DB59B4D5343F12FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9fdc89a681b6f77fe9ce3b47362ebb6310538dc1a4c40023db8241e1515b52b7
MD5 cfcf888ba671c7ae2080308fe711bea0
SHA1 65d99e2c1dc622ba0703198f916fb33becd9d0b1
SHA512 d1aea0d98bd3d59c9bf85708face3ae2f955c12b7428618b06f06df57bd76fccb8453edec8e8b22c69b25692960fae6beba9fccf24ec6bb66958773ca0db6552
SSDEEP 24576:UCLHGL0MoeVtFumTijCmlKQWDkHU+qXAh9/ylVYj8nUGZukB3D/L:UCLHGeeV5ijCmlDWDkHUY3/y3YIzB3
TLSH
T1C8A56B05E7EB5184E8F3CAF5C92294169A327C549B34F7EF4E80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 89770da7306bb7f247c0eb3ebbee1a1b698f788356ce78d70e77ebab98cec8c8
MD5 b2e5d1c7f69e95e13339cf95fc133f4b
SHA1 74933b029d09bbeb738efcf61c5e311f243b2c94
SHA512 d41fe200e63f7c39501005616bea331ed2e3b6fce35f0be856a99395f3914ddd78fd612e7c1edd3e227c25f93c67ded820ad10b9eba7019453d4f929f93fdce0
SSDEEP 12288:x1Hck6j5ZI7aUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:p6DIOU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1DBF4015C737A10F9D1ABC03E85830206E172B4708B5259EF4AD5C6B98EA3FD8B93DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 b7aa3ccd797c4cb4170729e87265d7c3c53f1e77c09c0ffa776c6c1215a82edd
MD5 e6bd79775f382f614fb81ef478cd8998
SHA1 cacb2b72c7ff0bff7e463d99e0f3df82095d4e0b
SHA512 3c1989213381070c29ea1b237edc96bcd4cf4548781a98a6ac35d082acc3470a67c67e407e873a78ced69ce645a0533311d7924a9380879f783155e8c2e764d0
SSDEEP 12288:UG6kytUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:FtytU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T1BCF41240A3B424C9E6FE463848A38258AE34BC201F51DAFFA9D2E76E5E317D06D35F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 6b9c73466e43670565f0661a9667d56bb7c30c4868b641e0be1532496185c5fd
MD5 095b19746abd8b7ba6bac32ed24978dd
SHA1 fd301a41dc3ca5aeea371499a971f5bcb44ab170
SHA512 7e5be79864e7a6146426229c37cbbca193e8bcceaf31b4425cf724207b463dd98c03111bae7a2abab72421c1d951ac9b70ef3b84a9d1d0ceecedbf966f6e3296
SSDEEP 12288:+o+UFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:1+U+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T107D422D0F7B528CAD5DE893908C2534EB428B9201F959DFFEDD293E0CA507D12936E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 bfd6c15b0e510031166c49338426766732ca78cc7493b6c57738856aa4d59ba5
MD5 a8617d72e855bb09d53130943cc7ed2e
SHA1 e55403a33d130277dfc3bbd45745e08bcaa13c8e
SHA512 f8c48777ebe7cd140510a035a7fa263cda78f97a6b6c748a748ff402cdf2e117eebbabad226b7f4d36dac8e9b23532b8cf9185e0490fa9cdf391a198616b1404
SSDEEP 24576:SggILoTfaidZYU+qXAh9/ylVYj8nUGZukB3D/L:PgHTrZYUY3/y3YIzB3
TLSH
T168558D1DB7FA05CAE2B2D635D8625493D633B4311772C6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 ac00c19b777fccfcbefb8dfd39858a45a7d6a1061e7e3d00d7ec8aece5255b10
MD5 98c7e0091f91082f4d44ccebc2663f1c
SHA1 b6b3a49625e0581e9986a896bb6fc3bf7247b39d
SHA512 7f256f64b506db1b69049411948b2d00683756c4923b635a438db58c89cfa10715a575981ab0d7f21947aa15e43db8d14f43c344d3d06ab22ecd02b20b2453df
SSDEEP 12288:+pJcm8CNiUFwqWD/GAhjzl/ylVS3zbz78TTPP+DjVGZu2Za9Y3MF6XHEwc0S:+rcmRiU+qXAh9/ylVYj8nUGZukB3D/L
TLSH
T13D05F04AB3BA00E6E1BB813C88824219F673743017519BEF46E1C7BD4E53AE97D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 706e5ad857aa6ae2e553f283a5df2c10adab00cef0ae68e2f7d1a6127e7f572f
MD5 d6b63c4a7e70bc78933dee04c4d5fa4f
SHA1 39b88a2d452802aa7a1873a423beacfb375d5e3a
SHA512 630cf822aea9ace41d2eb2651060ba2e25c7342dada5581f5d295dc555dede655a11e1b69a3bbaaec31d7799eb320e9fbf822e8374beea178fbd5d15bd19f6bd
SSDEEP 49152:XDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3+UY3/y3YIzB3:s3Upow8sBYY3gYIF
TLSH
T147A58C3DA2E800A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-293-0x00007FF71C580000-0x00007FF71C62D000-memory.dmp

Download

memory/844-295-0x000002DA2CC80000-0x000002DA2CCE6000-memory.dmp

Download

memory/844-294-0x000002DA2CC80000-0x000002DA2CCE6000-memory.dmp

Download

memory/844-379-0x00007FF71C580000-0x00007FF71C62D000-memory.dmp

Download

memory/928-353-0x000001A109050000-0x000001A1090B6000-memory.dmp

Download

memory/928-449-0x00007FF6A9880000-0x00007FF6A9B0A000-memory.dmp

Download

memory/928-351-0x000001A109050000-0x000001A1090B6000-memory.dmp

Download

memory/928-352-0x00007FF6A9880000-0x00007FF6A9B0A000-memory.dmp

Download

memory/1372-448-0x00007FF71DC30000-0x00007FF71DDC4000-memory.dmp

Download

memory/1372-330-0x00007FF71DC30000-0x00007FF71DDC4000-memory.dmp

Download

memory/1372-332-0x000001C2083F0000-0x000001C208456000-memory.dmp

Download

memory/1372-331-0x000001C2083F0000-0x000001C208456000-memory.dmp

Download

memory/1932-267-0x000002761FD70000-0x000002761FDD6000-memory.dmp

Download

memory/1932-359-0x00007FF6BF0A0000-0x00007FF6BF1E9000-memory.dmp

Download

memory/1932-264-0x00007FF6BF0A0000-0x00007FF6BF1E9000-memory.dmp

Download

memory/1932-266-0x000002761FD70000-0x000002761FDD6000-memory.dmp

Download

memory/1980-58-0x00000159C7670000-0x00000159C7731000-memory.dmp

Download

memory/1980-59-0x00000159C7810000-0x00000159C7876000-memory.dmp

Download

memory/1980-60-0x00000159C7810000-0x00000159C7876000-memory.dmp

Download

memory/2188-0-0x0000000002780000-0x000000000282B000-memory.dmp

Download

memory/2188-6-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/2188-1-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/2188-8-0x00000000029A0000-0x0000000002A09000-memory.dmp

Download

memory/2604-244-0x00007FF711900000-0x00007FF7119C8000-memory.dmp

Download

memory/2604-338-0x00007FF711900000-0x00007FF7119C8000-memory.dmp

Download

memory/2604-245-0x0000023DEC010000-0x0000023DEC076000-memory.dmp

Download

memory/2604-246-0x0000023DEC010000-0x0000023DEC076000-memory.dmp

Download

memory/2652-237-0x0000021C06F20000-0x0000021C06F86000-memory.dmp

Download

memory/2652-236-0x0000021C06F20000-0x0000021C06F86000-memory.dmp

Download

memory/2652-235-0x00007FF711900000-0x00007FF7119C8000-memory.dmp

Download

memory/2652-329-0x00007FF711900000-0x00007FF7119C8000-memory.dmp

Download

memory/2784-323-0x000002413C610000-0x000002413C676000-memory.dmp

Download

memory/2784-443-0x00007FF741440000-0x00007FF7416E2000-memory.dmp

Download

memory/2784-321-0x00007FF741440000-0x00007FF7416E2000-memory.dmp

Download

memory/2784-322-0x000002413C610000-0x000002413C676000-memory.dmp

Download

memory/2812-37-0x0000017B4CEE0000-0x0000017B4CFA1000-memory.dmp

Download

memory/2812-39-0x0000017B4E0D0000-0x0000017B4E136000-memory.dmp

Download

memory/2812-40-0x0000017B4E0D0000-0x0000017B4E136000-memory.dmp

Download

memory/2812-38-0x0000017B4E0D0000-0x0000017B4E136000-memory.dmp

Download

memory/2984-452-0x00007FF7ECAE0000-0x00007FF7ECC0E000-memory.dmp

Download

memory/2984-380-0x00007FF7ECAE0000-0x00007FF7ECC0E000-memory.dmp

Download

memory/2984-381-0x00000170F9FC0000-0x00000170FA026000-memory.dmp

Download

memory/2984-382-0x00000170F9FC0000-0x00000170FA026000-memory.dmp

Download

memory/2992-369-0x000001D8467A0000-0x000001D846806000-memory.dmp

Download

memory/2992-371-0x00007FF69C4F0000-0x00007FF69C9F6000-memory.dmp

Download

memory/2992-370-0x000001D8467A0000-0x000001D846806000-memory.dmp

Download

memory/2992-451-0x00007FF69C4F0000-0x00007FF69C9F6000-memory.dmp

Download

memory/3028-446-0x000001FB11D00000-0x000001FB11FA3000-memory.dmp

Download

memory/3028-442-0x000001FB11D00000-0x000001FB11FA3000-memory.dmp

Download

memory/3028-447-0x00007FF7DCF50000-0x00007FF7DD366000-memory.dmp

Download

memory/3028-389-0x00007FF7DCF50000-0x00007FF7DD366000-memory.dmp

Download

memory/3028-444-0x000001FB11360000-0x000001FB113C6000-memory.dmp

Download

memory/3028-304-0x000001FB11360000-0x000001FB113C6000-memory.dmp

Download

memory/3028-303-0x000001FB11360000-0x000001FB113C6000-memory.dmp

Download

memory/3028-302-0x00007FF7DCF50000-0x00007FF7DD366000-memory.dmp

Download

memory/3416-254-0x000002C50FBE0000-0x000002C50FC46000-memory.dmp

Download

memory/3416-350-0x00007FF743DC0000-0x00007FF743ED9000-memory.dmp

Download

memory/3416-252-0x00007FF743DC0000-0x00007FF743ED9000-memory.dmp

Download

memory/3416-253-0x000002C50FBE0000-0x000002C50FC46000-memory.dmp

Download

memory/3688-391-0x00007FF7EE1D0000-0x00007FF7EE283000-memory.dmp

Download

memory/3688-312-0x00007FF7EE1D0000-0x00007FF7EE283000-memory.dmp

Download

memory/3688-313-0x0000014E73170000-0x0000014E731D6000-memory.dmp

Download

memory/3688-314-0x0000014E73170000-0x0000014E731D6000-memory.dmp

Download

memory/3760-286-0x000001F7A1EF0000-0x000001F7A1F56000-memory.dmp

Download

memory/3760-375-0x00007FF6C3790000-0x00007FF6C3ED3000-memory.dmp

Download

memory/3760-288-0x000001F7A1EF0000-0x000001F7A1F56000-memory.dmp

Download

memory/3760-285-0x00007FF6C3790000-0x00007FF6C3ED3000-memory.dmp

Download

memory/4112-279-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/4112-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4112-274-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/4112-368-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4284-46-0x00007FF6560E0000-0x00007FF656247000-memory.dmp

Download

memory/4284-47-0x00000163630A0000-0x0000016363106000-memory.dmp

Download

memory/4284-48-0x00000163630A0000-0x0000016363106000-memory.dmp

Download

memory/4284-53-0x00000163630A0000-0x0000016363106000-memory.dmp

Download

memory/4284-55-0x00007FF6560E0000-0x00007FF656247000-memory.dmp

Download

memory/4296-29-0x000001F3B90F0000-0x000001F3B9156000-memory.dmp

Download

memory/4296-28-0x000001F3B8F40000-0x000001F3B9001000-memory.dmp

Download

memory/4296-31-0x000001F3B90F0000-0x000001F3B9156000-memory.dmp

Download

memory/4296-30-0x000001F3B90F0000-0x000001F3B9156000-memory.dmp

Download

memory/4432-453-0x00007FF603C90000-0x00007FF603FCE000-memory.dmp

Download

memory/4432-390-0x00007FF603C90000-0x00007FF603FCE000-memory.dmp

Download

memory/4432-392-0x0000021C5C670000-0x0000021C5C6D6000-memory.dmp

Download

memory/4432-393-0x0000021C5C670000-0x0000021C5C6D6000-memory.dmp

Download

memory/5024-360-0x00007FF607C90000-0x00007FF608160000-memory.dmp

Download

memory/5024-362-0x00000203E24C0000-0x00000203E2526000-memory.dmp

Download

memory/5024-450-0x00007FF607C90000-0x00007FF608160000-memory.dmp

Download

memory/5024-361-0x00000203E24C0000-0x00000203E2526000-memory.dmp

Download

memory/5376-17-0x000001FE98910000-0x000001FE98976000-memory.dmp

Download

memory/5376-18-0x000001FE98910000-0x000001FE98976000-memory.dmp

Download

memory/5376-65-0x00007FF750970000-0x00007FF750A92000-memory.dmp

Download

memory/5376-16-0x000001FE98910000-0x000001FE98976000-memory.dmp

Download

memory/5376-15-0x00007FF750970000-0x00007FF750A92000-memory.dmp

Download

memory/6008-345-0x000001AF42F80000-0x000001AF42FE6000-memory.dmp

Download

memory/6008-347-0x00007FF6CF260000-0x00007FF6CF580000-memory.dmp

Download

memory/6008-340-0x000001AF42F80000-0x000001AF42FE6000-memory.dmp

Download

memory/6008-341-0x000001AF42F80000-0x000001AF42FE6000-memory.dmp

Download

memory/6008-339-0x00007FF6CF260000-0x00007FF6CF580000-memory.dmp

Download