575f3d3ee570a39f7c8d4286d4013a4ffb2fc9d5ec31d07efeda8f48a2123588

Analysis

max time kernel
138s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Size 965KB
Sample260729-ael5mscf74
SHA256 575f3d3ee570a39f7c8d4286d4013a4ffb2fc9d5ec31d07efeda8f48a2123588
MD5 eeeb835958259d7c9dd816ceae00cee6
SHA1 0f2c83a4a6e424e6e1622608c7839bb6aca8a909
SHA512 05935dc126205cd91a1b96635e702a4d0accb4c4c77fdbf313aa92466f30e86ae8ede82f8581ca70c7882fbaeeef64eee7477744d10afb27472ea9028a3afadd
SSDEEP 12288:b429bHOzRoapAirjJAdGyTGy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQm1:5H0aDivJ+RTGy8f5/v1bvUHOjmkF
TLSH
T1BE25F129F3A019F8FC2AE13CC9A29511D572F8150360DAEF5354A6262F336E05E3FB55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5260	alg.exe
3852	elevation_service.exe
240	elevation_service.exe
1724	maintenanceservice.exe
3212	OSE.EXE
2008	GameInputSvc.exe
4284	GameInputSvc.exe
5860	msdtc.exe
2024	PerceptionSimulationService.exe
3420	perfhost.exe
3172	ReFsDedupSvc.exe
1100	locator.exe
4928	SensorDataService.exe
4728	snmptrap.exe
2904	ssh-agent.exe
5696	TieringEngineService.exe
4472	AgentService.exe
5276	vds.exe
3820	vssvc.exe
1424	wbengine.exe
5720	WmiApSrv.exe
1832	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f7b39dd7c618523d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4284	GameInputSvc.exe
4284	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3344	2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	5260	alg.exe
Token: SeDebugPrivilege	5260	alg.exe
Token: SeTakeOwnershipPrivilege	3852	elevation_service.exe
Token: SeTcbPrivilege	2008	GameInputSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5696	TieringEngineService.exe
Token: SeManageVolumePrivilege	5696	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4472	AgentService.exe
Token: SeBackupPrivilege	3820	vssvc.exe
Token: SeRestorePrivilege	3820	vssvc.exe
Token: SeAuditPrivilege	3820	vssvc.exe
Token: SeBackupPrivilege	1424	wbengine.exe
Token: SeRestorePrivilege	1424	wbengine.exe
Token: SeSecurityPrivilege	1424	wbengine.exe
Token: 33	1832	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1832	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1832	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4284	2008	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_eeeb835958259d7c9dd816ceae00cee6_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:240

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1724

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4284

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5860

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4928

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4728

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3820

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5720

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 166259d10e844b15b06dd9ab7acbe1aac26aacf4d7a0beb574db734f170874ef
MD5 8c3332f15de389e7d7e04ccd6b5c855b
SHA1 c324ea984b4575d9354ab75a0ba418cb7cd777d8
SHA512 a1e05f920d41bf76323fe851abe9121120231fc2f49a1b718cc1a62403ad590e3568a3927ff3f4830011ced4c6488b31a00f7f8b5bcc8c3f77330eb388a6f6db
SSDEEP 49152:Vb+632BuPkFKRrdE6oh7stBhuXjfS4LWxntX5/tbiCmm:r3q6gjBqX5/tbiCmm
TLSH
T159D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 1b343a558c2eeafe7cc50e0d2f9d458d5f8d26a518edc3b7ad8ac97a22d63e58
MD5 002b9dd15872e55d5aebde5b479715d1
SHA1 42ff72c9f0e663417fcdefe9decf4a12b09bed01
SHA512 65319a70227c755332e7bff230b33b78ab16779f34f1cbb4d4010827c6beafa33fd6abaf358e139713d8354c482e9a3085d155c840a4a2aa4acaca1d7f29eba3
SSDEEP 12288:Y1XLs/6Gkxy2lRq2czAby23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAS:eXYiTtczAby8f5/v1bvUHOjmkF
TLSH
T14A05F12877E008F9EC67923DCCA28511E63378554364EB9F03E49A661F237D85E3EB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 daf4a62890ffcca262e2e164679c8edb32d6053f18968b59ff8315e9e8502a56
MD5 96d02abdeb53feb4c5ec165b46815e05
SHA1 976067bfd423a87b5649b3c09b7c22e41832d779
SHA512 efb035b6a73e8f7ee2948605445d5c1be91300bd69c641a5bc8be3ec2e32f9700c565df7cac184c70221b0e84c2200c8cc662985c89d1185bfc98fea3300a2ac
SSDEEP 12288:VaZNYV3eQUiJ0h9BSD0wxpGZIVuhrHs0y23VH9ZU8CDqNp598oi9ivD3unfnG038:g03eviJ0hsxOrM0y8f5/v1bvUHOjmkF
TLSH
T161359E26F5748331D073C0B9C5D2A69AE971308657308ACB4286D77C7F67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 afd3aa73d0bff413775e1891d7117e6191c6681c12499f83b6638dda80ce1b05
MD5 9e5899cf71141281a24ecb0f5fab31cc
SHA1 e1f248bb1e256f4b03d49a5094056912e009d5f6
SHA512 e45fcf1ff1eeccf3d0aef9ba9f43dba21b962e1128761c910136509c41348d448d138aea651c97981b5322b33713e166a3fb96f2398cc0079797a0e1e6246275
SSDEEP 24576:iKp/ezSC6vUyD/aqgrvW/6q8wyuQy8f5/v1bvUHOjmkF:X/ezSC6vUzPvuHjyXX5/tbiCmm
TLSH
T1F1756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0610051e373202ef57b0eeefd692930e5767056868cb9ec4cb8b2498f13fa853
MD5 d916cc1104ae0ce956ce329365f47992
SHA1 32caaaf9ad150982cb501260258a262431e3cb65
SHA512 4b818e5c51e9054613ed2714885d252853e46f110c837fbc3cc09fc3e454f2161fc59fe4b291a38333dac754eab2badddab7beabd7479127123da43b11a4fc0b
SSDEEP 12288:5aJjB+33vOFTwJ+l1D03wsEBoW/lx4jf0Im98sy23VH9ZU8CDqNp598oi9ivD3us:5ab+POxwsv/l+dsy8f5/v1bvUHOjmkF
TLSH
T149559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 c5d9ca75ab9b4b1dbd14849a0ae91bff1ba151366a6aa64a69d5dccc07be8097
MD5 801a96ffdb8072c84eb5b478dd3954b7
SHA1 07bd5f1c6f8b359d094cf1b7883193455a524cbe
SHA512 595ae2c7a9ebca9002f9d23d787ff9776ba5f90361dd97a1e5f817bc91fd616005fe6c9b3c480088087fbd8883cc7e491c136a39bf601eaba72784856fdb8056
SSDEEP 12288:QETy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:QETy8f5/v1bvUHOjmkF
TLSH
T153D423AD9C705083DEA9B33EFCE25A6440344A19507D0EDFCA9077E6193BD6EEB1948C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 9bb54fb2930922771e7f928fea298f03b0e9b4d11c808a4d3c6e226f3b69b382
MD5 e0d7ce050af905b9ff6d7b6a76bf260f
SHA1 9a56dc7b3c6a4bad5740c4eff1fe9df0a0cc90ee
SHA512 2f729ac9eb656f02f885d487826a88bc764ad8308751d59e2c06a6fbe2f44fd691867f47074b2ee0042bc3e1c27e43f0914bcc109f09b87008dcc40a9086d004
SSDEEP 12288:7eBNUbTVO86Uky23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:7JIUky8f5/v1bvUHOjmkF
TLSH
T13B15DF3BEE38FCD2C67E9DB89A918600D77274304B22A3CBD164834E9E235E55E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 8f1fbe6cd9c985ea4ed2a489a96df2fd7ce73dedb85b0b00825f07d33f368ebf
MD5 e19bc952365af0bd0fe6f0ad7f6fbda7
SHA1 8f43f7c7e2baf7830e807d3576e4bb1a229af5c8
SHA512 84dcc8255239fc0cbfb715d518d328e3e30bf11fd20608efb4624078d0a3bb50c444721b93b36ef6c6523ff24b21f2ad6eb2a7c5afa645a902d8d30887f01130
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJY9DN5JJNRV3THW:XQvGAdlCEL8c/YRNF5CtX5/tbiCmm
TLSH
T1F9366C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 9ddc03a98445cc424cb61c598d2e4c8b054ae2722054579a9bc4f6112be86273
MD5 b1f1817b442782c5532135b3df00c671
SHA1 9a5a6989d3725ba24819280964d440d4ec4cce0f
SHA512 bd3c23d9a87de7b28c16a5b30a11f29c9532a2ca1fa38cee14ff4bfaa713b9c69e7c96c1a05f9156a947ee5f8504a827c4702b95b26fe33433d19b21ff08410b
SSDEEP 12288:YpwSfxL/2Dc3bDLLmt0LDQewsAjVy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBu+:4mewsAjVy8f5/v1bvUHOjmkF
TLSH
T1B915E031FE70E032C6BF0DB66B76C716143C7A204B611AC3E3E89E9D59316D22776A16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e02435bec9b23e6f1660a734d717ce3155153cb048a166e43ce257b324ce7f60
MD5 0aae9ffe5e49944383e8bad0bc60974f
SHA1 0f4d941721ca7385ef88aee2561cf4aeb1d9aa2e
SHA512 c61e7b1d4e30860983f4e4a55b6355ea0b59010721c930d9f4f1f33ea3fecd52eea226d286e29c743ff490ef063223e715cdacfa4622a025942b0384e9ac84ea
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrVdPlbuJHYiCmm:xUEtQevvqc2W1cpV2Xrn2Y
TLSH
T188474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 efa1815e0073ad2e73be74aef6a87d6fd9bf66c4e536e89d0dd046e792ecd847
MD5 6d9faa236cc0815d338a074025172daf
SHA1 04b24aff2db2fbc8d2280005ac34b82040a721fa
SHA512 31a3e7e64a890369067d23f642d5cb2cd9f28d37ba331b3fabe155efd21f33e02827716d6d2c604db4b64fb205b0a7b5e0d57c9c2f43e795ed97d585117c8777
SSDEEP 49152:YMbRquA/m2yL5zMfFiV+XenmE3/zlX5/tbiCmm:3oq1VjnmOX5/tbiCmm
TLSH
T1EBD58D0976B8C1E4D1F6C37886A2C647F37178154B35ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6f9f7fa31c80a549505ac9d5d03336b7e9a00d580db2fe63d69f6a516996fdea
MD5 8012dfc959e8ee1084f073084fcfa0f8
SHA1 7f3085951ad72e50b2064839e412b46cd369aefb
SHA512 3f5864156209fddb0764143d7c8390a17632779b726daaa86a63971d9306b11f325cc4322a8fb40f1709382be459af3ff008ddec72072b55f8f504b57980b7ac
SSDEEP 24576:BAhGLv2FoiwtA5l7S539y8f5/v1bvUHOjmkF:BAMSFoiq5NX5/tbiCmm
TLSH
T17845AD80EBF955D4F5B3AA78A9B68570E976BCAA5E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 a1822691aeeed0483219fd9ae06d3a0850980e22376234ae377a6dd508c1b470
MD5 92469f2991c400d7178a11dc31b18027
SHA1 98796424e84257da891360824fe203cab09663fa
SHA512 87db1cefef2218446d4080d9811e331b9fd46208a0f2db54f85bb81961535be82844670e950295bdbef216ae11a5f8ea41c590a1b234b363d691bf92941dcf93
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CZy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQm7:Owu+OWyy8f5/v1bvUHOjmkF
TLSH
T12605F14976A40CF9E9A79239C597C536E7B2B8012635CB1F0760C69B6F37321BE2DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 e5d697fadc21fdccabcc9a430598ea21d16ff637497b7cb453c5625f7a093017
MD5 d7c2479d35aa64486064bc5a4d3cc098
SHA1 e7268fcfadf834440c25f51a9c36b17b19647371
SHA512 4e474cb67c5e5a83b45bdabab585ec697a979147239853411826aac1bd570677b7d482b807fc2057c54a8deeeb2fae38d1013ca4b969fa25c69f3c324547fc3e
SSDEEP 12288:+XT1IUYy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:eTuPy8f5/v1bvUHOjmkF
TLSH
T181E4129D35F020F6D9A6A23CECE25A05D3717416233A47CF466052EA2F33EDA6E39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 117054bb9a909cb197a4f5a27a35b86ae88351ffee5dd4f9ce104103f9f5434e
MD5 a43422c681c1e8edc97d53f22bc563b2
SHA1 629afb7f8e3d19e0b42254081c037dd562f3ba2f
SHA512 fde8ce03bcdf0dbd0ae4bc11ead03f63324ef7b3363a2de82b2b91d731ee3489285cbea41ae4c706938b916ce872c9114ee1f8c68b8dd2ad53bdf99ad692ce7e
SSDEEP 98304:zQRQyi36YOcP8Lvw2gAf+PN3nX5/tbiCmm:iQyiKa+X+PN7iCmm
TLSH
T1A4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f21939e6fe8d79dc84400b275c4fa897d8b6c6df0f92d7bf504117f2021331a8
MD5 342f2d1ce25d32b941abbbc4a9ddb964
SHA1 1edbf0e35cba2ca7b7dc5048ca3ab50f5488410e
SHA512 205953b114c5ab77c9b1094aaaff586217d6c8499ae1eae5e0a6b0c281df7292ef48aa38ab9686aae36187c3a0f7b2c5bcfadd7fec75661f7be6b25bf997342c
SSDEEP 98304:zQRQyi36YOcP8Lvw2gAf+PN3aX5/tbiCmm:iQyiKa+X+PN8iCmm
TLSH
T19C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e5d1b96f0699738564293f768fda9d20de9e87adaf48e25eead0e2c445d3669a
MD5 f65387c28822ab08713e603af8fa7fa8
SHA1 ef8bece78f4fc0f43f04f2b6f846251e6d4a8272
SHA512 acdd5ccb03c4a01baefe88725cec498688c1ad234e5774fa0207d67fe7ed9b1f1a52f250c8c7405b1a4b4c17f7b0b4fe69d4f46040af38928e2f38ac46876bf9
SSDEEP 24576:twvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0oy8f5/v1bvUHOjZ:J68Qg55nhMeWu7PNU3/tX5/tbiCmm
TLSH
T124B55933B2F200A9C44DE1769F4A873196D27C758FE0E7DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b80aa733a24513591e048146e473b960937ca057d3533240c3d9559f1c4fffb3
MD5 843bf27c3d1518f179a22c67fbd8a519
SHA1 6916f2d58a420cfca599505927c9bd49842e34a6
SHA512 0f04b708322acdedea329962147565f5a6af1f1045857f72aa07e8e2120ae3fd6a3293203ef67ed5ebfaf801c1ac7c927326c94b9817b0e84b21dc0b06c4dc9c
SSDEEP 98304:6y5112gYy5azzVv569nLKnhZTX5/tbiCmm:jLIHAWhtiCmm
TLSH
T102167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cea29518eb3a4c7546959f68a73fbf2e9cfc955394e6aeb2291d3e48bb5fb4a4
MD5 00bf06a8398e8fd7b5f84bd8194cb6aa
SHA1 8e077276f46315ed16d6d82a5ca53642a8279084
SHA512 0def469e99389b9797f200cffcf45b9dcd8dbc59d9b2f0337660a0a70770b5d24d1d49b172d550ee4bbf3f2e26f58c077d4ac96c4c61d5cc29904d289a22dd91
SSDEEP 49152:XB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glwX5/tbiCmm:5u6JmTxd2dwX5/tbiCmm
TLSH
T1EBD59D13F1DA01E8D06ED178974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e3ce16cf235cd34ce2a08afc3efd2bb2354ba26c4dd4282bb742da485e5646f5
MD5 655c90bd004543eb287adba63638e101
SHA1 fc4ad6e28b0f9bd8574b32167cd3df4f5f13b561
SHA512 2937b1adf01874584fa16ad2f4fefd8a37862748cd4d37483ddb42ddcf3f909a1add3c92c4e441ea161fcefc00d8dae6f8b8355e85c7f6b427e5a5741e35f6d5
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4xzX5/tbiCmm:3mifPbRSX5/tbiCmm
TLSH
T18FB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6968c7575de1e616c0fc97c2dfb7b09cc0a31e5aa57b16b0bd1f4823a9edef15
MD5 db50edfb1d18870bf7f380526ee4fbf2
SHA1 fb9ef6dcb90cdda9f9a0f7d5b1f253d3ccca9969
SHA512 530a4c945f812bf147a0f540270b88c4f1affec88cc208f1df36fa316730ec7f59f0ae49de6ae685accb420dbbdff422403b203c8ff632ffa666e857b189e365
SSDEEP 49152:dSuZQIY0Be2K6RVtOnks6NMHq8zX5/tbiCmm:z5dKoi61cX5/tbiCmm
TLSH
T10AC5BE13F2E940E8E0BED67887669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 64afb348b8bdbb7be743af3f5daf8de1480d2f57ccad541910b87c0e2bb526fc
MD5 ac7bc920e250c445bcd8a8d44d906f61
SHA1 c543d1f56dcc6c56ac864bcdf95fde5c96111177
SHA512 f4c448c12b16e97e62c4fcf133e9afbc7c830a4ad87ec833ed7c5c3eacb42268cf81a3180a2c01c6a5787ba492c37ba92e0f0363baa3214c073b2fbcbffadb20
SSDEEP 49152:ChtSn8EApI0figTgiDn0AP5wHX5/tbiCmm:jX2iyphqX5/tbiCmm
TLSH
T1DCA5BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 8d7d40d2336f02c71c960f890eaa67043661d013c2932c4b23fe983a863123be
MD5 7be431ec6696ff7ebfd00e907cf6df15
SHA1 215088001557ae7e987b143cf343cdff3d54367b
SHA512 2aa09e46056d8b1448da57adc7a2ac3975695abd2224ae3a429a3162e485e827f9674a14d27240e2a3f815ac4990ab9b0e2728a6bca258789a8975fe8b08c33b
SSDEEP 12288:uoy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:uoy8f5/v1bvUHOjmkF
TLSH
T187D423ACACB15183DC58F33DFCD256A88068171AA13D0EDFEB5472E11A27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 761dce3ec5819b4d0e3f58045cbfac1d8df6a47bcfa2a024af4a29af2eb60df8
MD5 d61c8a2065f0629a0ed0b48f21fb5212
SHA1 d9fd4206d5abe451130f2bc34551221b50f2e52f
SHA512 ddc1c026de460b1d910a7a5157e1f885f7973936354c9d66ac3635c68a6cdd09c456deb002ca15f46346d1adeb7351bebfe0a6c0302cb69703a9a709390d79e9
SSDEEP 12288:oEy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:oEy8f5/v1bvUHOjmkF
TLSH
T1CDD423A8ACB15183DC58B37DFDD256A84028070AA13D0EDFDB5072E52A27D6E6B1D4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 05da20203ce600721b8825461bda765a382891a947e2a4ef1d679df4ef3eabd3
MD5 e6a4ee91f6fc8d1bd965dc563fc3878f
SHA1 754d77d14e1b0ea79fa0c341e8b9d5465648019d
SHA512 a16dcff8301854606193b1326c16624d06025743e04ae874e9fbb559f1dd1865f159d6ec18977db021e451d375f6c643ff38e8e7cdc7d471946a56dace037bba
SSDEEP 12288:Cwy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:Cwy8f5/v1bvUHOjmkF
TLSH
T153D423A8ACB15183DC58B37EFDD257A88028060AA17D0EDFDB5071E52E27D6E6B1D4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 386990399c9ed86b452f96d588c88a4d8ead2aff8c94026d2b04f9cdd1078166
MD5 860aeca321738cae77ece598d2a92932
SHA1 94f722b4087013a173277a0ccb9ad9ad5aa83c7a
SHA512 ff44edf86423e5eb3d50cad16b498abd654af95d866e690263fda5ec62a075231a0c73d6de6b3751f1a8352335786d38e93763e0f8c46d0e9819840deffd351d
SSDEEP 12288:Tl8y23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:6y8f5/v1bvUHOjmkF
TLSH
T10ED423A968B000C3DC69F33DECE25664D0747919A1390F9FDB4026E61F33F6D6E18A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 655711cca68b186857f1601b4b95ef8d62b2307ecd3439a331d7d2a047d0db7e
MD5 4f77d5ebae161f64c710506d0f0c67a2
SHA1 8427ebb0988eed305a02094ca20fe5c6c0452d06
SHA512 4d8a154f12ba53ef168fdb8bf687e59593319c25629ad2b7a965b6e06345a4142decd594f3c4d7270d3d92e6036711969e60b88692ebd50ea0eb8606efd6b308
SSDEEP 12288:Bhy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:Bhy8f5/v1bvUHOjmkF
TLSH
T191D423ACACB15583DD58B33DFDD256A88028070AA07D0EDFDB5472E12A27D6E6B1D4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 f99d95ca92064b80d40ab1d6502b5dbfda9c5c4e1dd3c1399e0b5e0fa61f10bd
MD5 224be7bfa298f8e2412659938e6a20b2
SHA1 d556f114267121e8c0c63d978aedaf78b21adff0
SHA512 d5111b5eb2f2f6080ac7ab13c563819abb688b48d4d48e14328d60a6f9494d0b506ff75b76b4be16359ef296b88f22f235b065f45b41e8f579bca46d7b9af673
SSDEEP 12288:yfy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:yfy8f5/v1bvUHOjmkF
TLSH
T192D423ACACB15183DD58B33DFDD257A88028071AA03D0EDFDB5472E12A67D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 b83f0d8e79ed62c69c2b64179d6823a3a43eb71a08fd70e81c8cadc79607542a
MD5 fdc4cb316300d48f1c8b741c81c1272c
SHA1 2821127e37fc93d7b2816b8c4a6cd72f59e5bfbb
SHA512 2868b5e77980a9bca0340e278fb5d0cbb4800829ca918cc547e0622c8575c74fcabc7c99ec81b978f7d7a85ac1e8b6871f810e8128a65f949b408a2a274eb0ae
SSDEEP 12288:5Ly23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:5Ly8f5/v1bvUHOjmkF
TLSH
T174D423ACACB15143DD58B37DFDD256A48028070EA07D0EDFEB5472E12A27D6E6B1D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 42af33f0f03761d1a47b121c31f4033bcb667352adc2079078fd9a4edccae0a5
MD5 aa7a12f6a0905a0fbadfa8c1d4009894
SHA1 8a595cb26db6519e7a9d60f32afaf0253da6311a
SHA512 3642aa48301e9ff0c79db08bcf6eadd2f00edbda7384a89ea861cc988cec19fa5c7b7a8c93256b6b88fa3ba907dbcd9feecc70c5c73cd5e2eee9007531925179
SSDEEP 12288:eiZwberz+0GSMcPvyBy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:BZMiz+/S4By8f5/v1bvUHOjmkF
TLSH
T1A91502A9B3A018F5EC67823ECD668916D1B27C1A0670CA1F07E436671F337611D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 766df782027f21e60b8d211a0a6a065707eae522e971dc46db660cbc614cc450
MD5 783a250794443b554cb77ef6e8f672e4
SHA1 698414fe37f468af570d539a609a268a87e2bdc9
SHA512 03080aa9cea4cd3590870b750dce2d3aae5af135cbcff9e4121bcede2c2aa098f3cb3be3eeaac8a60b6bc0c37ebf6e06bd14667279908d237bd060b9b5710ffd
SSDEEP 12288:0ky23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:0ky8f5/v1bvUHOjmkF
TLSH
T1B2D423ACACB05183DD58A33DFDD257A88028031EA0390EDFDB5472E52A27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 0c55827aad1b2937f197afb5ea308270fa1c7b4f2c29fbd88effc61487f0228d
MD5 1cd5b615948752362ca54adb6551241e
SHA1 4cf35328d54900df93f576579dc4e7191101ae0d
SHA512 9ead5ea0fb6adf669486de8bfb4c5851a9b4ab4b6c1e5e886db2f533c57e7849a26900c596273741c72ae539f4fb4ff3bae74437281138896fd4e8201067af1f
SSDEEP 12288:qFy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:qFy8f5/v1bvUHOjmkF
TLSH
T178D42399ACB15583DD58B33DFDD256A84028430EA03E0EDFEF5472E12A27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 88b85afb7198578f8a0bdf44d4f86cbafc589eaa3d3d4caa075da1aa2fd37007
MD5 0cb0d8ced5f99f1afbb9773cabd2c300
SHA1 c133213eaaaef4f2cfe02fbc9cfa5a21b2ff1a7d
SHA512 d2fdf53097bc74ce4d51bbc5f1a2fd1a78a507d71dbfabd6619fa1168dc6e349cdd3aac58678480e18718a08bfdc4584507b9a0e9bc6fa5cf54c2def38a97693
SSDEEP 12288:iWPS5L8Uy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:zSyUy8f5/v1bvUHOjmkF
TLSH
T1A6F4125B76B130F9D4769238CCE21A11F371743647348EAF57A013B62F23AA56E2EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 e37caa5b4892a79a1f671d89bb5eaddd14b4be6342eabe9d3652fa59cb2fd70d
MD5 8e5dd449d8bd4e75227b777a7e87eae4
SHA1 40a656445a953dcb0e66e1511ee75c97e7fb60e8
SHA512 d3451825d892474fc475e9985e2101c65b4fb0db1fe357b0576d7f889d4a764a9b790008a2f85e471ce6258ef015ebea1608d2985184b04c6afa21f4d57de550
SSDEEP 12288:4vy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:4vy8f5/v1bvUHOjmkF
TLSH
T1C8D423ADA8B15183DD58A33DFDD217A88028071AB07D0EDFDB4472E52E27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 859255f0729cc1ffbe2fe1b0e750886bdae9dc79bf27c5be0dfef1e3f3e78e96
MD5 d9a473fbc3ce382eb37bcaa67a4028c1
SHA1 01c22083999ce38a6dc26d35f551c4d333e5f50d
SHA512 2432524959d944eee7a746d54a1348a29d10ce4cc0794fef812c3a1723fba4b1b01db69699b85310defb1fc03c5d2f3e50481965462850a75227911a86e317c6
SSDEEP 12288:8vy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:8vy8f5/v1bvUHOjmkF
TLSH
T1E9D423ADA8B15183DD58A33DFDD25BA84028031EA03D0EDFDB4472E12A27D6E6B1D5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 04bfbe342236e6c5aa27a6776175ccfc0a8c098e02748fed7802efc51c26a042
MD5 e6daadc6f5390319d570cb3d55f3c2fa
SHA1 347d2084b9cb96a7c38ec7989fd301f449561f9b
SHA512 8fc92e467b19f7f425bcb200ea62fae4d497287e808be7228305e67c5fa5763a94e2fb717a7197ecc8d923288f7284110793d776f5e663939aa9a6954122dc9b
SSDEEP 12288:bWPS5L8Ty23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:CSyTy8f5/v1bvUHOjmkF
TLSH
T13CF4125B76B130F9D4769238CCA21A11F371743617348EAF57A013B62F23AA59E3EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 ff50abfb032f686a00c96a41bf3b463d289002d190f73caee33ad683efc51484
MD5 407ae933f683d191e06a5bb935708424
SHA1 44d8afd01de99f929ce574ed50e32a34f6140a69
SHA512 5d95f2d2e2867b52f041a9de244e17b014452b9edafcf4c3c39c761cc32c65f6cee793ba90433af648ddb64d7135f8f73c2fda7dcf283a684ea06bdf22ba3e6a
SSDEEP 12288:hCd9mcadaLSK3z0zC4PDvhpy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQm1:cT+aLL3z0z9py8f5/v1bvUHOjmkF
TLSH
T1B01502A8B3A018F5EC67823ECD568916D1B27C1A0674CA1F07E436A71F337611D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 323bb36159780e74649f322171c7419d3207d8fa54739a12ea045835f63c9934
MD5 87f6843b1aba9a3a96c6c16bd93cac57
SHA1 ad21ba2ab5e9c05e8211f1563414258d7a735b34
SHA512 348b04aac3751ecd8f43ba1dfcde9db1e8186eb97f80a910c1b2687c940b37b5791ff3fc680466d281c0c55261406531967a3ba5b80156bfd157cbf181d9fc17
SSDEEP 12288:/i4e7ZMdBfgwCHTy7bLbbdIvNyy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJh:/3LdHCHTy7bZBy8f5/v1bvUHOjmkF
TLSH
T1E135CE90F3E410E9F0B79A39C9765511D9B67C5A1B31CE8F03A4265A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 9ee8eab28fc6a78830424adbe5c60fefce8555c2355a71ddaafc990133e07a06
MD5 1b98bb2a8f7d18dd1584c95e0b4c3f2b
SHA1 71e36c6f64b5724b2bfa27c24890ecb6cf6b0d99
SHA512 b75c7bcb0697826539ee4859f8281301aa4cbff4ca66c384f9649d6f6f961dc991bcaa34471b5b19d502ec392c318e3514a489bd609108300eab22f80fe1aee7
SSDEEP 12288:Q5y23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:Q5y8f5/v1bvUHOjmkF
TLSH
T1BED423ACACB15183DD58B37DFDD25BA84028021AA1390EDFDB5472E12E27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 1b98c027071190aa9bf0694bdc9bc811fd62450c09179a01b5f960999e9f4c1b
MD5 997de5e14b7f5497f83f3741eaafc65b
SHA1 f8cfda7ce2df34e1a166dfcb6433dd9f165b541d
SHA512 8bb587206fd2c4721b1e863b4bba6643f458ab6d6c1d7c351d6615b528b2c43b4a0742e404ab55fb5b357175002e44fed5060b0c286226bd0169c70187134f88
SSDEEP 12288:2/Ay23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:OAy8f5/v1bvUHOjmkF
TLSH
T1E6D423ACACB15193DC58F37DFDD25B648028031AA07D0EDFEB5072E12A27D6E6A1958C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 e07a47e0d5676d212d9f05e29d65904f0020a8a8d3b499465ba488e3b69108ca
MD5 6c955322e0f2cf1e3d195d3c040b69fa
SHA1 23077066953d54523c47b24bb7e8fe543f920b00
SHA512 5be3220cf53703dfcbae8da5d2981a1c195a2587d90bef41d3ee7a5c4c05d7e0f860c3866dc09acdd8251cb37efed33ead1339f3cb0eec7160f93a6bce3dbddb
SSDEEP 12288:hJ0Ny23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:hJ0Ny8f5/v1bvUHOjmkF
TLSH
T194D4239DACB15083DD58A33DFDD25BA88028031AA17D0EDFDB4472E12E27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 c18157f66b133555742857fd2c41db8bb56d1d99574d57e7579aa6a3bc1f0acd
MD5 66cfac91f9a2da0e88c868ded1d0a29d
SHA1 da5ea614ccdf252a7a9cbea8d75ca894cbf5f8b7
SHA512 7fa53045e35f11d51a339610ba6bb47b6242fc9692bd585f9ff7a5b3e1b51fc3e7226e576a3314b4218dea99efa7246f9eaf89503ff9f225b640011c68350614
SSDEEP 12288:KT0Ny23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:KT0Ny8f5/v1bvUHOjmkF
TLSH
T182D423ADA8B15183DD58A33DFDD25BA84028031EA13D0EDFDB5472E12E27D6E6B1D48C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 7150e4282471b8d2d78e6ee17139418c0be75a0998b9333613e5cbd8442ec38a
MD5 ff6b828e8d95ebd6c1b0670147b28e68
SHA1 b3b412b46b10b0c9ec46fa862d7bc59122ec43bc
SHA512 c10a6e823b031699fd185110fca5084a4b3e9c8e108c2a7a34f17b182db61690ba1170297dd3ffeee23acb023289b0a2f7dffb0c6674ed4f9954e3e5eb46e498
SSDEEP 12288:JOsf/ey23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:H/ey8f5/v1bvUHOjmkF
TLSH
T1D1F40159D1A402D9C46EA239CB924A40B3333C2592F197CF57C0F57E1F37A986EE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 525e359c0457551335de1d245263610126f4fad54745e2f07d297c666b2b7d17
MD5 02aa21d1433f9af8a5b35f50fcd9d57b
SHA1 9d508c092cff762488f98d623895656888e47953
SHA512 093013cebb6f5b5c9ec03787ced1468e2c80289750c033d7c666466a4fcbaff734b7c2dad726b23bdf12f0a8a8c8a593774a5325ddfc06f269c5b30ffae7b58e
SSDEEP 12288:B/75y23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:l5y8f5/v1bvUHOjmkF
TLSH
T1E5D423A998B05443ECB8B33CFCD65634502D631957384DDFEA0072E52A37DAEAF2994C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c0a7c45a0eb4bc1213e2a982cc9ea2a255dcb81c69eb9fb2c64896f132d9d9a1
MD5 7fc7ec8a39b2bb33101864883deeec8f
SHA1 dbf43b459b4e36588fbb00534db08355f5969299
SHA512 52ea61c25fae35f8393aed5700169c9312b879c6ac7601b00d2898378c805b2b628cf45f87ff766b487c2b0f966af995e1354e511cb11a4fb2cd88f535bfbd8a
SSDEEP 24576:Hgb6bmBIi49WNNFpg1rSvFv7bYXy8f5/v1bvUHOjmkF:Hgb4mBIBhGFEX5/tbiCmm
TLSH
T17565AE1E22E802F5E0F9E2B8DDAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 489619d7585f337aa815f608c18d8c2ef5aef723c89cac48f26d149e9691d961
MD5 bf809ce8e08fe002f1131f758cbda75f
SHA1 3a0c1efc39abc206e9a58c505bc9aa3c01ef10a2
SHA512 e90f20497e79aa6a7a0e4181dfe8e031a149a4fbb19d2b594c7cafa3c1227820b3ae834023622df9a873d3f7e9d1b9d4b8e79b9a2dd208cfd149bcab357919ed
SSDEEP 12288:M7GQy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:aGQy8f5/v1bvUHOjmkF
TLSH
T1D9E4126C68F13095CC79E33DE8E256667070322457281AEF89D0A2B55F27DE97B3DC88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f571e0f50206c411b7db187b8bbce10e6a585b86625dba5da0a4979c419cd1d8
MD5 b6108d760bc123421aca2f6c93b0431a
SHA1 037f0ed12a7a2345a4c21114815b7489bff58ba1
SHA512 0178f1505f8d962b5bd6be171c8a29a21a7ac9bfbb3776a3359b2e810ef779a985ac1634a2fa9c5f235a2fb6ba4024ccb15326a2b12286bdd7e45c40990b0fd6
SSDEEP 12288:lny23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:lny8f5/v1bvUHOjmkF
TLSH
T1BBD423AC68B05183DD68B33DFCD35A645028521963390EDFE95072E21A67DEE6F3D88C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e96a37c8db083e8949ce2da867ec28035f92063388a571edf8e75e7345a6da41
MD5 c77e0f461e7ed73783c6c57d8707f5ea
SHA1 34c0a7057d68f475696e71c9500706696c5f21dd
SHA512 49302b2e1dcfbe3ae42455087b9d22bf1e65bca610faf65070342135d9a06012fb977663d8689a6eba2498af125a52c32716a98ae498cc303563211661940568
SSDEEP 24576:0pm878FpJqH1Mzria7/m/y8f5/v1bvUHOjmkF:MloFPqVra7/QX5/tbiCmm
TLSH
T16935F16576E101F1D47BE138C9824663F6B2B4251364EFDF0BA88B951F23AE54B3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 2b141b4a3e704198716942c4e09d31a9fc0474ace148d87e698deddf7c325aa7
MD5 ba253f25c577d2ce8263a1150e564229
SHA1 511ed24d99b8a68f62094c53ef6fd28f3108d0fb
SHA512 2228dceaac6851f0c3e12698cc904f6b3c43b0cca6663a313c31b400a66250bf402679bf11e558fd62a56e704de77ed6974462802f97d360eefc1d8e3964d7f7
SSDEEP 12288:OHvUrBFrEjwaQry23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:OPUr+NQry8f5/v1bvUHOjmkF
TLSH
T17705F12F65E818E5E67AE17DC9828719E2717462131296CF02E0817E1F27EECBD3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 bdf5e868b8e8abc207c45dec5d77d3adeb95851338c2ab8c0677a023e4297602
MD5 1f1b0075cfd839039d23f6112337b4c4
SHA1 1b8aa7d8b3662f528631166aab581845bd972e32
SHA512 4cfd03d7e32faf0b75a2b4133cae72a5e3c6dc397a287e414aa3258f6847526bddf29c7f70d3665db7a37b75a76b919047af447233e3d7ec929764538c11eab6
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuX5/tbiCmm:cG05lO43bjX5/tbiCmm
TLSH
T1D9D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23415033556CF02A486A91F27FF46A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 3180b3a13db7d179550ab95a53319c3d131e031af28086a379f32b3548914a01
MD5 9cebb9871695129f5259c884c415a00a
SHA1 efc02579ec73f449954ab396abdd90c350f56018
SHA512 d9ddccc174d71966c887dfd5508aee75a01e0984602ff48f285bf300fad72b7882fe0b9d28465147690c64fe887777891caa3a9e07421e77b601975021fd391d
SSDEEP 24576:L4a5POZ3dpbWVM50JicR2hG0lasx2+47eidnky8f5/v1bvUHOjmkF:Ea5POZ3wJt2pasx2+mOX5/tbiCmm
TLSH
T1AA65BF5EA6F800D5D5B9D17DC583861AF5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ded7c4a092befbb60744e795fe6d6c9f183a5b77e35b4c10a5c7aba3c1d32909
MD5 1695dfee6e29082572119434b259d10b
SHA1 8c2d14e38b9db174c37bba187931d33a90d5cb02
SHA512 436277401b7441ea1ebe3dee31b7b30cd1fc508f344196e05704a2af065739968cdd91a206bfa54647cc0992ee695afab6e4c612b16fefde4bcdad7797407212
SSDEEP 24576:4NcwHdjbyQ4nLC18lb/EOjowL7Fk5y8f5/v1bvUHOjmkF:4Nc/zEOVHFCX5/tbiCmm
TLSH
T1AB858C2622E901E4F5BBE1BE89779546FA71786513348ACF0291811F1E73BF85C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 ce404bd31c40e5f65bee37ca36702e826dc08bd4564609093be06def90ed8b5a
MD5 580d1f32c2a4c350334e2d4cca3b9ba9
SHA1 5887d8d1a12658349e05694f8b50cadaf7f4e76b
SHA512 b2b96f056eec78d1c49a93e10a82f71eb5e0bebd368c113fb272d77edee00cfc6a7dfdb6f439b6ffc0bd092c1da684c948628183120a076d97e10136ed2bc5ee
SSDEEP 12288:+DHPJnJP6szeCs6Rl28dNEy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmY0:0JnJPbzB4SNEy8f5/v1bvUHOjmkF
TLSH
T1A715E03DD2A810E9D4B7C2B4815A1B59FE31347D2B2669CB59B4D5343F13EE0AA39F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 82211bf000fc0367e22796ee9ca57f7223873e7edc8b06f3fa3aa430b86aac61
MD5 23320d228430e0c3671fb9849e38e2b0
SHA1 8196b18913f96507495912eb12b42c1f3ad66068
SHA512 78fd08cfb1a010204c4d705c6354141db72e71984b05563dd3a5b1cf4a14d3e72f8790623c0603dbc32e2e1eb971e6fa4236dd4b94eb6482005108a689329266
SSDEEP 24576:WCLHGL0MoeVtFumTijCmlKQWDkdy8f5/v1bvUHOjmkF:WCLHGeeV5ijCmlDWDkdX5/tbiCmm
TLSH
T11DA56B05A7EB4184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 b812e68939b01c16bdb3849982255b18788a15da5b5a418e2a9a94fcfd6f030f
MD5 21fcaab2b8f620767f9f432c173781e6
SHA1 57f7c1ef27b04233504c6d572f56048c32635d80
SHA512 38faab2cff2a8f0f370ed5fa8360ed91eb8fa247fa780e3fcca2a011bfa2a746fc2b2bcaee1e61e71f97f806baf88ea4b7e78b2baa1d40666479fbff3ba9ed06
SSDEEP 12288:K1Hck6j5ZI76y23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:26DIOy8f5/v1bvUHOjmkF
TLSH
T1C7F4015C22B610F6D06BE13ED6C30611D1B2B17583261ADF4A94D5BA5FA3EDCBA3CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 f34ebab47299e9b6c68fa21c22b8049510b49b8ed71481a49cc2562066fd816a
MD5 0e895f6331f0cdd0c9ff05b2d676a74e
SHA1 4de354f7148722ddf8dbef6b5f3300cf50db10e1
SHA512 aa6840ff094fc76a9cf02c3254aa6603da3cb3022a180d0b10c8fc12e22400f16057ae795e8c2cd33566926c5542389da5059d57202bd1e879ece214b2335b90
SSDEEP 12288:wG6kyey23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:htyey8f5/v1bvUHOjmkF
TLSH
T17DF4124862A060C1E9B9533CEDE342A489347C2457254BDF9690F67E2F37FE9AD34B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 c8d4061e8a62786fc585bb8085a8fbd6b7fd4a5c2f95da5b35844c04efda0b08
MD5 7bb7bc50fc6db08bf0d3675884d813e0
SHA1 d1d8f69f45a71d23cfac5f294c4e824f6b77b9dd
SHA512 7dc9baab29fc0225bfc82b852c13ea3759ff264a479254f815fbc3f261d9f2eac99d9b0ae1923ba632cc918d1fcd9945b203cb1dd39139ff4248fa7812411243
SSDEEP 12288:Q8Dy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:nDy8f5/v1bvUHOjmkF
TLSH
T195D423AC64706182DC68B33DE8D2576540342229573A0EEFE9D0B2F15F27DEE6E39D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 e234775220b423008e6462520ced6a267af50decdf3eab5ba2c98966841c8739
MD5 804a9bc02e2330419cbd1585565cbf5c
SHA1 aed018e05478651e4a550f41bd8611d0fa0e7cfe
SHA512 14954f40eca0f7fc53401e262374a006a08348db4a4af7b355bb1e32f47c8c3c90518e3a6e47d490cf7183882f21844db96462a5d84c2dd2e0cba03e49ae912b
SSDEEP 12288:f6g7uZyFDK3tT5Tr7aVLIH9lH3caYy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBt:f6g7LoTfaidZrYy8f5/v1bvUHOjmkF
TLSH
T126558C1DA7EA05CAE2B2D239D8621493D633B4315772C6DF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 9029d3568c05a34464283f4cc53a690a754d9855f9875cc7913fa1b5c463a5aa
MD5 a05e7a164b394fe883eea13880edae87
SHA1 7994bb66fbf9cc9f2fda4a561145aac8d3942158
SHA512 e32bf8693dff6d340d56a1cad0a5117eb1a9ba1a52e4a2bc0a24512572f36e56b309404be056b3afe61c700d1caba365bdc4e576fae851a3fef3b8b865bcf86d
SSDEEP 12288:5pJcm8CNXy23VH9ZU8CDqNp598oi9ivD3unfnG03BwBuYJTQmYkAQvF:5rcmRXy8f5/v1bvUHOjmkF
TLSH
T1F005F15EB6BA00A6D5B7D23CC8824655E2737030632257DF46A0C7BE4E679ED7E38B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d40d5860a540a06a161d41b58af09d83b89d7ae1464e94fbae7e782706b3bb9e
MD5 c944130f95aca008a30ee3e40ce34ee2
SHA1 022a367abd04acb66cd206f2d41946bba86bcb40
SHA512 5063ed5a90707d98dfff50f75da5624944edf7a7c29e8629d54e5fb22d563c349b1e14d9a9836aec3381913b81eb86d0910dba1023c29f02ad0317890e3e068a
SSDEEP 49152:TDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS37X5/tbiCmm:I3Upow8sBmX5/tbiCmm
TLSH
T1A9A58C3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C5B8BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-34-0x000001AF26850000-0x000001AF268EB000-memory.dmp

Download

memory/240-37-0x000001AF26A10000-0x000001AF26A76000-memory.dmp

Download

memory/240-36-0x000001AF26A10000-0x000001AF26A76000-memory.dmp

Download

memory/240-35-0x000001AF26A10000-0x000001AF26A76000-memory.dmp

Download

memory/1100-373-0x00007FF720750000-0x00007FF7207FD000-memory.dmp

Download

memory/1100-290-0x00007FF720750000-0x00007FF7207FD000-memory.dmp

Download

memory/1100-291-0x0000025A727B0000-0x0000025A72816000-memory.dmp

Download

memory/1100-292-0x0000025A727B0000-0x0000025A72816000-memory.dmp

Download

memory/1424-366-0x000001F23F2B0000-0x000001F23F316000-memory.dmp

Download

memory/1424-372-0x00007FF788FC0000-0x00007FF7894C6000-memory.dmp

Download

memory/1424-368-0x000001F23F2B0000-0x000001F23F316000-memory.dmp

Download

memory/1424-446-0x00007FF788FC0000-0x00007FF7894C6000-memory.dmp

Download

memory/1724-44-0x00000235EB800000-0x00000235EB866000-memory.dmp

Download

memory/1724-50-0x00000235EB800000-0x00000235EB866000-memory.dmp

Download

memory/1724-45-0x00000235EB800000-0x00000235EB866000-memory.dmp

Download

memory/1724-43-0x00007FF701190000-0x00007FF7012F7000-memory.dmp

Download

memory/1724-52-0x00007FF701190000-0x00007FF7012F7000-memory.dmp

Download

memory/1832-388-0x00007FF6C0CE0000-0x00007FF6C101E000-memory.dmp

Download

memory/1832-390-0x0000010B34DF0000-0x0000010B34E56000-memory.dmp

Download

memory/1832-389-0x0000010B34DF0000-0x0000010B34E56000-memory.dmp

Download

memory/2008-233-0x00000201900C0000-0x0000020190126000-memory.dmp

Download

memory/2008-234-0x00000201900C0000-0x0000020190126000-memory.dmp

Download

memory/2008-232-0x00007FF7FE540000-0x00007FF7FE608000-memory.dmp

Download

memory/2008-309-0x00007FF7FE540000-0x00007FF7FE608000-memory.dmp

Download

memory/2024-337-0x00007FF70A2A0000-0x00007FF70A3E9000-memory.dmp

Download

memory/2024-260-0x000001C242A40000-0x000001C242AA6000-memory.dmp

Download

memory/2024-261-0x000001C242A40000-0x000001C242AA6000-memory.dmp

Download

memory/2024-258-0x00007FF70A2A0000-0x00007FF70A3E9000-memory.dmp

Download

memory/2904-322-0x00000214368E0000-0x0000021436946000-memory.dmp

Download

memory/2904-321-0x00000214368E0000-0x0000021436946000-memory.dmp

Download

memory/2904-319-0x00007FF779790000-0x00007FF779A32000-memory.dmp

Download

memory/2904-439-0x00007FF779790000-0x00007FF779A32000-memory.dmp

Download

memory/3172-283-0x00007FF604710000-0x00007FF604E53000-memory.dmp

Download

memory/3172-282-0x000001FD43350000-0x000001FD433B6000-memory.dmp

Download

memory/3172-284-0x000001FD43350000-0x000001FD433B6000-memory.dmp

Download

memory/3172-367-0x00007FF604710000-0x00007FF604E53000-memory.dmp

Download

memory/3212-57-0x0000019BF4360000-0x0000019BF43C6000-memory.dmp

Download

memory/3212-56-0x0000019BF4360000-0x0000019BF43C6000-memory.dmp

Download

memory/3212-55-0x0000019BF4140000-0x0000019BF41DB000-memory.dmp

Download

memory/3344-1-0x000001C8E3E40000-0x000001C8E3EA6000-memory.dmp

Download

memory/3344-3-0x000001C8E3E40000-0x000001C8E3EA6000-memory.dmp

Download

memory/3344-2-0x000001C8E3E40000-0x000001C8E3EA6000-memory.dmp

Download

memory/3344-19-0x000001C8E3E40000-0x000001C8E3EA6000-memory.dmp

Download

memory/3344-22-0x00007FF74E460000-0x00007FF74E62A000-memory.dmp

Download

memory/3344-0-0x00007FF74E460000-0x00007FF74E62A000-memory.dmp

Download

memory/3420-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3420-349-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3420-276-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/3420-271-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/3820-363-0x00007FF66A650000-0x00007FF66AB20000-memory.dmp

Download

memory/3820-445-0x00007FF66A650000-0x00007FF66AB20000-memory.dmp

Download

memory/3820-359-0x00000220CE850000-0x00000220CE8B6000-memory.dmp

Download

memory/3820-358-0x00000220CE850000-0x00000220CE8B6000-memory.dmp

Download

memory/3852-25-0x000001F59A120000-0x000001F59A1BB000-memory.dmp

Download

memory/3852-27-0x000001F59A300000-0x000001F59A366000-memory.dmp

Download

memory/3852-28-0x000001F59A300000-0x000001F59A366000-memory.dmp

Download

memory/3852-26-0x000001F59A300000-0x000001F59A366000-memory.dmp

Download

memory/4284-243-0x000001AE79C80000-0x000001AE79CE6000-memory.dmp

Download

memory/4284-242-0x000001AE79C80000-0x000001AE79CE6000-memory.dmp

Download

memory/4284-241-0x00007FF7FE540000-0x00007FF7FE608000-memory.dmp

Download

memory/4284-318-0x00007FF7FE540000-0x00007FF7FE608000-memory.dmp

Download

memory/4472-338-0x00007FF623F60000-0x00007FF624280000-memory.dmp

Download

memory/4472-346-0x00007FF623F60000-0x00007FF624280000-memory.dmp

Download

memory/4472-344-0x00000295ABBB0000-0x00000295ABC16000-memory.dmp

Download

memory/4472-340-0x00000295ABBB0000-0x00000295ABC16000-memory.dmp

Download

memory/4472-339-0x00000295ABBB0000-0x00000295ABC16000-memory.dmp

Download

memory/4728-310-0x00007FF78CD90000-0x00007FF78CE43000-memory.dmp

Download

memory/4728-387-0x00007FF78CD90000-0x00007FF78CE43000-memory.dmp

Download

memory/4728-311-0x0000015565BF0000-0x0000015565C56000-memory.dmp

Download

memory/4728-312-0x0000015565BF0000-0x0000015565C56000-memory.dmp

Download

memory/4928-442-0x00007FF6B14C0000-0x00007FF6B18D6000-memory.dmp

Download

memory/4928-440-0x000002C6A4CA0000-0x000002C6A4D06000-memory.dmp

Download

memory/4928-384-0x00007FF6B14C0000-0x00007FF6B18D6000-memory.dmp

Download

memory/4928-299-0x00007FF6B14C0000-0x00007FF6B18D6000-memory.dmp

Download

memory/4928-300-0x000002C6A4CA0000-0x000002C6A4D06000-memory.dmp

Download

memory/4928-301-0x000002C6A4CA0000-0x000002C6A4D06000-memory.dmp

Download

memory/5260-13-0x000001BB0D750000-0x000001BB0D7B6000-memory.dmp

Download

memory/5260-61-0x00007FF7273B0000-0x00007FF7274D2000-memory.dmp

Download

memory/5260-11-0x00007FF7273B0000-0x00007FF7274D2000-memory.dmp

Download

memory/5260-12-0x000001BB0D750000-0x000001BB0D7B6000-memory.dmp

Download

memory/5260-14-0x000001BB0D750000-0x000001BB0D7B6000-memory.dmp

Download

memory/5276-444-0x00007FF7BF620000-0x00007FF7BF8AA000-memory.dmp

Download

memory/5276-352-0x00000227D5300000-0x00000227D5366000-memory.dmp

Download

memory/5276-350-0x00007FF7BF620000-0x00007FF7BF8AA000-memory.dmp

Download

memory/5276-351-0x00000227D5300000-0x00000227D5366000-memory.dmp

Download

memory/5696-443-0x00007FF7C7EF0000-0x00007FF7C8084000-memory.dmp

Download

memory/5696-331-0x000002558EF30000-0x000002558EF96000-memory.dmp

Download

memory/5696-330-0x000002558EF30000-0x000002558EF96000-memory.dmp

Download

memory/5696-329-0x00007FF7C7EF0000-0x00007FF7C8084000-memory.dmp

Download

memory/5720-379-0x00000253A0440000-0x00000253A04A6000-memory.dmp

Download

memory/5720-378-0x00000253A0440000-0x00000253A04A6000-memory.dmp

Download

memory/5720-377-0x00007FF6FAAF0000-0x00007FF6FAC1E000-memory.dmp

Download

memory/5720-447-0x00007FF6FAAF0000-0x00007FF6FAC1E000-memory.dmp

Download

memory/5860-249-0x00007FF7BF560000-0x00007FF7BF679000-memory.dmp

Download

memory/5860-251-0x00000227B99A0000-0x00000227B9A06000-memory.dmp

Download

memory/5860-250-0x00000227B99A0000-0x00000227B9A06000-memory.dmp

Download

memory/5860-328-0x00007FF7BF560000-0x00007FF7BF679000-memory.dmp

Download