0416eb2f668662393594d77b5f27917c1ff78df6c449b2af2463871279020209

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Size 819KB
Sample260721-c8faascz3q
SHA256 0416eb2f668662393594d77b5f27917c1ff78df6c449b2af2463871279020209
MD5 47ad41d5a9e5ab5189ce48ed40ecc177
SHA1 c0a02007531f11e4e76c3dd05b20c08eaa4a61f5
SHA512 c067a78d06d9be8d47f0c1e2f34389a9b6fea04fd6612fe52596f127edbdd37727b706a57b1be5f01c6edd369fed379984b871a24c766bc25957fabb7d99a403
SSDEEP 12288:YxHZ+D1p729fluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:RH7290ofITNUohc3C5pPc66a0t
TLSH
T1E405F129B39509F9DC67C17DCDB2D012EA7238650362EADB4394466A1F333C46F3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5116	alg.exe
4500	elevation_service.exe
5700	elevation_service.exe
5680	maintenanceservice.exe
5768	OSE.EXE
2176	GameInputSvc.exe
1684	GameInputSvc.exe
1572	msdtc.exe
5436	PerceptionSimulationService.exe
1584	perfhost.exe
4208	ReFsDedupSvc.exe
2340	locator.exe
240	SensorDataService.exe
4992	snmptrap.exe
1528	ssh-agent.exe
1124	TieringEngineService.exe
3492	AgentService.exe
1936	vds.exe
3776	vssvc.exe
1676	wbengine.exe
1096	WmiApSrv.exe
1484	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\94aa1b4f83806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	GameInputSvc.exe
1684	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1756	2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	5116	alg.exe
Token: SeDebugPrivilege	5116	alg.exe
Token: SeTakeOwnershipPrivilege	4500	elevation_service.exe
Token: SeTcbPrivilege	2176	GameInputSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1124	TieringEngineService.exe
Token: SeManageVolumePrivilege	1124	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3492	AgentService.exe
Token: SeBackupPrivilege	3776	vssvc.exe
Token: SeRestorePrivilege	3776	vssvc.exe
Token: SeAuditPrivilege	3776	vssvc.exe
Token: SeBackupPrivilege	1676	wbengine.exe
Token: SeRestorePrivilege	1676	wbengine.exe
Token: SeSecurityPrivilege	1676	wbengine.exe
Token: 33	1484	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1484	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1484	SearchIndexer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1684	2176	GameInputSvc.exe	96
PID 1484 wrote to memory of 3676	1484	SearchIndexer.exe	113
PID 1484 wrote to memory of 2796	1484	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_47ad41d5a9e5ab5189ce48ed40ecc177_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5700

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5680

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5768

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1684

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1584

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1528

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1676

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1096

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3676
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3280b9c88a6c352a0f609cad31bc096f86bf815bc6d804646743e69e119a2483
MD5 fdef67af127cbccb8771fff9dbdbdd44
SHA1 e7369c3f2eede716e530b92019e406ddd9a43273
SHA512 8414b10bc35205a4251701e0f0f7ea02c5d01597540eb05ad518135f31579be9e9436b039ae1ecb6adfff9685bfe5d86174726db06eed396ebe5c1385e65f8b2
SSDEEP 49152:tb+6P2BuPkFKRrdE6oh7stBhuXjfS4LWxncoDWcF:zPq6gjBVqb
TLSH
T116D59D03F29900E9E06AD178D7469133EAA2BC890B35B6DF0780B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ac0f04d38784f7451a99633a8fe2cdd02df1992c6fa84a278f6b1b493cbfab8f
MD5 9853ccb58d206aebb5e78295931c819d
SHA1 73f81f59bb2643072fdd88878de270a530bc31b6
SHA512 e70e3eaac399596799177269493354e3cc0a30faeaae3c92a1fa2baa43620990c8c2b3bab0e4e4bb72c3a18d7d26f763187acf8d8634f979a5a51288401ead82
SSDEEP 12288:M1XLs+HukxXkTRCEczA3luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eX1:6XYargczAcofITNUohc3C5pPc66a0t
TLSH
T158050228A3D509F9EC67913DCC728501EB73789547A1EB8B03E49A695F233881F3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ca7c56739c45dd2a468b146cfe76e6ecb53b38552fece6200fd67827ab348f8d
MD5 1ff3433a1aee919d012b4c2b1c963022
SHA1 8ea592ad3bd0f7600824022f0f2a56dceae64892
SHA512 a1a87139709bb257971b22be0a4d0eebf796f78cd951a5f237bab4a8b638ce10a8434891042fefa271833584c6c6b8a55b0014360c69a8a2d4c5567991f572f8
SSDEEP 24576:V0SeeoE0vdxOrMTofITNUohc3C5pPc66a0t:VToE01o4oDWcF
TLSH
T1E3459E26F6748331D073C0B9C5D2A68AED7230865B318ACB4286D77C7E677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b1697cb2d545d63ffe2aea8b93fb879997f1bb0acdab61fb90650a3b6c92546f
MD5 d721624d43ceba3b9e2292f35b77e233
SHA1 e8a13bac412ad8be962f3577e6b2b07a775de8a7
SHA512 ca96fec1fae484267d03e064e85e8497ffd7f0891234961ec1bd48e841970cdabc8019aba45c8193d3b9a6c5989f74d4c6a5ec86ea92a7275269e61b4ae93457
SSDEEP 24576:2VM/ezSC6vUyD/aqgrvW/6q8wyuzofITNUohc3C5pPc66a0t:9/ezSC6vUzPvuHjySoDWcF
TLSH
T18A756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 67cb60f489bf0431eaced8cca6569a802a50cab2ec7a2da368d6e51acf4a5e5d
MD5 6c0b6cc890ef7d0b1a0f1216de345561
SHA1 0d87a6064477908dd3c57f458b0bd95d79430ff7
SHA512 e57e1ad71b081e360b7c70a2abda7a589ab138a14479a649a84dc3be0d80f1fbcde332d8bedc4d8ebe11a4fc5b722be919143f212207d9df276ad988ec558429
SSDEEP 24576:5abAPrap0v/l+dJofITNUohc3C5pPc66a0t:5a0ap0Xl+PoDWcF
TLSH
T121559E66F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 5b0d26185b042ea6782e1f9f745982a76a9cb7c4d3555454668a5205ee23972c
MD5 321d0879436167f3c239cd34224b806b
SHA1 e32ef3dff504c530fd4f8cc300bbb963aca904ae
SHA512 4dd3e096357b318eacbb6e6b8d3658b3b007c68a8c1e9e5e75759b26287b41f7a44fd397109a6f7659834f390bae85c9c45506cd111eaed08c117863a4f9c262
SSDEEP 12288:AEjluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:AEYofITNUohc3C5pPc66a0t
TLSH
T17FD423A1C20E59A2EDAAB837583D7581AE794EB5BB834E42C5C43BDDD5F03889332057
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 e2a728c6c8f0b8b807ff801ae1aeb2c109f35b9f06214bf8301bb89403d81c19
MD5 141049574d55c576b78597f8aa8ef21d
SHA1 71cfc88dfd8970a87c07ea07b4b54a5b2a7d2b44
SHA512 f599b4007f61638288c30bd4715e2bd2b0a8a998843f87d127ea0062dc2728288fdae64c8c5a32aeb708383b74c0d836ec2f127f4ccdd0576ef6aba83f86ec21
SSDEEP 12288:geBNUbTVO86UAluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:gJIUTofITNUohc3C5pPc66a0t
TLSH
T19915CF7BEE28FCE2C27A9CB95A518240E77278704F5293CBD164834EDE236D05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5ce5a401cf4b439fcf37c54a5d97438cc56c447d0c64d6315fd21432cef19bc6
MD5 cdcb51266e2f9f247b49926c09f74a03
SHA1 ed7600ec32ea589c760c6bd7eefdf77041d2d419
SHA512 2b0d0a1e97f6edffb391acd5e4e996aefb4786631630515a59d3da3ca838960bd3c1fc20ec4f76831475bc1873c60659a648dd72d1b309725785cc7d85bd1560
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THP:VQvGAdlCEL8c/9RNw5C7qb
TLSH
T13A367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 c89f3ad6aa53d3ec70d8b7228faae29d8c4c3dc7abacfa9dd83f07ffc5eeb0d0
MD5 93b0431ec56fd726e804797d65a1b2c8
SHA1 0fdb5376781bb2f22814e7acd735126164b33968
SHA512 1cf076bc2d8b07fadaa2665852419f14a5cca31925a360762210d71894c7d39bfdd572c07cbd48d969d6a894822b8f23ec6da15db7e7d45b7dae436564d84f7b
SSDEEP 12288:UbwSfxL/2Dc3bDLLmt0LDQewsAjeluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFcF:2mewsAjVofITNUohc3C5pPc66a0t
TLSH
T14F15E031FA75E432C6BB0CB21B36D706587C6A604F521AC3E3E85E9E59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0e8ff169c3f51be6be2a1b17b70aa90d57cbcad6bd0082806f76dd587145c6f9
MD5 3d841fba7f2ac9f02f50f87f28fbb552
SHA1 2ecdc3f159eeb72012d8a0b8c46983dd4288cd80
SHA512 1a85c1008b97dedc3fce8ab2794d9bcbc3d3037fb716dc4dd8550752cdb9f604500900775d99edd2674d4a39f1055c44bf109ded66b7562cfff3d5b69c379656
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHzqb:HUEtQevvqc2W1cpV2XF32u
TLSH
T137474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 840e538584c2a4749ef203e45f5d2d39736814f26fc0e1973c4ff50b84a27fcd
MD5 b37560182edceeca1d179809b2557f00
SHA1 728e0c1c353f5706223152aedccc352a90e60d5d
SHA512 963f7b42d6253cf2aa239935a5fe37a4a3812c38cbde751ef6bc51eaaf4b22f8d158886a21a3316b9fff2d1b0c50b9296280cb5e0e818158ef4e0d25beca7570
SSDEEP 49152:G/bRquA/m2yL5zMfFiV+XenmE3/zLoDWcF:Moq1VjnmOqb
TLSH
T100D58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 080b7c335f0ebbd6cb6c77a1037e5d272a7637c84225c3fc363215a876671f18
MD5 ab17146bde7e3940783eb495b1c84025
SHA1 0a48838f84fd3452c6f41799eba5970f08063543
SHA512 113ff9e12e54ce99b474c1fccde4fb7df65646485c75b1c605159a74693432b4a4d2c19c0e8a85ddbadd361ef29ba05a7f034f34da8011b38d58acad5a2067db
SSDEEP 24576:RAhGLvnFoiwtA5l7S53BofITNUohc3C5pPc66a0t:RAMTFoiq5xoDWcF
TLSH
T1AF45AE81E7F955D4F5F3AAB899B69170EA76BCA65E31C20F2150D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 fd95de9b0c0f7274b4c9fefce99c4b382675f34415d0c397b763c0295d7be96e
MD5 4fdf4097d62752e6102d1bdc3a55f700
SHA1 45c88371535aba404aff11d1ab4dd8e2fbf75cfd
SHA512 4185406547d832af906c0eb70a4b602dfc9a78f6d7ec542d1f05064a1f4345f237bf98f15322bd16579919009814930e21ceba88d225c87ad95a10457aa11117
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+C0Zluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPJ:QwuuOWDyofITNUohc3C5pPc66a0t
TLSH
T18D05F14672A90CF9E96791398557D132FBF2B8112B22CB1F47A0C75B5F333516E2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 6a4ce1c17a09ee5b35e76014860901cd30a8fc344d25d8ad92346d324e55a8c8
MD5 6bdba591b0200ee437ebdbdc27e8332e
SHA1 3cf8174640725c9744ca25e85cec10bfef139b8a
SHA512 452920bacefb1e956f5b21358942c0d042abb906dcf387406ecb6e94757dff1239d59da9391c9687c46cf63b584275c9c3d4c37fb37d2c769942e5c88c28732d
SSDEEP 12288:ppw1IxZluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:TwucofITNUohc3C5pPc66a0t
TLSH
T151E41296639820F6E5A3A13988B56641EBB274B2777347CF469403AE5F723C51F32332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c5cc9c346079549424ee464d72fe89eb008751776573f99ec6bfc155919c1550
MD5 26f0d3c6efce9e427ea6ac419b9618a5
SHA1 ce7889a8bbb168deebcc4f9516cd19ecfcec924d
SHA512 f5131822bd18f226c3e987cd12cacfe56b43f1d370c0c25da23c4e9d87a487d8ccedcb6753f72b0b43962b5c87d269ac18d9ccd4ff6b0ff83667c9c50e6cbefb
SSDEEP 49152:+j/JC0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UF:XQRQyi36YOcP8Lvw2gAf+PN3Cqb
TLSH
T16C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8f0b16cf1f3f3059cd4b0a59db899f47e1cff612aba3ca2373008873da015330
MD5 55c113e3b224994afba5f45e33d150fc
SHA1 324a53a19b2b6604a5bb63efb9b5e2d752a60f81
SHA512 6af9f082d64124476cf23c4bcbf65a2737f67335c70ae50d86581332e0c2e56c75b25a8bdd1c7ff62df291458b824db5bdfbe6d872db4a46fce50dd90aa4c52a
SSDEEP 49152:+j/JC0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U+:XQRQyi36YOcP8Lvw2gAf+PN3fqb
TLSH
T1EE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c7b9a42d707549f9ec941c31267861c7d76af03c4deca1e70c9c0d7de565be98
MD5 82b090f27e059add0bbcf30e5443eb96
SHA1 8509f02a99d9be2ab70957302c2ec649477a9077
SHA512 9e1ea5e2c1519720af7e29b3139092eb75bc8269a875a24d559bcc7e5cc3ab0e454cb584a391ea9a5b6bd20432385c8bf3db66a83eeb9559bb678c5b73c7ba46
SSDEEP 24576:3wvLaf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0AofITNUohc3C5pa:h68Qg55nhMeWu7PNU3/roDWcF
TLSH
T1B6B55A33B2F60099C44DE1769F4A972196E17C718FE1E7DB8501720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4a5ba81536ff63d021737c39b9b9d4b64705be2edd1f90e593ab01753e9a0741
MD5 1957db427172e036f856a0efccd1b22e
SHA1 379780316f0dc0a93af97ac3d50afc90fbc8fa9e
SHA512 3baed4ca897cc57becd3e6c8f857ebdda8cc0e31f861c860a6c1fc19d941696a3d19f6e12a90a51f3269056122a9bc23f844f99cf7021c659f758af60284c3b6
SSDEEP 49152:h3aCC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99p:By5112gYy5azzVv569nLKnhZtqb
TLSH
T1B6168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c062f35778a5100f271eadd74aa224db1ab389716f436c2272ce40baa420eeba
MD5 b4a5bf1698bef532156d7a9d31763906
SHA1 3dff3c3f61dec1ca29b05f7d3361634067b3e81b
SHA512 fdb80f1aa6f81d6b92b3a692314bcba1da6ac62b581cfbfe9d8ee5609270d6babb3cd212fad230dc250593aafed8291b6d82123a47d890421c7cf673395f675c
SSDEEP 49152:akYtaZ3usBWOBr4tEGp0bqx0z+n217aau1glKoDWcF:vu6JmTxd2dKqb
TLSH
T1E8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 3a116c7c66622397c0550f9fcd3fd5056383741edee07c0b0c5b6f5baaf78853
MD5 25dcb290cdc434e10b34562b74645fce
SHA1 a450bf2c707412b57913b282148b89f39a351c97
SHA512 8991dc42f192fcc28b3d14e9e279c570c0e58f4948f4a3961fb656f89c889ee122bb678411689387cc8883a848b8ddd40f63a67c84315cf67b4f2c1ae5471059
SSDEEP 24576:jhv3E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3DofITNUohc3C5pa:G1hpsNoJpF1A6UU44CwH7R4xzoDWcF
TLSH
T190B5BE13F29901E8D06ED178875A9232EA72BC460B31B6DF0A9077961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 97a90ea05b2dd93bf3aae88135a779cf302abaf000ce91f71561750b8d797003
MD5 7a6b524c3c0c1d8a1ef6590f3c9d6cc2
SHA1 78705ef88eadadf5c8965cec4f8230325e5a72c4
SHA512 1409df9a04c1575e628eabcd53d2350cd3ae6081624dc5932457b5028dc22e7f397a54be402a0ba0de32d09298cdef41287334db9cadbc5daf17a9fe39bc2386
SSDEEP 24576:1cBvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSMHnqXofITNUb:7SuZQIY0Be2K6RVtOnks6NMHqXoDWcF
TLSH
T1E7C5BF13F2E940E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 512855deaa990fb6bef8fe5d970873955dd0e35b198c831e775f8e2c64764e52
MD5 6e4a8bef5e3de09cfe443aaf87aada51
SHA1 fde0dfb4807f937a8d253c3531ca72d1f462c984
SHA512 8e047576a4ab799b79f405370c433e11684484c090821139e146663048a41976c092b0ae615401d8f94b1d8cea930eecd41a0c85b7799f6b1b1b51e806c0a6ba
SSDEEP 24576:EViavMPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLoofITNUohc3C5pPc66B:EV+Sn8EApI0figTgiDn0AP5wMoDWcF
TLSH
T1D2A5BE13F2D900E8D05ED178C7568632EA72BC160B35AAEF0A9077561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 603KB
SHA256 db0aaedde769d28aec7e072eb963bf29ee87725e2d381a404ce0ba8f97919107
MD5 59d26d9d36171f7cea713d4c98c33a11
SHA1 d8d484b812910f85f0bde9470c1f38cd876dfb5f
SHA512 1a0067d1c575cac971cab682eae1dc3075a74c8cd506af7333c9de0ca3065dff4fd78339b7d21b9c75e3f8de080cdaae65ddcb494ce5879bdda630be39c6a81e
SSDEEP 12288:+lluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:+uofITNUohc3C5pPc66a0t
TLSH
T15AD423A1C50F4AA2D855B477583D71C1EE7D4AB6BB830E86D6CC36DDD7E038813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 603KB
SHA256 6e6081857334071fda9cc34f5381c6206664149b5992555fd743745debe3303e
MD5 2e816d3077a2225a12851af054e502c3
SHA1 ecb616c7948adf62348f5cdf85da45a472fe624d
SHA512 5a621a593d43f17bdc574bd9ffc4c2e187d678fd3e70466353a053206f7376ae40ef8e2fbb7d0a66815abe9ea7a90d981c6897998532190cf71f0e2a087cc0ad
SSDEEP 12288:ciluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:cJofITNUohc3C5pPc66a0t
TLSH
T11ED423A1C50F4AA3D856B477583D71C1EE7D4AB6BB830E86D6CC26DDD7E038813324A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 603KB
SHA256 a01b33752b37f3d9cccd3d7cb121eae6d6ea3de388c08217c73ab7dbc6285a9f
MD5 d40e6636986990f0aa3e67bd188160a1
SHA1 b07f40ee73a47a601ed332f87366d1e36f25c3e9
SHA512 7e38f8d421b42146c8cc4505f1dc68963cb35d747f5c9aac61ef4f5b57543d5d0c0c8d37a72096ec3d0169f0d3551fed5e9e0e2ecbfb48f7158e9b3597e0f6f3
SSDEEP 12288:elHluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:eaofITNUohc3C5pPc66a0t
TLSH
T1D2D423A1C50F5A93D856B477583D31C1EE7C4AB6BB830E86D6CD369DD7E038813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 78601fe14d7c0287d2ac704191f201c9be303d88bb67b131a2ec56bceeb043b0
MD5 8a891dc618a002b5a3bcc71bfa60c987
SHA1 1a569813949daa3f6c141d32a9d00748f339c442
SHA512 ffa8f07bb248c8aef118bb3cae6817591eb894e69411d9defd19af1d177afd28b458fce95b3ee44a84153ac72fc9a3618ca796166b1dc6f66342f44211c406b3
SSDEEP 12288:7lWeluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:8ofITNUohc3C5pPc66a0t
TLSH
T19CD42362D20F05D2D866F47688396081FFB979B5B7634F8FC68416DE8FB03481731AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 603KB
SHA256 6ad38d0a262cf36cb752a4c466f9fa1a9ad49fbb9ce19396a6ae83669c02fce1
MD5 a03716dbe5dee07290443b34199258de
SHA1 9430e9a44da7795d2abf344d46eea40d394f61e6
SHA512 ac9beb3ece5b6d132c14b247a7f37fbd040882c28cb9b17f7eba824bba77dc1c9a9bc84377a8db06226ac15e8c024bea980d7527f868e99c6f4f3b316db5479f
SSDEEP 12288:Foluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:FrofITNUohc3C5pPc66a0t
TLSH
T1F3D423A1C50F49A3D855B477583D71C1EEBC46BABB830E86D5CD26DDD7E038813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 603KB
SHA256 b803a589eafc87010c40af57c7398e646b8c2ae0c17ca39ab0bef2da44608ad3
MD5 76a68b545d8f176f2458d714812a9a55
SHA1 f3d1585499cf848a255a2d042653dc151277307c
SHA512 07f1f981652dbcbe65f65d7905102bd73af3f093207647ccb73951665264ea34e0621a6d82a768759d61c9c5fa7d994f0c51f18f6b640b0fbc61eae81317f84f
SSDEEP 12288:GKluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:GBofITNUohc3C5pPc66a0t
TLSH
T199D423A1C50F49A3D856B477583D71C1EE7C46BABB830E86D6C926DDD7F038813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 256af6e6f9a435023c12a4aa324604eea570784daf5cb28fe2d39108373058f3
MD5 f0f1333d07361b406e2f5fcec8374674
SHA1 141386246f694cc961b8c20f2b445df4effe6ade
SHA512 a8afd3078dfdbf55f0886c32c66ac321cbabc5299e5ad6f2f99411f5758d896146eb922a05bdcac0639bb0313c20a188709245e1e22e0f5bb4fe8a73f0f8d807
SSDEEP 12288:Amluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:AtofITNUohc3C5pPc66a0t
TLSH
T1F5D423B1C50F4A92D856B477583D71C1EE7D4AB6BB830E86D6CC26DDD7E038813324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 65f43caf966d6a58cff4545461434a572ff746d5cf60567a915ea2d2fea022ee
MD5 3983507a40649be1b9796c4bcdf8675a
SHA1 e5b18cdc1fa9efc5b6532b7c55aeddd3644b007f
SHA512 7a2ec9170843098aad6c493349b68ff15f3e8f0d8fcb07c093c99c60ae797170dc8d41ce48ec9729f6607c2c3f51c5776988279465cabf11cc37d094d7e0594d
SSDEEP 12288:uiZwbQTzrp9S+cPvyjPluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXP9:RZMMzrnSmAofITNUohc3C5pPc66a0t
TLSH
T1231502A5B3501CF4EC67813ECC259906D6B27C6A1B60CA0F03E4366B5F733911D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 2781298ccedf75dcd1a6452cc6e06cfc758c04b09f823465b2616f82a4abfcb4
MD5 b597f2da30935910fecca58737b46602
SHA1 9cd56de0e4e626e7a20522c50e9655ec80068d4e
SHA512 58afbef0c4277deb5031a2bcd1298998607daf48a04bd6b568532117feb7094ee0b43a0dde27ca418ec24e7de9101d5bc6e06116e998340db466db591923b1fe
SSDEEP 12288:UMnluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:UVofITNUohc3C5pPc66a0t
TLSH
T147D423A1C10F59A3D855B477583D71C1EE7D4AB6BB830E86D9CD26EDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 dc8f718fa1c60221a922e60288630c5b96c4e8878b78cc30e716bf277dedb15a
MD5 dbff23ff9b0fd62a6887e0c3584c17de
SHA1 77dae1b4c30bca931755a3b35a9a8020e03bcc9a
SHA512 e5cd1dfaacfc691213e61b0816c636df8c886af389250df93cf576061219cab25e5327473dffd33f275dbb0d1ab27de8c06a2ab90f9c336c13a962fc9631b4ad
SSDEEP 12288:uTluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:uoofITNUohc3C5pPc66a0t
TLSH
T166D423B1C50F4AA3D856B477543D71C1EE7D46B6BB830E82DACD26DD97E038813224AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9c43fb2b5534dd7445c444b90f8d35967f5b71d2accca67fa3c60f0f8e9c33a4
MD5 e3264e1164fc9bfba66a0a98f9e9da88
SHA1 2b92ce64667a4608ccdb37d22471cf3f8586c65c
SHA512 0248ff9589af22d69ddd653bc9028bfe2117c8317aa536d9d894d8409cb24967485c286aa3d74495980b38b28779dd02021121e5d94d439928477291c3a7e59c
SSDEEP 12288:sHPJ3L1xluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:4J5aofITNUohc3C5pPc66a0t
TLSH
T1FCF41253B36630F9D437913988661A42FB7678325B228F5F539407BA2F633905F3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 603KB
SHA256 4eaf0490d94d4f6a8d1b078897f45504758c4d8093641073084ea9530b9eaff1
MD5 d25caaf0789e796ded745d8bb117013a
SHA1 dce0f8215bc41f3b98405d56e31217a31e8735e1
SHA512 f2cf8e3af8935d1da21e37e811f03b76826592240189e787920f136b720c05acfd765e4f47fcac661f8346cd325ea20dd6246b5c0da6a562823f51d095c5b681
SSDEEP 12288:4Wrluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:4WQofITNUohc3C5pPc66a0t
TLSH
T1F8D423A1D50F4992D855B477583D71C1EEBD4AF6BB830E82DACD26DDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 603KB
SHA256 52c9c359a651a6ba80435858ef430023336c5e9f5ac50cf9f324d8ea99dec42a
MD5 f12c6568388ef4839b5ddfd8b5b29255
SHA1 98ff400e9a797637341a2401a52ceac29718172e
SHA512 2b2975edee2ddd468b9ee98caf300d97f6fe25f4ea85048039a3f6122bac6e41c8e14f8c90512a5588ab3658a209aa4e090e9b4325e2dfe86d922fd2d8dae4bc
SSDEEP 12288:8Drluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:8DQofITNUohc3C5pPc66a0t
TLSH
T1FAD423A1D50F4992D855B477583D71C1EEBD4AF6BB830E82DACD26DDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 16f13ebc115bb77b350539591e119b6d7638b5a4b037ec249482e6a8028d7c93
MD5 766ac1d2e9a10d4ef8087536717febb0
SHA1 f66a09aa710f987929a4990aa4e080510f545976
SHA512 15b3fe68fb27046fb52f93794e868141296475e8b59da0f0d0c7d93e0874141d4833baf2af8ef3eb0f17b20219711463e63330bd3934ded2b031f3b839f0e76c
SSDEEP 12288:RHPJ3L1Aluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:BJ5TofITNUohc3C5pPc66a0t
TLSH
T1B1F41253B36630F9D4269139C8661A42FB7678325B228F5F539407BA2F633905F3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 35cc16028c092f17d38ac04658689f5841212b430935da100e367bdab9ed78e7
MD5 c0d6166b874707b226ea0b29c461764c
SHA1 42942fad250f7d237a433d8891430d01b1bd3089
SHA512 5b9b84fc6e994bfddc03e2d57f38f9fb3f22d4ad3939b7058bc5d7e3154ed57fdd5c3950d3f1aa5ca360d4e567fd47d9f63848d939dbab582b10a094b1c5bfe9
SSDEEP 24576:HTuaLl3z0zDDofITNUohc3C5pPc66a0t:HTdLljEoDWcF
TLSH
T18C1502A5B3501CF4EC67813ECC259906D6B27C6A1760CA5F03E8366B5F733901D3AB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 cecfbc2c493ac865eb103fffdeaa0272149a6207f63157fd01a0b6519d2b02bb
MD5 f2e86620a0e13d6c9e1d3a54928d2b64
SHA1 1f0e874cc26b62bde3927cd486cc1f101a4193c4
SHA512 29b13afb53b434487de6f8e327b53b67b6f4b27cecd940b76953de8c18486966e3e928e920dadbb0571c22545d2e86a7ec1f9b776e08b78d6fffb8da5564811b
SSDEEP 24576:N3PdSCHYy78ZtofITNUohc3C5pPc66a0t:tPdSCHYy47oDWcF
TLSH
T1BD35CF90F3E414E4F0B79A3589765511DAB67CAA1B31CE8F03A4265A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 603KB
SHA256 57700e9d37c280967d3fe554f1faad5c9c425af9554407cda9eab1ea9f1b0d06
MD5 28947b20027a2cbca940cfdb9c3283e1
SHA1 a73404c83ecdedc1b0c0174f8466e73e30d66df3
SHA512 684770e1aaab03de308a9f990adec8918b14c1b460cea7be360f82aeb7935a0ad27f0b253917cd123c8dfb838e641280896fce6934b86d61b7c458f93cda8da4
SSDEEP 12288:w9luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:w2ofITNUohc3C5pPc66a0t
TLSH
T151D423A1D50F4AA3D855B477543D31C1EE7D4AB6BB830E82DACD36DD97E038813224AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 b4c0b35870de2c0641180998e6fcbf0046674385248e98ff7e05e7b84fee2f65
MD5 cb3adafb6716f5c1237723852c5069c9
SHA1 d02d9eddcf6b6a5092df7bf16a5d4c06c1229002
SHA512 470154df7031769b92d65decc20067c6056ae926a2a01f3b405ffe894af560a5b940399433ef8f2dfe1ad609b526ed3518c272a07e662ba3107c1b708da0243f
SSDEEP 12288:4oluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:4rofITNUohc3C5pPc66a0t
TLSH
T148D423B1C50F49A3D856B477583D61C1EE7D4AB6BB830F86D6C926DDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 603KB
SHA256 2f258d0263ee801997bfcdb0d8e0d3426b927305014f17a59294dc0cbf636df9
MD5 7e774d3afc1d32910de7997de29fc4b5
SHA1 9d0f9e82510092a1f1aba4c6023f8af96790402a
SHA512 be76ffb4be44aa00a90a4c964892e04ba59f03fc32a96ba87d2e18f146078a7cf00cb74dae0af5ca6b0196f571d88ab128cea9d71caba6bb85fb013ac36a0023
SSDEEP 12288:J+luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:J1ofITNUohc3C5pPc66a0t
TLSH
T14FD423A1D50F4AA3D855B477542D71C1EE7C4AB7BB830E87DAC926DDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 603KB
SHA256 0a1c54a19680e76df2ff07226394461415ff7422fb5a83b0eb201d96095f4c1f
MD5 4cb34b7ad7e2939f52ecf6843916fdc2
SHA1 778dec887f35add589c0bad5a4fdea198b51b377
SHA512 5a4ec777ff012fb7c9ed9b8fcc0d23d42f4a7d36997be3ad8a922f99e358017fdbcb1299e660bb277c540accba02b695338e6af60e7502ae44e29952179ac874
SSDEEP 12288:KYluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:K7ofITNUohc3C5pPc66a0t
TLSH
T154D423A1D50F4AA3D855B477583D31C1EE7D4AB6BB830E86D6CD26DDD7E038803324AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 071c4d7db9d97705eb61c6c06b86ee42951dcce2a1b8c16f0e9cfb65792cd9bf
MD5 a5c7384745e3d9ce6c9b64e37a0c7ad0
SHA1 5146e749923a5cd00e113f4bf7da457c2502b630
SHA512 4c84ebb775435cf2025c4837b2eddbab393d213bb9d8e1af93b5cad48f7705064a569c7bdf723164f3b7b7091b9417983681c691318d2721e809cd1a4c39c285
SSDEEP 12288:sqmfiCluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:CipofITNUohc3C5pPc66a0t
TLSH
T194F4015AD25802E8C06EA13ACB2A5641F7377C6597E2C7CB92C0F57E1F712805EE6743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 b4794cbb3d5e4fef71bd14518b93242691d859744a0194b48565ea4b4dd80bc0
MD5 54f851a6ca4f476717ae7f289e622150
SHA1 247dada691fc8d6f6ba582a77292a258fdad4253
SHA512 4cf5d1bffa44ddd8b5152d9e5184664f9b79bce60563fc259fc659dc416dedc14565100d1615c56ab7b4338d3659aa2d52b84a142ab9ab102518fec44770d8a0
SSDEEP 12288:Rd7Aluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:HTofITNUohc3C5pPc66a0t
TLSH
T1EBD42362C20E5D52EC7AB476183DA150BE3D4AB5BF434EC3E58827ED96B03C84B3255B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e322c1486085b9e86a876bc67178a5b5a92577938b388c3b5870f222752baabd
MD5 61f8a3895b229a38fc641ffd671166e1
SHA1 c6c71afcedc71c69356fbce8f2b08c2db6efab6d
SHA512 7d1856afcfc95e2654c42838d99ea66dab54adaa7dfe9271f3d9fa8278bdbddb6533e01585d1f811a46fd08789f3b1f5fc65a3b611a2407061d4a040b367d239
SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYVofITNUohc3C5pPc66a0t:Egb4mBIBhGFAoDWcF
TLSH
T1C165AE1E22EC02F5E0F9E2B89DAA4417D6B278161732D2CF1151427D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 427e496c3f42c84da2ad6f0e6f63f265d043ad6a36ad9595a33331f31a2109ac
MD5 876fabbbb054e99d0bb99a289cb7c488
SHA1 3f031f3ad4889c069bf1d323dbdebb1b1635a693
SHA512 6f6dcbce76a6cc0118e59432103eafa24fa3f0a8d608991d31d7ab5be2b893576d459438cb99d3dd607ed4e93982d7834f4009593b6a51a4f478dbec0a781ca4
SSDEEP 12288:T1Gsluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:hGPofITNUohc3C5pPc66a0t
TLSH
T1EAE42379E1AB35D1C83AE53A48396092BDB535B06B131EEF89C466BDCFA03D42331C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 eeea484fd0824b6b8a9fc4d5ae41191d641d7d273f3f9b3a69b6af40d4481219
MD5 3a9bbcfbbb4f0a362a9e1a88364d5dfd
SHA1 a450987ba2eafdc33a49a09f4aa9836ba75741af
SHA512 649967d44618549e982e8bf5cfd4dae8d3752b576770b6e6ddee99ee22212cde5b11a3349ea90569edc98945db071d66e981bf25fddbe073fbc194a153ecd79c
SSDEEP 12288:8Cluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:8pofITNUohc3C5pPc66a0t
TLSH
T11AD423A1C10F5992D866B87758397581AE7D46B5BB830FC3E4C836EED7E03C813325A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5f54f6dc6438ca557c7ef237eb40c09385aa29ed5700430080330149cb00cb03
MD5 3386cab06b45b55cecdb0ebceeb5cd9a
SHA1 5d3b9f2d05b5697bab82e9c69222a2c2a48e7005
SHA512 6497dffb317b4a32617b29b5973b1c6a86f9e2599af99974f156035c263a344ddca6804e580a294a346d9f7d22f26b90ec23d690bbf4eb02f5e6353f548a91ef
SSDEEP 24576:A7r8A8sjJqH1kzria7/mcofITNUohc3C5pPc66a0t:Ow/sVqVza7/BoDWcF
TLSH
T173350165A6E101F1D47BE138894646A3FAB2B4251361EFDF07AC8B951F237D40B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 80b96ea116f54ea6aef41dfc955a18f943719b01930f22084521d3908520db32
MD5 122490ecad9a5f44e825c26955270167
SHA1 9eeab38ffa26440442177eb10e69e25aa840e231
SHA512 86c113dbc68884956ec71d3002f89ac2e5c95ef977abc2d6ea22344064d06100d10e38b43bfe6ea7acf96284de32e0e852c3662da9559c10aaead75c61aa6686
SSDEEP 12288:KHvUrBFrEjwaQeluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:KPUr+NQVofITNUohc3C5pPc66a0t
TLSH
T15305F12F62AD1CE5E67AF13D89468709F771B462171296CF02D0417E4F63AD8BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 14ec68f435382b8cd8b9d6ad205adb09d62b9aba3c1fc3630203ee02db90a6a4
MD5 94f7b5f29c8b96034c9c9f984cec14db
SHA1 4668826cff977fbbcae3ec3742ea21b84adb4aa5
SHA512 0bfbebcfeb91cb359e8cd49183c517b14d5ca5c0ee1a388dbfe9ff089c7c797d97479b8131cb846f384065cddc467384ad7ed8ac975bd7eb6b92fcafb371671b
SSDEEP 49152:wBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjioDWcF:rG05lO43bJqb
TLSH
T1B6D5CF6A62EC11F9D1BBD17CDAC6460BEBB23425033556CF02A486A91F23FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 707745e292b731dd8631240006ecc380250b94376ce191bfebefb9595edfa7ad
MD5 beadd7f26a1b2965d62156a4b6eec295
SHA1 7493cc9dff3ef0e860d8dbebacbde810a439e1f3
SHA512 d2c674c8d8e63def1f71044d2e3fb9590958bf391647384c8e71dbfb1b9eb0bef719cf6cf6e38f81b6c0446d2ca0fd3de7117dcd62a8cb2727298c9bdf40d811
SSDEEP 24576:+qa5POZ3dpbWVM50JicR2hG0lasx2+47eidn+ofITNUohc3C5pPc66a0t:Ha5POZ3wJt2pasx2+mkoDWcF
TLSH
T11265BF5EA6FC01D5D5B9D17DC583461AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5434d3b06fc8d86b44d4d62b247c5baad0434ae42ab8b8b20dbf3e2d8e1112c6
MD5 7c05063e0bed078c1c521a3d71f7357b
SHA1 6bb050e6a2eecd53df32150a707f5fc48d45a9d8
SHA512 e8b887116376705ebcfa1a6a30202679e04b29c33e21934c7753b154e390078486b0c07703450058106d1766c47cd552867c449a598b9f3d4e870e1cab2b1e86
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk+ofITNUohc3C5pPc66a0t:pNc/zEOVHFvoDWcF
TLSH
T1FF858B2662E901E4F5BBE1BE89779546FA71786513308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 f3e0c976ac02a5edcdea1d559d6e0823164e467de2d26fd6a6e792190c40b090
MD5 d3ef6c1d47c469ff4391873de1bf2623
SHA1 a616c70d2870cab7a87a9830cea8e6a3dc868dff
SHA512 5ccb47207ffe8a724a8f2b38e6ed1ed6c0ad057610ba16e4514eb094ac2afceebfbaf942a85409c59a5e7a034b160b70283fc9715ae330a37f44c38844850903
SSDEEP 12288:j5HPJnJP6szeCs6Rl28dpluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eF:ZJnJPbzB4SiofITNUohc3C5pPc66a0t
TLSH
T14D15D03DD2A810E8E4B7C2B4811A165AFE31387D2F2269C759B4D5353F52FD0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d2a786095389795605753df9d51ca5fbb14d246246b2efd2912f68d256af70ed
MD5 6bbf62c6ed75712f8f9f380ae8e7f4d3
SHA1 3b89f6517617d429c1a3e1937fb99546f601032e
SHA512 d262d5923bcd42f36b9afa8f981743a30bd25b9cf511c95403f995bc8f26eab57170d994cbc8379754c8d484c215fd96415cd46304aa6e2027397b1c11e4f66f
SSDEEP 24576:bCLHGL0MoeVtFumTijCmlKQWDkKofITNUohc3C5pPc66a0t:bCLHGeeV5ijCmlDWDkKoDWcF
TLSH
T1F3A56B05E7EB5184E8F3CAF5CA2694169E327C549B34F7DF4A80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 519d02f17003684a0b802daaaed597e95277025809a017465fdd132924aaefb5
MD5 e9fc6d6b925f55e39e6fbf082cdced3d
SHA1 82efa929179968dbec99234f94dedccc2a395862
SHA512 0d4d9d30a87633e41a8d35f4094742a41b429975450b80ccc04e5250b4ebf321cd079240733b1bb8f232336265452739f3ae320df46130b1cd007e44f510d371
SSDEEP 12288:B1HIkxp5ZI7Wluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:tx5IRofITNUohc3C5pPc66a0t
TLSH
T1FD05015D637A10F5D06BE03E85530102E6B2B1B197531ADF4AD485BE8FA3FC8BA39E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 66fa52ea79cfd1a270a46c7bbd24ca3c67fcdbf7c78e42e2b5c809c2b2bc34c7
MD5 eda47aac7a24bda134e877ee98fb3309
SHA1 72df692def823a32fb20e040d46d0b89d812316d
SHA512 75740e26a59dca9706dfc5fd84865a0d7d0134e302ec4504b40dcbdc8d2005a2a3b43a10428dabc53ccd8eae8c13240499d05674682c288f621394bb8b093c82
SSDEEP 12288:XG6ky3luow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:WtycofITNUohc3C5pPc66a0t
TLSH
T129F42201D39964D1E9BA653989378190AF39BC30AB234BCF95C0B77E6F713C46A31B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 6225a91c9f76777a09aff5d1d6a79b3ff42dafd3521b8055c396a46523917ea1
MD5 a6d6eaa55e1fe3aaabcec453cbf8284e
SHA1 727026b50799aea94a908967a8f080df4b78a232
SHA512 f6e889c59ab42fcd4105bade628a8a9b3499aca81acbbeaa4604fcb0763ef2a3458d32f292b86e2b4e7c5321aaa7497d23605abfd7e6f35f940610edc36fb3ce
SSDEEP 12288:58Pluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:GEofITNUohc3C5pPc66a0t
TLSH
T165D423B5C20F69A2DC25B876043D6181AE7946B57B530EDBE9C426FECBB03C81332D56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 7f98e8aa8e64cd1afa4984f3b3df96e81a76cfd428d31ddd3516079c056e6646
MD5 71074d2c764edd6c2b0e9d5a52831daa
SHA1 1b28612a1dd7df542d0e6dd846bac07541466316
SHA512 778ee68a6cdc7c82c240012274f366b6a7a61492c7863e213520a0964a520a18d8e1f95af020c87597fe53fff9a05d8634ae3d3dcca50888457b84d38fb7699f
SSDEEP 24576:iFg1ToTfaidZHofITNUohc3C5pPc66a0t:Sg+TrZHoDWcF
TLSH
T15B559D1DA7EA05CAE2B2D675D8721493D633B4315772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 e389d296c1ccb8c81e6fcf8c2817abe78bb1da2e795da651f7399722c289b26c
MD5 19f7784a1e16e904f8ebfbf11e0e1636
SHA1 9c594ced104c2b776a6bddb1d1c1143c6d9030b0
SHA512 9183092ab87464755d7b23ceac13729a759b4374c8fd650d3af560a10fa3b5868394e23158ccf9b58c431e44773987fa0f789a7136f3db9c7e9a495c4d613534
SSDEEP 12288:JpJcm8CNZluow+JHIabtqlLNUohKbJKIJwQ9A2et2kFc67WPr2eXPXq+:JrcmRyofITNUohc3C5pPc66a0t
TLSH
T17F05015EB26E00E6E1B7D13C88464142FAB3707067526BCF42D087BE8E636E97E35B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 43744a4b6723e6b7ed9210e30bbacfd6a1081bac7edcb34c3048742d3e8e3f1a
MD5 ea8f847d4e47806161bf16b3d1d0ba2f
SHA1 41332d7a5d20a290aac01c5254873981b84ce7cf
SHA512 8b1046bf47e87029eed4a5b301c0768ef589b0237a3f58dae0b463eadeabea2bdcf93769c944a5682fc1a1f5d393adacd02cc90229cf91a9b55cde4ba451883f
SSDEEP 49152:8DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS32oDWcF:Z3Upow8sBhqb
TLSH
T1F0A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-300-0x000001D4887B0000-0x000001D488816000-memory.dmp

Download

memory/240-301-0x000001D4887B0000-0x000001D488816000-memory.dmp

Download

memory/240-441-0x000001D4887B0000-0x000001D488816000-memory.dmp

Download

memory/240-374-0x00007FF639D40000-0x00007FF63A157000-memory.dmp

Download

memory/240-443-0x00007FF639D40000-0x00007FF63A157000-memory.dmp

Download

memory/240-299-0x00007FF639D40000-0x00007FF63A157000-memory.dmp

Download

memory/1096-381-0x0000015E5CBA0000-0x0000015E5CC06000-memory.dmp

Download

memory/1096-379-0x00007FF620EF0000-0x00007FF62101F000-memory.dmp

Download

memory/1096-447-0x00007FF620EF0000-0x00007FF62101F000-memory.dmp

Download

memory/1096-380-0x0000015E5CBA0000-0x0000015E5CC06000-memory.dmp

Download

memory/1124-328-0x0000028D6CEA0000-0x0000028D6CF06000-memory.dmp

Download

memory/1124-329-0x00007FF760200000-0x00007FF760395000-memory.dmp

Download

memory/1124-330-0x0000028D6CEA0000-0x0000028D6CF06000-memory.dmp

Download

memory/1124-440-0x00007FF760200000-0x00007FF760395000-memory.dmp

Download

memory/1484-448-0x00007FF73BCF0000-0x00007FF73C02F000-memory.dmp

Download

memory/1484-391-0x0000021EEC200000-0x0000021EEC266000-memory.dmp

Download

memory/1484-389-0x00007FF73BCF0000-0x00007FF73C02F000-memory.dmp

Download

memory/1484-390-0x0000021EEC200000-0x0000021EEC266000-memory.dmp

Download

memory/1528-321-0x0000022607F90000-0x0000022607FF6000-memory.dmp

Download

memory/1528-320-0x0000022607F90000-0x0000022607FF6000-memory.dmp

Download

memory/1528-319-0x00007FF640BD0000-0x00007FF640E73000-memory.dmp

Download

memory/1528-388-0x00007FF640BD0000-0x00007FF640E73000-memory.dmp

Download

memory/1572-249-0x00007FF754E20000-0x00007FF754F3A000-memory.dmp

Download

memory/1572-336-0x00007FF754E20000-0x00007FF754F3A000-memory.dmp

Download

memory/1572-251-0x000001BA019C0000-0x000001BA01A26000-memory.dmp

Download

memory/1572-250-0x000001BA019C0000-0x000001BA01A26000-memory.dmp

Download

memory/1584-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1584-271-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/1584-276-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/1584-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1676-369-0x0000022F8F200000-0x0000022F8F266000-memory.dmp

Download

memory/1676-367-0x00007FF7E9B00000-0x00007FF7EA007000-memory.dmp

Download

memory/1676-446-0x00007FF7E9B00000-0x00007FF7EA007000-memory.dmp

Download

memory/1676-368-0x0000022F8F200000-0x0000022F8F266000-memory.dmp

Download

memory/1684-243-0x000001E291C40000-0x000001E291CA6000-memory.dmp

Download

memory/1684-241-0x00007FF60C630000-0x00007FF60C6F9000-memory.dmp

Download

memory/1684-242-0x000001E291C40000-0x000001E291CA6000-memory.dmp

Download

memory/1684-327-0x00007FF60C630000-0x00007FF60C6F9000-memory.dmp

Download

memory/1756-2-0x000002416E4B0000-0x000002416E516000-memory.dmp

Download

memory/1756-22-0x00007FF758F50000-0x00007FF7590A6000-memory.dmp

Download

memory/1756-19-0x000002416E4B0000-0x000002416E516000-memory.dmp

Download

memory/1756-0-0x00007FF758F50000-0x00007FF7590A6000-memory.dmp

Download

memory/1756-3-0x000002416E4B0000-0x000002416E516000-memory.dmp

Download

memory/1756-1-0x000002416E4B0000-0x000002416E516000-memory.dmp

Download

memory/1936-444-0x00007FF6DDB20000-0x00007FF6DDDAB000-memory.dmp

Download

memory/1936-351-0x0000018D4BDA0000-0x0000018D4BE06000-memory.dmp

Download

memory/1936-350-0x0000018D4BDA0000-0x0000018D4BE06000-memory.dmp

Download

memory/1936-349-0x00007FF6DDB20000-0x00007FF6DDDAB000-memory.dmp

Download

memory/2176-318-0x00007FF60C630000-0x00007FF60C6F9000-memory.dmp

Download

memory/2176-234-0x000002AFF31A0000-0x000002AFF3206000-memory.dmp

Download

memory/2176-233-0x000002AFF31A0000-0x000002AFF3206000-memory.dmp

Download

memory/2176-232-0x00007FF60C630000-0x00007FF60C6F9000-memory.dmp

Download

memory/2340-290-0x00007FF653250000-0x00007FF6532FE000-memory.dmp

Download

memory/2340-291-0x000001BF8C050000-0x000001BF8C0B6000-memory.dmp

Download

memory/2340-292-0x000001BF8C050000-0x000001BF8C0B6000-memory.dmp

Download

memory/2340-373-0x00007FF653250000-0x00007FF6532FE000-memory.dmp

Download

memory/3492-337-0x00007FF609420000-0x00007FF609741000-memory.dmp

Download

memory/3492-346-0x00007FF609420000-0x00007FF609741000-memory.dmp

Download

memory/3492-343-0x000001D9C1CD0000-0x000001D9C1D36000-memory.dmp

Download

memory/3492-338-0x000001D9C1CD0000-0x000001D9C1D36000-memory.dmp

Download

memory/3492-339-0x000001D9C1CD0000-0x000001D9C1D36000-memory.dmp

Download

memory/3776-359-0x000001C2FC330000-0x000001C2FC396000-memory.dmp

Download

memory/3776-358-0x00007FF712F40000-0x00007FF713411000-memory.dmp

Download

memory/3776-360-0x000001C2FC330000-0x000001C2FC396000-memory.dmp

Download

memory/3776-445-0x00007FF712F40000-0x00007FF713411000-memory.dmp

Download

memory/4208-284-0x0000020CA6760000-0x0000020CA67C6000-memory.dmp

Download

memory/4208-282-0x00007FF771810000-0x00007FF771F54000-memory.dmp

Download

memory/4208-283-0x0000020CA6760000-0x0000020CA67C6000-memory.dmp

Download

memory/4208-366-0x00007FF771810000-0x00007FF771F54000-memory.dmp

Download

memory/4500-28-0x000001FC426C0000-0x000001FC42726000-memory.dmp

Download

memory/4500-27-0x000001FC426C0000-0x000001FC42726000-memory.dmp

Download

memory/4500-26-0x000001FC426C0000-0x000001FC42726000-memory.dmp

Download

memory/4500-25-0x000001FC42410000-0x000001FC4256D000-memory.dmp

Download

memory/4992-311-0x000001DC904D0000-0x000001DC90536000-memory.dmp

Download

memory/4992-378-0x00007FF61DBB0000-0x00007FF61DC64000-memory.dmp

Download

memory/4992-310-0x000001DC904D0000-0x000001DC90536000-memory.dmp

Download

memory/4992-309-0x00007FF61DBB0000-0x00007FF61DC64000-memory.dmp

Download

memory/5116-61-0x00007FF76F400000-0x00007FF76F523000-memory.dmp

Download

memory/5116-11-0x00007FF76F400000-0x00007FF76F523000-memory.dmp

Download

memory/5116-12-0x000001FB967D0000-0x000001FB96836000-memory.dmp

Download

memory/5116-14-0x000001FB967D0000-0x000001FB96836000-memory.dmp

Download

memory/5116-13-0x000001FB967D0000-0x000001FB96836000-memory.dmp

Download

memory/5436-264-0x00000242B6980000-0x00000242B69E6000-memory.dmp

Download

memory/5436-261-0x00007FF71BFB0000-0x00007FF71C0FA000-memory.dmp

Download

memory/5436-348-0x00007FF71BFB0000-0x00007FF71C0FA000-memory.dmp

Download

memory/5436-263-0x00000242B6980000-0x00000242B69E6000-memory.dmp

Download

memory/5680-52-0x00007FF710450000-0x00007FF7105B8000-memory.dmp

Download

memory/5680-43-0x00007FF710450000-0x00007FF7105B8000-memory.dmp

Download

memory/5680-50-0x000001DCCB370000-0x000001DCCB3D6000-memory.dmp

Download

memory/5680-45-0x000001DCCB370000-0x000001DCCB3D6000-memory.dmp

Download

memory/5680-44-0x000001DCCB370000-0x000001DCCB3D6000-memory.dmp

Download

memory/5700-36-0x0000019DAD430000-0x0000019DAD496000-memory.dmp

Download

memory/5700-34-0x0000019DAD1B0000-0x0000019DAD30D000-memory.dmp

Download

memory/5700-37-0x0000019DAD430000-0x0000019DAD496000-memory.dmp

Download

memory/5700-35-0x0000019DAD430000-0x0000019DAD496000-memory.dmp

Download

memory/5768-56-0x000001E6ED130000-0x000001E6ED196000-memory.dmp

Download

memory/5768-55-0x000001E6ECF00000-0x000001E6ED05D000-memory.dmp

Download

memory/5768-57-0x000001E6ED130000-0x000001E6ED196000-memory.dmp

Download