119779f6b429f23d30e90b18fd3062f31e5e7c795118ccc63d9a7650aba70110

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260720-dagadafx6x
SHA256 119779f6b429f23d30e90b18fd3062f31e5e7c795118ccc63d9a7650aba70110
MD5 9acbd31d3e6ce2533d333bec0522bfeb
SHA1 fa4022566597ba8980cd2b6784e3121a15af520f
SHA512 1ed80e61539e82b128fe81e822925a5513bead4e7425a1732680b8f6c04ae6ea378910a8534be30fffa88f3c069782a23f5105a5f7f259420f44a2b3aa64fd60
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJhT7Jckdwi6i9bNrqq4E41WFpW3oRos:zul13qcQFTIOZeB7Jckdwi3N7+WTW3
TLSH
T11845E01EBEF1C032C12352318E6ED358B2B5A4B248264847BBDD675C2F701D2973AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1776	alg.exe
5344	elevation_service.exe
256	elevation_service.exe
3820	maintenanceservice.exe
4144	OSE.EXE
4900	GameInputSvc.exe
1272	GameInputSvc.exe
3040	msdtc.exe
5296	PerceptionSimulationService.exe
4272	perfhost.exe
2796	ReFsDedupSvc.exe
4456	locator.exe
5376	SensorDataService.exe
5540	snmptrap.exe
4892	ssh-agent.exe
1500	TieringEngineService.exe
4864	AgentService.exe
5528	vds.exe
988	vssvc.exe
2128	wbengine.exe
2340	WmiApSrv.exe
796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\abd6329723e529ce.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1272	GameInputSvc.exe
1272	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5156	2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	1776	alg.exe
Token: SeDebugPrivilege	1776	alg.exe
Token: SeTakeOwnershipPrivilege	5344	elevation_service.exe
Token: SeTcbPrivilege	4900	GameInputSvc.exe
Token: SeBackupPrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1500	TieringEngineService.exe
Token: SeManageVolumePrivilege	1500	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4864	AgentService.exe
Token: SeBackupPrivilege	988	vssvc.exe
Token: SeRestorePrivilege	988	vssvc.exe
Token: SeAuditPrivilege	988	vssvc.exe
Token: SeBackupPrivilege	2128	wbengine.exe
Token: SeRestorePrivilege	2128	wbengine.exe
Token: SeSecurityPrivilege	2128	wbengine.exe
Token: 33	796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	796	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1272	4900	GameInputSvc.exe	97
PID 796 wrote to memory of 3772	796	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_9acbd31d3e6ce2533d333bec0522bfeb_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5156

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3040

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4272

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5376

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4892

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5528

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0a1e72ff1c1e9185f57955c7ce06e0911a39663cad5fc1482e89e92999b7483e
MD5 a04636c9efab20c8313399fa9548a1ad
SHA1 def446b2423f0ba8500143a2c192101821ce51be
SHA512 0eea38ebe8853ac250facb50424fb88f5089756f0cfceb1bf58d8da89656c98250f20700c0f9fbeced060a17e5be52834f2cba2502ab6513ab5d886738c3dce0
SSDEEP 49152:bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnJ7Jckdwi3N7+WTW3:p3q6gjBQPdwi3Q
TLSH
T1A3D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 e538d732e96bc39e95a0e46b3baa6971cd91bec0bfd72e409c72103ac5db51e8
MD5 ff99541bdf7ab3220319890be4ff2251
SHA1 1857f72243b6dd6b78136537abf857073f09f8cc
SHA512 2ba1db6d8acea457ec63160372ded36ff1775995bcdcb5e14411df2adb5bb4c1f44ee640c1a2711622a020f45ef22c6109ec31dd493ebe6c68b8b2ad62b74fc0
SSDEEP 24576:7XYkeOczA0T7Jckdwi6i9bNrqq4E41WFpW3oRos:OOc37Jckdwi3N7+WTW3
TLSH
T122050128A3E409F9ED67C239C9B2C515EA7278514760FB8B03E496651F233C46E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5400491374cfbb95ae92e67c7f465b793f00f2bfb106417d4dbe7c56e8751f59
MD5 e62cf974e2e95a9d03a923265f03c2d4
SHA1 7dc8a18aa0b02d2940b99036f18e668dc7b9f437
SHA512 2d886e3af9a42ba773d99671ed9d5eef6cf08cec503fdf8b2886b84a7c94b0be014b45cd8f97c2e8cfcb552aa9668c8c27258c50714d374208e2816dbb3a1ac7
SSDEEP 24576:n0NezM309fxOrMUT7Jckdwi6i9bNrqq4E41WFpW3oRos:nDM301o77Jckdwi3N7+WTW3
TLSH
T1AF359E16F6748335D073C0B9C5D2A69AEE7130825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4bc847134886651e1415221342f1cacbcd87e7cd4d44c55f9510271b6df71845
MD5 db71ce1de6aed6b24d835bf5e483165c
SHA1 1a217778192f99ac86950dda668cab315aa44146
SHA512 59b6428a939e3ebd8f2f9a06f0a37371b6de35c76e4f9da9f9624fd9b8d2a0d45f7eed137424079ed544ef2c9b131b99c62bb9284bc58fcab397e90a480b5f92
SSDEEP 49152:P/ezSC6vUzPvuHjym7Jckdwi3N7+WTW3:XezSC6v2XuHxPdwi3Q
TLSH
T168755C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6dee02bc0b49681a19eb90bac5a5461b937e721fef5b12ba68e7c426ef6c3d17
MD5 770ddbfa652146b48445e6037708d816
SHA1 bfb17c9ff764e1cf107af7a914878ed72d5cb78e
SHA512 3d11278310ed558e45e5e9050a57b2c79b84cf08d1b51be2677e0904f2bd8e31a802b552766782e6d60a655831d2da823db54e5e3c58ad36b87ebe85f9453d1f
SSDEEP 24576:7AbBPxpQov/l+dDT7Jckdwi6i9bNrqq4E41WFpW3oRos:7AnpQoXl+h7Jckdwi3N7+WTW3
TLSH
T1D4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 a3db81041f367f78a08275f14066528157bd79210aacb0e217e9a40a0bf8c0f0
MD5 245b698ed2004f226acdb777716b1f77
SHA1 ecf6eff9e300cadc2272050d57a9922bbf18b6ee
SHA512 4000caa4f84bd69e2e5174106c84922be8f98ff187730537f9ec01b23be6085648d9e70e5cd47c22d0f130f307f4bb9e84c03937113c8c803efc314d84ffa384
SSDEEP 12288:Q34T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:Q34T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F1D4234CC64956ABE3A7D231977DE6E8FAA42E423859FE0547A473E0542D340B38BF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 b53ed73e63360b63897bfd0c2bd446fff1f7df9cae90eeca48c280af2ddd10c7
MD5 bbb1534501df7ec296be5597995e61c6
SHA1 3211f67a816d542bd9eb0ad8560f0ba91a0c255a
SHA512 7b29a1917cbabee74f566d5003c46d2443b4f88de6d1204f2f0bdd1445c35ee3b6190763e64efaaac9270b2f6aba470560cd3efeb42af9f6c2cff45be1ff6ed9
SSDEEP 24576:yJIUoT7Jckdwi6i9bNrqq4E41WFpW3oRos:yJIUq7Jckdwi3N7+WTW3
TLSH
T18915CF2BEE28FCE2C27A9D795751C640E7B278314F62A3CBD164820DDE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 740ab6bd28bee081fcd51fbc215e6ae65cbe3340eb73a4c8693a1a779bd58c49
MD5 6ebc7f3725c8189b6e8f8d1e0a607aa4
SHA1 2452dc8645c928f1ebe228d363b1329bed8f8504
SHA512 93e4156aa4a211a7220a6c6278f76e9895b707ec0fa7497819330ab190d03fbaa14708ed47dff4ec4adc0be23c19b45c663d6d33fce44cc99548ede547ecc509
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5JnNRV3TH+:XQvGAdlCEL8c/bRNz5CGPdwi3Q
TLSH
T1BE367C656BF880F5E0A7E134897AC6B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 86916bbd0e3f91bc4af156fc3342db80258240268372c66b8a8fe4568dadae89
MD5 adddb1652e67bd558e6833f851616bef
SHA1 c8463e502318c482c1bbad6796cdc033e474faf5
SHA512 e99cae51f760de8d7c8e602bf2ee196203d4e39ff7f5a9e27906a72a332431cfc022c5567980626eda17c9c6577b048940304e4304284a4f1704e1b1b1f296a6
SSDEEP 24576:gmewsAjuT7Jckdwi6i9bNrqq4E41WFpW3oRos:jljU7Jckdwi3N7+WTW3
TLSH
T18B15E031FA74E436C37B0DB21B35D716647C7A204F612AC3E3E89A9D59342D22376E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3130025e4ca1fa0f318da1a18aaa9c00863a36c3a4ddf1f5e3120d984c7ac9b3
MD5 f7a192b52b60b32c11aa8dbefda9104e
SHA1 121a7cabfc5ba0ba6d4f411a2153d3579959ecc8
SHA512 800e9901e16e1cab2fd7266d1ad9a406d07b8b1b72954f1aa0a3626343ef63267769da3488191bb7738098ce05d67bbf15b0065e5413a69f6f929d6befe414fe
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHoPdwi:FUEtQevvqc2W1cpV2X132oPdwi
TLSH
T16F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0199fe8d5f44fda9ea95f035b1fcb7a3ce171ae2d3067a8b47fbddaeb9971b22
MD5 31c6fe80efee425fc83131329f68ba5a
SHA1 c83edbc7ee0099897860c4ba70b74898ff9ddfcd
SHA512 fe5e5f1f5965e83de717a15a125ad70b9fbd84979a6791be8f325220b0e4a5794afc9f744e176c0a9bf7f2528b023352b54a0077aa5db9837e3b164bcb03f57d
SSDEEP 49152:eMbRquA/m2yL5zMfFiV+XenmE3/zs7Jckdwi3N7+WTW3:Roq1VjnmpPdwi3Q
TLSH
T12ED58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d07d9232c4405a6e3cc75cdc60952841fc5324706c02c70f3a604058e0faed5f
MD5 d9af3c1e66ca43d0520cceee75e07cb3
SHA1 15ee9c222c711cd1f682450015c19b4cdeec18b5
SHA512 d8407a12333b1fe6bd5098495207c69cbc385590b0a0a08d5575a59ed1a7ea6be58ae1f8ce085ed505577f96a19fab551806b9359836bc7accbfcdacf6d460e9
SSDEEP 24576:BAhGLv+FoiwtA5l7S530T7Jckdwi6i9bNrqq4E41WFpW3oRos:BAM6Foiq5G7Jckdwi3N7+WTW3
TLSH
T1D745AE80E7F955D4F5F3AA7899B69170EA76BCA65E31D20F1260D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 632c7296eb2d9d5d26ec19350410f0bc6a5be2699ca3769d80bdab83adbe6290
MD5 de07b3a490d9c6f8d873ad675eefb736
SHA1 5e53af3baf2cc1858fb8ac41112d60bb7f9248bf
SHA512 4640c4b9b82421c721d5e05eb31e97cb0266d2a634fe905411a4c0860d59c48c5c4e32df49cb1a95de05ca24d6b8c5621cb3afc05d5aa69894230068c277e26a
SSDEEP 24576:Owu+OWqT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOH7Jckdwi3N7+WTW3
TLSH
T18205F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F0760C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 1a8251670ae84c6ae7d4fb55206d7d71fa7250099e8867a5e4aaeb81a65c5951
MD5 80cbbcf44e3a1d9a75cccdc641b17fec
SHA1 d0713da0816a4a13450ae590dd8ae7348a6eb1e5
SHA512 32acd388c34221a9ba390849c804c0438c0bca65e0cae4a328b43819571995a72bf55662f4252f9a590b5eaa59011df0f11ffd05ef616a0f7acc6f67d2b6ca5c
SSDEEP 12288:6ro1Is0T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:CoupT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1ABE4124D239421FAE2A3D239CAF99644E7B138532735A7CF066453A41F277C16E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b31bd9cc6a2823344c8b4fa8307a736c079848755ddaa93916fbc4f69d846998
MD5 d4cd76252e626344f0bd388ecbfe292c
SHA1 6ae07186d8990f332506b5da66d306b21b24f4f4
SHA512 b242fa63eb1583a81ae930f462d61e955480eced16a69c97f6b06f2888399f9976db0cc81d8dd7d8cd80cfde964b55996bd8e238fc50e054c7db971b2e4c5d4e
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uv:cQRQyi36YOcP8Lvw2gAf+PN3uPdwi3Q
TLSH
T1BB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4eded64b6c1d8b4e72bf3fa86e5b25d2b9803d315f50397c729c2ea95f71dd44
MD5 d4bfbb1524691c1b52f1e9680c2a41ab
SHA1 fff8fa6b3d6b91d48adc851c3c92494deca5abb4
SHA512 214343bf90f1ac609c15a62a9e1e9c4a7680a5938f9d6a839f3f84a32c222d4f31ecc150d3fbdd457a01ed85b3276230255798e2743680c6f992b50c974311d1
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uq:cQRQyi36YOcP8Lvw2gAf+PN3XPdwi3Q
TLSH
T186667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f8b923f50422081e57cbec09b0b7d1a0ff8e3493a04c9fb7ffdc27f15b462a8c
MD5 dafe3eb017ed8308d633c0a96adeb13d
SHA1 94592f80ed61f1ab1e5f179efec21710eae1f53c
SHA512 719703544b62ee06a5cf5def165a09749d1882dcadd91e04f5da45f51041196410e37c7410d53d50daa7a6c01cb2dc679b531b4c6b623bf92c06db06e5109223
SSDEEP 49152:r68Qg55nhMeWu7PNU3/S7Jckdwi3N7+WTW3:1thbRc/gPdwi3Q
TLSH
T104B55A33B2F600A9C44DE1769F4A973196E17C718FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a76dfc937a303992f9e8fb095069d04263e10a3076065de9730f6c01bfbeb289
MD5 6be24bc2069587c5e3e85a0f83dc1f3e
SHA1 bac3aeb5607ceb04e0796c33eb9abbcba2bec3a0
SHA512 fafaf570a14b954d2fe2534166229b5192b3c7dcabec98a12245a0f57594b729eeb917bae8298244dcb65dbb529510c0ceeaaed9b28f6ded54122ca885b3991d
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99/:5y5112gYy5azzVv569nLKnhZ3Pdwi3Q
TLSH
T134167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e415fbd044f5b8a5b906aa0123072dd93aac4ed4e3390b357cd27cbbbe53ee5a
MD5 023e248977bc8e405b02e3ebc0a97ae9
SHA1 9534543125cde9329c9aed113702d669cb521f58
SHA512 f1f2c729eb5cac24b99c78249adadc0ba3675fd90e9db9750d2dfb283f97370add8d684f3d7c76db0ec04f04b746e39524e1d0d4264f2a81204b2571ac402fe4
SSDEEP 49152:CB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glt7Jckdwi3N7+WTW3:wu6JmTxd2dLPdwi3Q
TLSH
T1B3D59D13F1DA01E8D06ED178974A9232FA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a98cb6258febdd8bf73cec64f182940686a808909b45faac8f09f741d16d9bea
MD5 80dad0e504e0003edf37b969eaa69798
SHA1 3fcb6ca27321e6bb8bc8b36ce19676f57d3b6329
SHA512 b627205246978a117be30a1ba4a90713d2bcfffc1a0684f32817d20eaf1ea3fea83180db166383dad0b8fb55128f6f33cb0b64a7d2d50aabca4c4ba504675ece
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4x67Jckdwi3N7+WTW3:cmifPbRZPdwi3Q
TLSH
T1E7B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7951F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5a1e274c883688fe215d3700425eebddd70b98a687ee990ab2e5e6cc1520cbd0
MD5 779c03981d1b820c0f91e0494a9b78c1
SHA1 8b161a66d9ddcf025f27935ba1a78b8952b5919a
SHA512 8cfbe12d2b089f5d57c776c1f74254f37f89afee42588cd2f5559844edf451a5054ba2995453070df3a14a6237331f8440ebd7754c3db75203698d5e951073cd
SSDEEP 49152:CSuZQIY0Be2K6RVtOnks6NMHqZ7Jckdwi3N7+WTW3:c5dKoi613Pdwi3Q
TLSH
T1F2C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8a608c0e74791f293dcc46392ff6eb84faf81658fe819a79ee5d7e88f7f69df5
MD5 93cb90f3b0784cc93008f8718073dfc8
SHA1 e85e9e8819ca255f0d5c9c83e32a4f0eb7c01783
SHA512 ead2a1dde2241af2d73184c1b89008aa44fcbb06bbe147dbabb4c5c9f40a163c262e775d021efb877df2f67b7fb2dbf315c87245529ed3bcc1d8892eda2cb1e6
SSDEEP 49152:RHlSn8EApI0figTgiDn0AP5wxb7Jckdwi3N7+WTW3:yX2iyphwBPdwi3Q
TLSH
T108A5BE13F2D900E8D05ED174C7568632EA62BC060B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 58045b24189d1a00d58b6b390516f9d018a487af7a08919ea7817e6a5bf50a12
MD5 db706c27fd8d2475c7f0c8a6f827df90
SHA1 dbb34df10138557efbb705752589190d48bbba63
SHA512 f041fc29e8f6a1bb715376063415f6ab0f4209e41415e227535d35a0acec669516cbd342a20a4e628c78830853975ce973e9a41bff43261b6ad2a775cb4fb22e
SSDEEP 12288:Wp+T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:Wp+T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T17BD4234CD55A07ABE353E231C33DE6D8FAE82F43795ABA05479862A0555D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 fddfaaf3ed2bc5e21a5f89482a2be70121d49e59b25d4c7b3b7608b1398464e0
MD5 af8120973cac628af31b2cc8dc36ef95
SHA1 abe02a9bd43d2e940fa75ace6a2b608641eace0f
SHA512 93a239810f4bc99510e49e8c1c6b8c9fd72eb2163d1a40d5b211d229428b491694fd551581ea804bc71963f1c2ee36095bd9b0c71d6c9cad85666c0fe33e5c2b
SSDEEP 12288:4QT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:4QT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1ACD4234CD55A06ABE353E232C33DE6D8FAA83F437956BE05479862A06559340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 0a18ec0cc2d1a57e645f42eb86455c0ca5914091a6fa9e3e1e65bbad04b7ff7d
MD5 09b27d24a20a61e2bf39334fa39c5ab6
SHA1 fcdcc55e12019a03f22eea237b257d4c81fdce71
SHA512 be2867c88beb6cdb04f90bcf833f633eeaab24b700f43abcf0c0ac35b0c7057d841d890fa98f96da7cf0a492f1d3a007c640938777db7c28351f2a98b19bc93e
SSDEEP 12288:qDT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:qDT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1CBD4234CD55A06ABD353E232C73DE6E8FAE82F437D56BA05479862A0655D340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 51a00a876cce93dc20703e6b3a4f3db34b37aad293f3f8ad40a87654c58a4730
MD5 3ee11b7e000f416ea4e705b2860059f4
SHA1 cef812bc92ff3cf0005261d4584804806a89e51b
SHA512 85ba427dcad5828b48fcb39901ea9a3a6754ce8e9341276793ad30bb9528b3e7e391b536f486b81c3ff4d605fd85dc8a88726c646c2f154fa7fefa4fe16f6d4d
SSDEEP 12288:ZlFT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:xT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T160D4230C975A02EBE663E231C63DE694F7F87E427A36BB0F479012A41969340775AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 6d39aa74f5bedba9b15413ffe8848054ff841fdbba195585a00afe8c6e7d39f8
MD5 b576e8a0deafb94acf3ece75f3cfaeff
SHA1 c2cb535633faf7529133371d3fa6bc8aa98a7cbe
SHA512 58be8db5dab503ea3d69c54cf0996fa0f0b9793a26a4c42c7df10a3c70031a5bf540c88323a1dbc002ad320fcc257baf818b647e0ee0867731dc3dc90b1ec3dc
SSDEEP 12288:5uT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:5uT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T190D4234CD65A06ABE353E232C73DE6D8FAF82F437956BA0547D862A0555D340338BE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 1f735c64e305acd23dd3124f3485c53bdd539321e9d83122fd6a92d2ce56902f
MD5 573e7a69241464e61ac441484d289a30
SHA1 f19b04dba9964c39842c627c56a34f70a15f7cd5
SHA512 bf06f19b404a6db5ac931c5c91b424fb1ab5e40d104ef322a5bd5f0455d269d6c88b78347ad26d963fe93c8731cb8fee208004bda0c0c99c86d03bc68fbbd75d
SSDEEP 12288:ahT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ahT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T170D4234CD55A06ABE353E232C73DE6D8FAA83F437956BA05479862A0655D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 b52bfc4598c0ee5429dc526a2dd6912de5f439ab6d781889f62e0526f15032c8
MD5 5ad15bb44df17de6c3ab0c47ade67612
SHA1 d833743ddf77025c6bae7f9144ae2ac4eb77c782
SHA512 c6bb5170fb76409c90342ce54f79c5c69ae44d90da4c5875c06c43483cb16680a394788dbb3023f553a41424fe6c1b108b42245c57f4ccbe688bfd1c6bc65948
SSDEEP 12288:GSNT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:HNT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T165D4234CD55A06ABE353D232C33DE6D8FAE83F437969BA05479862A0655D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 4c07b2ef167209d0b2fa867b2c5d3d498a1a03a22bbbbf11243a692592bccb85
MD5 5f84b8d2a82463c0d324ffe33ad6b839
SHA1 d6af33672628d1aa2beed1e9a11a473b3de38d7f
SHA512 527ce70b2227ce7cf6769934f1a6aaeffa09cb4f5997b8fb5455d6c194908f24514abc9784b3a04b32be342df035a37238e100f93944d1f401e802ff5f80eec7
SSDEEP 24576:BZMczFKSMBT7Jckdwi6i9bNrqq4E41WFpW3oRos:BZMcz4f7Jckdwi3N7+WTW3
TLSH
T121150298B39018F9ED63823EC9299945E6F27C561A70DA0F03F432665F333911D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 a87147d53069dee300c4783210a7243e9ab0da93309d44a469bfa11e6d1719e6
MD5 9d2ca5a042b7b124eccc74730598637d
SHA1 905624fda5bb76f729d5d28052c19c0a74eb15e3
SHA512 36b78f5f512f159bd3109eaf91c358982dd040d038e81dd04ca0ef7b93887343af545f2b30097a076d7f0d36b8a038bea9697476d900f4a5170abc3d5dde4a5d
SSDEEP 12288:72C1T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:CaT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1C0D4234CD65A06ABE353D232C33DE6D8FAE82F437956BA05479862A06519340778FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 2d7364b1fb1854debf7dc95ced1b0ea2ef83184e7fa0dbf3c7423e8e538d3b21
MD5 f5c222128566bd2253b61420bb8411c0
SHA1 44afbaa9cc6588a5bfbea9c5ef3644b8e7440672
SHA512 21b0120e148c9a274b4225ee9c12ad606936bbc81bade79098465b48fd76388ada0411859580126b2f67ddb50326bbf13a312e1a0bde36881761482f433b0e29
SSDEEP 12288:nUh1T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:UPT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B5D4234CD55A06ABE353E232C33DE6D8FAB82F437956BA05479862A0655D340378FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 f29f888cfa3998a1cc54c74fc8bb78abdb8bb4800704b3dcaed7eaa92b0c0396
MD5 bbaf80217e853ce276ef00188c7b0dbf
SHA1 99c7ae18df897586121739fd28c4752ece958d47
SHA512 9d5254476ddd865633b3769bf285702cb84e33915092500cf22aebc9606950dae3c8452a8fe3caf0292db8dd5701ce8e4f3ad1e72803672b74a7465c5911052a
SSDEEP 12288:EiPz5LndT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:VzxdT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T125F4020B63A521FAD267D235C9665A45F7B578321B24AF5F03A403752E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 802dd2f6a2add0812f941815ec634c2a838ede9a9915ace617b0a755bef2b1e4
MD5 eb15efa3f375dfafffe1d8c13421a608
SHA1 032a54efb9180a6a203e5e1cf5107fde6b8b5f08
SHA512 25c10b989727f9667ea39eba7157510fae05d3aa77fb82e79d198e6423bdc65f6a0df5a8f05013cbfac1f8c8850ce9ed7cb345854b77768a44abf7aee8c5f69d
SSDEEP 12288:lMeT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:6eT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T12FD4234CD65A06ABE353D232C73DE6D8FAE82F437956BA05479862A0655D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 17afbbd38265550ec1e19592e017cf50ff24e98fdab8010d78588c3ff83b710d
MD5 8233f1ddf7630811bb7d2514ee8f6b58
SHA1 1b9690c4d52f13de6b521d5e3c580141b1634a9c
SHA512 d08c18fb7656f93272fb066a8f4d5b44e729e6793507d8e20a4113fc51b2ac12e0d596e1ec07015a6cd7500434bd1510bea833190d3d4c7a01e7688f8912c307
SSDEEP 12288:SpHT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:mHT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T198D4234CD65A06ABE353D232C73DE6D8FAE82F437956BA05479862A0651D340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 334e45b029c82245ddfae35b41f257331fd80a4ee8e0e43e525206a486ffcf9a
MD5 a0ad1fe6f8a66769b22fbed6db189461
SHA1 e1c1f51f9a67cc4b4d56aa5d1bbb882652e56420
SHA512 5079698d44e121637dcb69ef7b5e62ae450694fa00b607868b52fdc81c2b7b80cdb1c925aa6e574eb25595c654b6755294bda5bb98863c8f7417ba79ea0ffa48
SSDEEP 12288:JiPz5Ln/T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:Azx/T7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T1D0F4020B63A521FAD167D235C9665A45F7B578321B20AF5F03A403B52E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 fa8a6818fc945421139edac35f300c00d97e9fe5bb90012711854a9c5d797387
MD5 eb98e07b85fe6990e3f00e7bbc55aa29
SHA1 a2a7e57381731d299281380c7f919fb1fe3e0919
SHA512 d222559257028db61cf22c0e31d590bed13b63d3d4ea81a8365e76f4310b64275b018b26ba20bb50180f24362fefadc89434fb87966d332e5f5c265574fcb289
SSDEEP 24576:cTaaLV3z0z1kT7Jckdwi6i9bNrqq4E41WFpW3oRos:cTBLVj17Jckdwi3N7+WTW3
TLSH
T155150298B35018F9ED67823EC9298955E6F27C561B70CA1F03E832665F333502D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 0367ed03cb411caba74481b623306a9b1848dcf4f2f6951d66bc3f936276294d
MD5 0e1fa9060660aff2e680d59803c12503
SHA1 a6c681e1fba563729b1cffb267fdc72b2b1afe9b
SHA512 ddfc14318c5fc69ce320dfb4c0e23a63eb1073116bdb9ef3af176f43f68401c07719f7e34c5a034da9b398d2e1da861c9d8efd6626599b9aa1c7de3fd81794f0
SSDEEP 24576:P3vd0CHvy7jcsT7Jckdwi6i9bNrqq4E41WFpW3oRos:fvd0CHvynT7Jckdwi3N7+WTW3
TLSH
T1BA35CE90F3E410E8F1B7DA3589769511DAB67C5A1B21DE8F03A4261A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 29113416e4764c2b8e6d03f46b967bd14b1a444a395619356e2d607cb95d9972
MD5 6530b31ad8532076f63e346be878b968
SHA1 a1d467b9238f84119126b34acd1ffaac413d8459
SHA512 80b538f689d599af8aec469825515941d4925e886ec2f364d465bc02115d2da1fb526a6aad782a8304c4e01d49187d3352a5a73a9ebb86e2956209828d65537b
SSDEEP 12288:YHT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:YHT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1FAD4234CD65A06ABE357D232C33DE6D8FAE82F437965BA05479862A0651D340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 dfb5c2efa9ae56517486e284be6bd7d396f8b4ed9fd71b86c56f8487a5d573aa
MD5 cb9a4e883359112b4f1c149f337c772e
SHA1 2d850525a2ef4ce9467a8c01e8ff90d7770b7a09
SHA512 c4fc1200935a6e0f75dbe1b98315d6f8df7d88071a7728203a5cdb0087d2b3671863dac3934c88a51eeb6aac9e4a3bdbb62cac16063d51f09a4879c123203d5d
SSDEEP 12288:WPT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:WPT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T15BD4234CD65A06ABE357D232C33DE6D8FAE83F437965BA05479862A0651D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 2ee2dc666faa3e433c096027f19292c1e0af40394d3bce7c96649a91fdc4b336
MD5 7a62eb3a4d48785d435f352b4870c43c
SHA1 a8f1d015fd8f7d7345c90fd2adc55ae77d9735db
SHA512 d33918036da25d4774a63be18e741e981a305e88933baf7daedc53fa9c965b322943b3aeb359da6a91a3190094a0f7201fbd1aee3f197e0d8747855b777c7c47
SSDEEP 12288:gqjT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:PjT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1AAD4234CD55A06ABE353D232C33DE6D8FAE83F437956BA06479862A0651D340778FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 b58ce177db496cd11d92cf2539329bf9c99614bc26e43576a7233ebc50bc0d2d
MD5 0a2bf6ec61e4a18424e2c3c12b35da40
SHA1 ab10a948cb0a71e32bf462cd2442eff936c5c5ac
SHA512 8a76e1ac8937f73484fbbad413faf170d88d19e20fc5db5d6a05b257e37347f53191681877d0f3049d48a683b1d752a90a58e822ff7814ba40992544f9b8b404
SSDEEP 12288:5a+VT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:U+VT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T15AD4234CD65A16ABE353D232C33DE6D8FAE82F437965BB05479862A0655D340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 3b22d2b6fdab122e3043c5953a62c11b93fcb00a0daafa8bbbe8f5aa6c0b15af
MD5 cffc47c72ccb02f4ccab7b73c07b3ce0
SHA1 1adf89eb200b0ae6a3d1da84c604753b313eeeaa
SHA512 11752604fbbf214a4f3ec97a16d813aa272e00b03aa702f473a759ff2146ae557362bdca003b1639f51016144d103ce784d68af56485966a74716cadf979d63f
SSDEEP 12288:AecfiT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:MiT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T163F4F109D29802E9C16EA235C7699640F7773C2257E1E7CA53D0F57D1F3A2806EDAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e1a9e66f1322bc6b68c09f2e2a5c34c796f113060640df1c9036b814f5597256
MD5 c84deb0d10d80f32e3c1b0f96b12e03a
SHA1 d591f8b9d8374028cda5bd8777a20933fc880865
SHA512 17640ee8bd5be75777f52d5c5c08d85ff186796f31818697283c57f4842fbd56950ddc86961fbd326b7b47538860ba33ae0f2581e72b9b11252a33f17c2fd041
SSDEEP 12288:BN7cT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:bcT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T189D42308C7595A5BE277D231823DD2A4F6AC3F523F54FA87875462E054293807BABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a5ac44a975f55fc612afd50b41ee89d514b6a0e65347506cd11754f9b79161e3
MD5 34f4cf1edab90319932c06a7acd13f0f
SHA1 b6d97bedc6a77b141d9a85a2ae9b9e8ae47f6038
SHA512 d2489f1ac73ffccf17bf8298560dc52920aeaecd08a874af41f33ae4cc1222e9f2a9b8f7eeeba450570c2fbd430a48c251fe9796363fe0278aace139ee19adf8
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYST7Jckdwi6i9bNrqq4E41WFpW3oRos:Mgb4mBIBhGFj7Jckdwi3N7+WTW3
TLSH
T15965AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 eeb9914a00482ceb364500d6c9401f0c6c042b901ef05eee3ff467c37a341057
MD5 f2d68c1ae87f883a27de8026fa5f98da
SHA1 3d8d01dc1500f6eb0a4d2efc882bc8284a427d1c
SHA512 c8423c5149b0ef9cab04928ae1feea795681575131344986e5c9640ec90f378f73a73209c4e211049c94e94e458777f76ca4c7db4a969d9b63dd55898ef300a0
SSDEEP 12288:QhG9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:EG9T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A7E4230C61A635E9C637D331853DD5A5F9F03A512B247AEF06D0A2749B293D0737EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 dda1bd746fdc664c1b2611b526528a57b5d2a7e8fd349e17133f3814944e0f2e
MD5 2fbaa8d6f766a03d05829ad3f94c0e47
SHA1 38386504bff089bff06774e52c1bf9f5d6c8e884
SHA512 4f5dade02365ccea8e385766e49b575f95503fe3ece6eaedd9b273ff92449741491f04202341fcbd8e87e7ec04e2317c16072d7e3998c201c5d27d2c41fd63c6
SSDEEP 12288:7XT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:7XT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T10AD4234C8259569BD363E231823EE694FAA82F033B657FC3469462A0555D3C077BBF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 012d3b177dab4c7a06da2ff6fcf80460080362a5289279047289488d8a2c0abc
MD5 a8869ba023f0569924eb3ab1ecbc9da1
SHA1 0f23dfbfc0706604f90f0ef2831c77a0fb65af39
SHA512 b0f4dd8f2aaf0c0a4494cee8c8639aebb773b4e63cfc03b19d3b3d45a913b94161299a25cbae7d29579662a5b9b4b1cf01233d8be1a2387e151ce94799e5ffac
SSDEEP 24576:itZ8s8FGJqH10zria7/m7T7Jckdwi6i9bNrqq4E41WFpW3oRos:qeTFCqVDa7/U7Jckdwi3N7+WTW3
TLSH
T1AE35F165A6E102F1D477D1388A9686A3F6B1B8211364FFDF07A88B511F236D04B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 1f9f9aafadbfae7532f369ea573ebe3deadce96139a76c89a8b4ceaf61f96196
MD5 0a5b0f953949780857830e3ade904779
SHA1 2e2cb3878a6372f2cf35a3f415066160d27bd76d
SHA512 dc13b684c2557002a8ef91efbb55de4e67597419bc8cfadae57f601e20440d577a5a80dafed7f695d3b488ffbee160d515b1815be622c353ef4ad8075744d5b6
SSDEEP 24576:rPUr+NQvDT7Jckdwi6i9bNrqq4E41WFpW3oRos:rJQvf7Jckdwi3N7+WTW3
TLSH
T16505F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 a64292a08b1ca7281c4fa88cc19863c6b7c4d18024036cef2af14eed1ae2c488
MD5 8ce4d0526d52a88d508fcd941dfa7e7a
SHA1 f8349a1a2d30dffd1d0b2a100f2b71a6a31b5d5e
SHA512 21c28a7c20c953bd7d78e60f98b9bf51aefb640d2e97a3909e3e021d15875112a891650e4f9d5abbff9f33337f46e3f222e59476e423abb1a2d391e95241365b
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjG7Jckdwi3N7+WTW3:aG05lO43bZPdwi3Q
TLSH
T1EED5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 6165bd219cb355aa7815f1d093cd48a352f845bb4ad3dbaa63b6eb1afcc6099d
MD5 cbf258b748fc8287e48883a82e641df3
SHA1 55bac3a940dd72daecf2dabc40fdc4239ea0ea73
SHA512 8410222850be0af0ec34566ee3b8f8f7fbe6fc5e370873ed04e34cb1d6f64f96b376394f326f4332e75573dbffd86b134ac565bc8961e042bb7b96e556232ba8
SSDEEP 24576:0ea5POZ3dpbWVM50JicR2hG0lasx2+47eidnsT7Jckdwi6i9bNrqq4E41WFpW3ov:ta5POZ3wJt2pasx2+mQ7Jckdwi3N7+Wa
TLSH
T14A65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 483117c89a8581aee9553cb9a9c319243671ef3dfc2c0f85e8bf373f511fc584
MD5 1b92407bfb27993040cb269269ca98b7
SHA1 5d1495bdbc9606197a72872396c0c5f7a4b23bcb
SHA512 53210b46d19848133a4a9ebf7f2753d8bd4c709ef0f0e13324cae3e5a885f71a0533bc2ecb18218d9457ce4110e3767fbfc64f3edb7ac2356afbd2dfce0fb5f0
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkKT7Jckdwi6i9bNrqq4E41WFpW3oRos:/Nc/zEOVHFL7Jckdwi3N7+WTW3
TLSH
T119858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 bcf480a015b4b8a072196c8659f9f7daaa001298abcb664873a5b649192368be
MD5 f573a9f2fcb626d9e304fcba7dfcb406
SHA1 a5523d2a397c97da570a031348df99fa1d176fe9
SHA512 e8905681d39cebb1b7dbcc9772840e50ee80e688163f017536e9163528917bc254bd7b8463cfb7524ed5e36782cabe4ddf160fc16126aa99a1e310f805248b9c
SSDEEP 24576:7JnJPbzB4SoT7Jckdwi6i9bNrqq4E41WFpW3oRos:7JnJv6Sq7Jckdwi3N7+WTW3
TLSH
T1A715E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4f6236ff337208dc8a4fddf6b3038dcea687719f5fd0ffa233c01f225b6739d0
MD5 11c3d8ed562b2c916e844c9485fe9816
SHA1 7f3f0c29c0f298f23e64dd8af18e614487a5445a
SHA512 beb010e60bbcc4bccd2e9c7630b293a91971003155dcafd7645965465e2e4d4d7dbd1b21ac001d13757b1e632146e97e9fe2f379b2e4812007aff297fa7f5802
SSDEEP 49152:KCLHGeeV5ijCmlDWDkD7Jckdwi3N7+WTW3:R7Pdwi3Q
TLSH
T1CEA56B05E7EB5184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 708d4477a8ae0076420dc3eb5fb6baa4152cdb0040479ddd691600ad0b3a9557
MD5 a2d8bb18a0c502a6c605caad36bcb530
SHA1 ecd4238bf61f2cc6d3887d27ea0118dc582ad721
SHA512 40c54d33c5af82afbaf782a10c9c7bf7dd6464fabf3235e7cd5819ee27e69722d08556c02999fd993dabf5c338eefcd3662b648856dd1b08b0f7a63b12a5d4c7
SSDEEP 24576:U6DIyq2T7Jckdwi6i9bNrqq4E41WFpW3oRos:U6DIyqM7Jckdwi3N7+WTW3
TLSH
T1DFF4010C637A11FAD167D03EC6934151E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 04d3572b510489213cd90af72db53c0b5131edb44f28cf0958c2d38f4e14fdb7
MD5 2be330446cad8d5db1677ec2655e688e
SHA1 804b117c512064671a9f67bc222d0a2f4aa10c9c
SHA512 ebd6c02e7a3ad4750f02ade74be2b1a31b03d2ae4b86b83fb96aab9ef79685253fcda0fe2d7c9e5abfb7c951040a14eaab5ad0c74d17377387e267da150889d0
SSDEEP 12288:SG6kyqT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:btyqT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T168F41208539861D9E6B79234CA3682A4EF747C116B21A7CF46D0E33D2E367C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 4a33602c20cff6f737f6e91de14b225bf57f1bcb934ec308ce61ec765c123713
MD5 417ace939785f6066921dc6e9e31d367
SHA1 43deda6e89432337339d4d024a07e45fd42d82f5
SHA512 a2901325a2c2c81ed1f77f5ecaa9730668600627824f3d56b9814e7efb4ee4fec6be4fbb517319c439ba78768fcb41e498b6a9d8f37e432fa00c7370f60d2f3d
SSDEEP 12288:5yTT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:YTT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B2D4234C921926ABD253E231823DD7D4F6B83A623F157ADB46D4A2B0852D3C0777BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2509d3e964ce9dd1b2d849e653ac1aca265fce2ed492c4657f0ff501845da6d5
MD5 49b51f0bbad1ac1bce46f34e1fbdda9a
SHA1 5bb5ed5b81cd63c29d70df04c2fa7be9a44c90ff
SHA512 99ae7ab9a356479cc9299f52a46a42a3078d2cd6984373641aaae8c97329f4c28ca839f63bcfa162c0222f997aa467128f09abb14d040bf663919c4b8f650256
SSDEEP 24576:NLg+LoTfaidZ9T7Jckdwi6i9bNrqq4E41WFpW3oRos:1gdTrZt7Jckdwi3N7+WTW3
TLSH
T1EA559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 425aaf1ecbb70f9c3ce551e1e241d80b1211a823c7d70341f68e6f543f49ed4f
MD5 665e40f8857d3b282ea087929d3177ee
SHA1 d0a4dd0fa5fd55935b9b6fb2a00679b4e30592d9
SHA512 ca46e468ac2b889df6c518a5d2f03786282f18901067392da67840e43daae01a63f7283f9b98fd771c8fb54a99f136f8c4f4b5a21481999972fe8d396fcc160f
SSDEEP 24576:arcmRFAT7Jckdwi6i9bNrqq4E41WFpW3oRos:ccmRFy7Jckdwi3N7+WTW3
TLSH
T18D05F14EB26E00E6E2B7D13CC9558655F6B37431271267CF02A0C37D4A6B6E97E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7f90bb3ebb5818ca5ceefad576b35bcc5e18a0466a95c20d0bbfe69295bbb1bb
MD5 bc3b3491b2f243d163e333b78ef8c1fe
SHA1 e8a061a1b178d89426d57806eb63d3db77dde1bd
SHA512 7302ce85ac0a5b11a2eb5f57706607946dad906b112702598868ed90292a5af9f5131a17da529eb44be1be6b27ebecd42f5a601cc088896df3add3293013d7f2
SSDEEP 49152:NDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3/7Jckdwi3N7+WTW3:u3Upow8sB0Pdwi3Q
TLSH
T1F1A58C3DA2E810A8D9AAC379C54213A5EA71782E3F3055DB0174C178BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-38-0x00000270DD2D0000-0x00000270DD336000-memory.dmp

Download

memory/256-40-0x00000270DD2D0000-0x00000270DD336000-memory.dmp

Download

memory/256-37-0x00000270DD0E0000-0x00000270DD1A1000-memory.dmp

Download

memory/256-39-0x00000270DD2D0000-0x00000270DD336000-memory.dmp

Download

memory/796-451-0x00007FF654FD0000-0x00007FF65530E000-memory.dmp

Download

memory/796-390-0x0000022AD6660000-0x0000022AD66C6000-memory.dmp

Download

memory/796-393-0x0000022AD6660000-0x0000022AD66C6000-memory.dmp

Download

memory/796-394-0x00007FF654FD0000-0x00007FF65530E000-memory.dmp

Download

memory/988-361-0x000001FD31A50000-0x000001FD31AB6000-memory.dmp

Download

memory/988-448-0x00007FF6E47E0000-0x00007FF6E4CB0000-memory.dmp

Download

memory/988-362-0x000001FD31A50000-0x000001FD31AB6000-memory.dmp

Download

memory/988-363-0x00007FF6E47E0000-0x00007FF6E4CB0000-memory.dmp

Download

memory/1272-244-0x00007FF6E1600000-0x00007FF6E16C8000-memory.dmp

Download

memory/1272-248-0x000002038A9D0000-0x000002038AA36000-memory.dmp

Download

memory/1272-246-0x000002038A9D0000-0x000002038AA36000-memory.dmp

Download

memory/1272-335-0x00007FF6E1600000-0x00007FF6E16C8000-memory.dmp

Download

memory/1500-336-0x00007FF7FB9C0000-0x00007FF7FBB54000-memory.dmp

Download

memory/1500-446-0x00007FF7FB9C0000-0x00007FF7FBB54000-memory.dmp

Download

memory/1500-331-0x000001F9A1800000-0x000001F9A1866000-memory.dmp

Download

memory/1500-330-0x000001F9A1800000-0x000001F9A1866000-memory.dmp

Download

memory/1776-18-0x0000013DEB0A0000-0x0000013DEB106000-memory.dmp

Download

memory/1776-17-0x0000013DEB0A0000-0x0000013DEB106000-memory.dmp

Download

memory/1776-16-0x0000013DEB0A0000-0x0000013DEB106000-memory.dmp

Download

memory/1776-70-0x00007FF798E60000-0x00007FF798F82000-memory.dmp

Download

memory/1776-15-0x00007FF798E60000-0x00007FF798F82000-memory.dmp

Download

memory/2128-372-0x0000022B5CBA0000-0x0000022B5CC06000-memory.dmp

Download

memory/2128-371-0x0000022B5CBA0000-0x0000022B5CC06000-memory.dmp

Download

memory/2128-370-0x00007FF6C1E90000-0x00007FF6C2396000-memory.dmp

Download

memory/2128-449-0x00007FF6C1E90000-0x00007FF6C2396000-memory.dmp

Download

memory/2340-450-0x00007FF7EF8A0000-0x00007FF7EF9CE000-memory.dmp

Download

memory/2340-382-0x000001CCC01A0000-0x000001CCC0206000-memory.dmp

Download

memory/2340-381-0x00007FF7EF8A0000-0x00007FF7EF9CE000-memory.dmp

Download

memory/2340-380-0x000001CCC01A0000-0x000001CCC0206000-memory.dmp

Download

memory/2796-286-0x0000023078AD0000-0x0000023078B36000-memory.dmp

Download

memory/2796-297-0x00007FF7B2D40000-0x00007FF7B3483000-memory.dmp

Download

memory/2796-369-0x00007FF7B2D40000-0x00007FF7B3483000-memory.dmp

Download

memory/2796-285-0x0000023078AD0000-0x0000023078B36000-memory.dmp

Download

memory/3040-254-0x00000250C19C0000-0x00000250C1A26000-memory.dmp

Download

memory/3040-339-0x00007FF6B2130000-0x00007FF6B2249000-memory.dmp

Download

memory/3040-249-0x00007FF6B2130000-0x00007FF6B2249000-memory.dmp

Download

memory/3040-253-0x00000250C19C0000-0x00000250C1A26000-memory.dmp

Download

memory/3820-48-0x0000023C7B820000-0x0000023C7B886000-memory.dmp

Download

memory/3820-47-0x0000023C7B820000-0x0000023C7B886000-memory.dmp

Download

memory/3820-46-0x00007FF6CDC20000-0x00007FF6CDD87000-memory.dmp

Download

memory/3820-55-0x00007FF6CDC20000-0x00007FF6CDD87000-memory.dmp

Download

memory/3820-53-0x0000023C7B820000-0x0000023C7B886000-memory.dmp

Download

memory/4144-59-0x000002A823810000-0x000002A823876000-memory.dmp

Download

memory/4144-60-0x000002A823810000-0x000002A823876000-memory.dmp

Download

memory/4144-58-0x000002A8236F0000-0x000002A8237B1000-memory.dmp

Download

memory/4272-274-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/4272-360-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4272-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4272-279-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/4456-299-0x00007FF60EE80000-0x00007FF60EF2D000-memory.dmp

Download

memory/4456-379-0x00007FF60EE80000-0x00007FF60EF2D000-memory.dmp

Download

memory/4456-293-0x0000015943370000-0x00000159433D6000-memory.dmp

Download

memory/4456-292-0x0000015943370000-0x00000159433D6000-memory.dmp

Download

memory/4864-346-0x00000246D22B0000-0x00000246D2316000-memory.dmp

Download

memory/4864-340-0x00007FF7AA7F0000-0x00007FF7AAB10000-memory.dmp

Download

memory/4864-348-0x00007FF7AA7F0000-0x00007FF7AAB10000-memory.dmp

Download

memory/4864-341-0x00000246D22B0000-0x00000246D2316000-memory.dmp

Download

memory/4864-342-0x00000246D22B0000-0x00000246D2316000-memory.dmp

Download

memory/4892-392-0x00007FF70BA10000-0x00007FF70BCB2000-memory.dmp

Download

memory/4892-322-0x000002217CB90000-0x000002217CBF6000-memory.dmp

Download

memory/4892-323-0x000002217CB90000-0x000002217CBF6000-memory.dmp

Download

memory/4892-324-0x00007FF70BA10000-0x00007FF70BCB2000-memory.dmp

Download

memory/4900-235-0x00007FF6E1600000-0x00007FF6E16C8000-memory.dmp

Download

memory/4900-237-0x00000228AD7A0000-0x00000228AD806000-memory.dmp

Download

memory/4900-321-0x00007FF6E1600000-0x00007FF6E16C8000-memory.dmp

Download

memory/4900-236-0x00000228AD7A0000-0x00000228AD806000-memory.dmp

Download

memory/5156-7-0x0000000002B90000-0x0000000002BF9000-memory.dmp

Download

memory/5156-2-0x0000000002B90000-0x0000000002BF9000-memory.dmp

Download

memory/5156-6-0x0000000002B90000-0x0000000002BF9000-memory.dmp

Download

memory/5156-0-0x0000000002AD0000-0x0000000002B7B000-memory.dmp

Download

memory/5296-264-0x00007FF734C60000-0x00007FF734DA9000-memory.dmp

Download

memory/5296-266-0x000002176BF30000-0x000002176BF96000-memory.dmp

Download

memory/5296-351-0x00007FF734C60000-0x00007FF734DA9000-memory.dmp

Download

memory/5296-267-0x000002176BF30000-0x000002176BF96000-memory.dmp

Download

memory/5344-29-0x00000291C3530000-0x00000291C3596000-memory.dmp

Download

memory/5344-30-0x00000291C3530000-0x00000291C3596000-memory.dmp

Download

memory/5344-31-0x00000291C3530000-0x00000291C3596000-memory.dmp

Download

memory/5344-28-0x00000291C3390000-0x00000291C3451000-memory.dmp

Download

memory/5376-302-0x000001D2427E0000-0x000001D242846000-memory.dmp

Download

memory/5376-303-0x000001D2427E0000-0x000001D242846000-memory.dmp

Download

memory/5376-387-0x00007FF6AE8B0000-0x00007FF6AECC6000-memory.dmp

Download

memory/5376-304-0x00007FF6AE8B0000-0x00007FF6AECC6000-memory.dmp

Download

memory/5376-445-0x00007FF6AE8B0000-0x00007FF6AECC6000-memory.dmp

Download

memory/5376-443-0x000001D2427E0000-0x000001D242846000-memory.dmp

Download

memory/5528-352-0x00007FF74FCF0000-0x00007FF74FF7A000-memory.dmp

Download

memory/5528-353-0x000001C095950000-0x000001C0959B6000-memory.dmp

Download

memory/5528-447-0x00007FF74FCF0000-0x00007FF74FF7A000-memory.dmp

Download

memory/5528-354-0x000001C095950000-0x000001C0959B6000-memory.dmp

Download

memory/5540-391-0x00007FF6462A0000-0x00007FF646353000-memory.dmp

Download

memory/5540-311-0x00007FF6462A0000-0x00007FF646353000-memory.dmp

Download

memory/5540-312-0x0000017DA0EC0000-0x0000017DA0F26000-memory.dmp

Download

memory/5540-313-0x0000017DA0EC0000-0x0000017DA0F26000-memory.dmp

Download