44254570114f92d2e101de295dea9b6597f05a1d860ef40999b3c1fc07679e6c

Analysis

max time kernel
144s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Size 969KB
Sample260731-d2x27sca75
SHA256 44254570114f92d2e101de295dea9b6597f05a1d860ef40999b3c1fc07679e6c
MD5 122688c12d07426b7e863e0948a0acfd
SHA1 b66d33cb25d830f682d08ffcde9ae1caa316bef6
SHA512 2fff9bcd7e11b51ce6738bbf8e68aca75f6e978e7f23dc68c133c45b1556ab5c8317768a393996a9286431119c1089455888b02544bfa77c5f4a5a62e0f3a0bf
SSDEEP 24576:gH06fzJ+RXOpayI7qWwfMaCGRdd3aEHX:Ity+paZtGRddKEHX
TLSH
T1E225F12AF76118F8FD2AE17CCEA68512D972F4150360DADF139496262F732D05A3FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2500	alg.exe
1404	elevation_service.exe
2920	elevation_service.exe
4236	maintenanceservice.exe
4720	OSE.EXE
4292	GameInputSvc.exe
4668	GameInputSvc.exe
3864	msdtc.exe
5224	PerceptionSimulationService.exe
1560	perfhost.exe
3848	ReFsDedupSvc.exe
2336	locator.exe
1040	SensorDataService.exe
1324	snmptrap.exe
1564	ssh-agent.exe
4652	TieringEngineService.exe
2704	AgentService.exe
2100	vds.exe
1116	vssvc.exe
2932	wbengine.exe
2692	WmiApSrv.exe
2684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56a24e8383806d8d.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4668	GameInputSvc.exe
4668	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5320	2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
Token: SeDebugPrivilege	2500	alg.exe
Token: SeDebugPrivilege	2500	alg.exe
Token: SeTakeOwnershipPrivilege	1404	elevation_service.exe
Token: SeTcbPrivilege	4292	GameInputSvc.exe
Token: SeBackupPrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3848	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3848	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4652	TieringEngineService.exe
Token: SeManageVolumePrivilege	4652	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2704	AgentService.exe
Token: SeBackupPrivilege	1116	vssvc.exe
Token: SeRestorePrivilege	1116	vssvc.exe
Token: SeAuditPrivilege	1116	vssvc.exe
Token: SeBackupPrivilege	2932	wbengine.exe
Token: SeRestorePrivilege	2932	wbengine.exe
Token: SeSecurityPrivilege	2932	wbengine.exe
Token: 33	2684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4668	4292	GameInputSvc.exe	97
PID 2684 wrote to memory of 5828	2684	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_122688c12d07426b7e863e0948a0acfd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5320

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2920

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3440

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3848

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1040

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1564

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2692

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 674f3a6be18975a4fba2938413bbec523730b2d88367d023cc70e2a438ad9fa8
MD5 2278e25f6e0b74c0b338d01d72129adb
SHA1 2781b9f4b2c34cb0017e733a84877ed88a3c0324
SHA512 832140bc00fa16bd2f54e9c31bb87cfb67b4a0b275075dae1a2d59a9407947883597b2033ef4e7827ed38156e03484adbde5448a0842a310b63d9e6e601e5b09
SSDEEP 49152:Lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnypaZtGRddKEHX:Z3q6gjBbgtsx
TLSH
T193D59D03F29900E9E069D178D7469133E9A2BC890B34B6DF0790B6562F7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 0e77f1f9feac6e777201a0e522acc3cd13c5a55009549b54d1289d9789a82a22
MD5 464dc5d371c21cdc29433851ffc8c7c2
SHA1 bcd75f88ab25d7fc5c9ae6d0f5f49f9b7ed9a9be
SHA512 4de75afd3cc10c6b9cd29752d59f5da596c6bc7cf5bd5a1592c51c92c1bc997cc9b799fcfb54daf3defcc21b51d8d32a0bc282f73080b36040f4edd234dda63b
SSDEEP 24576:iXY6DtczADOpayI7qWwfMaCGRdd3aEHX:mtchpaZtGRddKEHX
TLSH
T18F050229A7E504F9EEA7917DCDE28501DA73B84143A0EB8F03E499654F233D45E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e17c41865ea7ab2dd39a27b45d36b3996bcfe0068c4e6c0c0284f969068a67fc
MD5 bce91adb5c57fbc96daffa6dd2ff816e
SHA1 99b4117e56d0affad1fd70c8330c30d45ac077ea
SHA512 1d19937220de3e1d0968c50ada477f9c1516889e8608bd6e0501382c4d2cf5dc5ad1efc350109d3439317df1e1f42aa4ba4d0f38ad8af87d25443aa0b5b6b590
SSDEEP 24576:k03el1T0fFxOrMxROpayI7qWwfMaCGRdd3aEHX:kX1T0doZpaZtGRddKEHX
TLSH
T124459D26F6748375D073C0B9C5D2A68EE972308257308ACB4286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0d992a6b94a2cd554a7fced2493b686d3a6e367dabef211aff89f749c75209f2
MD5 6358c4d7e229c3f209cf799a769d9bb3
SHA1 fc1a8ed190eac58875ec93c2f46f09f86a8a594c
SHA512 630d0eb5ab9d05c8dd456e06054dae00f5f775809a9b93d33a93821e455f5cf6e36da0ace97d66b66e2a16f8527eb43aa5dacdb04a468edeb2c0a933d5ddfe2b
SSDEEP 24576:8L6/ezSC6vUyD/aqgrvW/6q8wyuxOpayI7qWwfMaCGRdd3aEHX:P/ezSC6vUzPvuHjytpaZtGRddKEHX
TLSH
T1F6755C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 06a784a3b89132c5b0771903e6d4c9384b4481414faf3fb159009330560b1b68
MD5 668394d20bd6f7cb025342459a95277b
SHA1 5c6c8151f13cb0ca178fca25c9edd8b177d69003
SHA512 3613e066e253f10545fa73aefb15b6819f61f7e20ed5c65a68a897f069f4df8624e4bbceade10bc01f74925d9bbe3df9995f32b63e5cfa5ed24dd46b8a31c28c
SSDEEP 24576:+AbjPsv8pv/l+dZbOpayI7qWwfMaCGRdd3aEHX:+Acv8pXl++paZtGRddKEHX
TLSH
T1F1559E66F5748331D073C0BAC5D3AA9AEE7230424B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 a113038415193b1970bb93f0e4c4b0949e74eea87f8110203f0922f848f676c3
MD5 7a0d0a251209512f570dd01897833606
SHA1 082cec1ffb3938107545215c203656b75e3ada65
SHA512 31e82b72f1405068504342427ada3b08ab67c53581dd13318267a2708176ef786f27ec9de2d67606d0d496f14967a240132cde8e7ef80d8605a1685338badb7a
SSDEEP 12288:AKBOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:AKBOpayI7qWwfMaCGRdd3aEHX
TLSH
T180D42383CE3620E2E7F876F6BFEE454A49F8F80242944D8A1690BAD5C7763D3D106643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 42ca61a17c1147187c151ed288843367817cf0f49df978681972ea659defba02
MD5 e1bedf1af217b4dfc535519ff6e0dd28
SHA1 a23c275b2cf40fd25b1c15f0d0065250f94a16fb
SHA512 3de735ff7d0459b5d776d6a7967c39425ceddc7b1237ed9256db9dbe35ef227d37963b68b988cd2c51d0ededa3fa5988a6aadfcb62d52938b0e94588bc36b5b7
SSDEEP 12288:DeBNUbTVO86UHOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:DJIUHOpayI7qWwfMaCGRdd3aEHX
TLSH
T11115DF3BEE28FCE2C27E9DB95B918200D7B274314B6193CBD164824EDE235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 faf340f12fbc5fa0cbedc7c7ec307f38c94723997bbbcd094d95b2d9b97d1e39
MD5 0d998602812e2310e3324c22c7169234
SHA1 759ad96ee5b03505edc446e41efa14a91cbce928
SHA512 1faabf557abdaf46c271caae1ec4981fc3648ec9152f5ffdee7f119c406c0202f694f649427d5cb244fbdafee75cb4a0bd29960e3a9fbcfa2097637f09efae8b
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5JoNRV3THx:nQvGAdlCEL8c/WRNE5Cygtsx
TLSH
T1C7367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 0613beb8330614ac2badb5e93376de80839ff02f13f931c3956cddcb39c3745d
MD5 ab70079ed32a524802e8e279b5411054
SHA1 fa085ac9ab06af4a7cfa0b3dbb81e02a76eea61d
SHA512 b71104f238e02811af89681b97c9e97410dbf1d53f3fbcff71a4d056f295bc1ae61114fe152c52d29d98cc5c307ae611ae60eabffb1c7e183b3f672a7c77f2d8
SSDEEP 12288:lLwSfxL/2Dc3bDLLmt0LDQewsAjOhOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd9:tmewsAjOhOpayI7qWwfMaCGRdd3aEHX
TLSH
T1D615E031FE75E036C3BB0DB62B66C716187CB9204B9119C3E3E89E9D59702D26336A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0209970d4f09ad87aca9dcb21a170babda6266032c760c3a538786c8081ee7fa
MD5 abe95f3a087a7058d671a0667d56dd85
SHA1 f385c18b063ddcba9c0f2805e68b75c5c666e3e3
SHA512 736b795612c2489f0aa84adee1b39622347da5f8c1f872ee0ca776de3ec3a7b99bca91211241d9e72b805551df84647f9ffed2dbadd2654d9bf0de8bb63d975d
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrQdPlbuJHM:BUEtQevvqc2W1cpV2Xr02M
TLSH
T1FB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6be0a87d6f362d9cc95111822531b72d204629867f4c0d6a5f28e034855dcade
MD5 56f7c2cb1a39ed69de3bbe6419dfe0ad
SHA1 0323142ed21a000e62437e583e4635e473202e3c
SHA512 fda93df82447531695356063ee6456812a2a4637afa55816c2abf8afbd7cc565a4c6d51ead09ffe2606726dc8048dd7b356cab481dfe88f5808522ba53068506
SSDEEP 49152:SpbRquA/m2yL5zMfFiV+XenmE3/z4TpaZtGRddKEHX:aoq1Vjnmhgtsx
TLSH
T11CD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4456e3b2da17015534f336b5b70c0eacedd4d4894785b266839e06c1dbe1abe9
MD5 6306b0e4ad0be615c9b78fcedeb68346
SHA1 2e978da2cad5839af3e6eeabcf891bb004f134ab
SHA512 09e51f61c3e76fc89e60db52e208e3962df4510232527aa67f1733e2b7b89da95873914352fef8b62ee80528b983583ee5820e61f06e6057e28491526f5d852f
SSDEEP 24576:RAhGLvvFoiwtA5l7S53sOpayI7qWwfMaCGRdd3aEHX:RAMrFoiq5jpaZtGRddKEHX
TLSH
T17F459E81EBF951D4F5F3AAB899B68171EA76BCA65E31C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 0643603f8e30fb58d48a2ba5b9b981b1d610daf59de24ebe779a17e6e34f1497
MD5 b438d63e7eb534bb1fa8ce17661f6d69
SHA1 af501161de08f05cf66df1806dc7e23481c1a158
SHA512 ea5548880b034d814fcd8c4cd219acece1d4ad6bcff228b9b02cfa4183eae9c28446e2a3f178e37f1f9ce6f7e32fe8d95b0c45909145ade72146825d1cab0060
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CYOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBE3:uwuuOWjOpayI7qWwfMaCGRdd3aEHX
TLSH
T1D005024677A51CF9EAB65279C697C136E7F2B8022621CB0F1360C65B5F33361AD2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 10c7cba62cd6b3372fedd2efbdb80a0cc36cd48be0e02402285782cb0ddaa158
MD5 b4aa89371b342301643fc19db16af1e5
SHA1 29894466541e58b13f69b24ebaf79fb9b056841b
SHA512 a38ec54b01bc2a9a677d3390476efe0a04483e58c205f1a80f96d5c08e8a9e0bf348829b9f3cf9c7cde91be6c1a75cf339a76855cdc1d9f1d6e6383d067b988f
SSDEEP 12288:icC1IkbmOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:VCuUmOpayI7qWwfMaCGRdd3aEHX
TLSH
T12DE412872BA520F6E3E562B9DFEA4646C7B1B013137147CF1260469A5F237C29D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0ff90f97900c8c7f137f6c67d2dd96baacb3d348b0bd12dccef7dcca521ace45
MD5 f9478ae31ca0dee2edf260a7d1449d6e
SHA1 66f4ab91670e01abb1b3d0839edc7cf77256a878
SHA512 4375a6a4b034a801c1a5a8e5e4b3f2336969d30707e02c729f88f164bd82a38011619ec0b2610957e87c4ad9f9728c4aa7bed896c492c75aef81a13336a25e0c
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U2:qQRQyi36YOcP8Lvw2gAf+PN3kgtsx
TLSH
T1FF667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7b3640c03af5c6aa1d080c5bc9511a411827ae7e0f48883b97955b86ced3ea6f
MD5 a46711fd1165a9d45ab22ce048cfe7cb
SHA1 95c019b9d92d1a0d6ce6896b3f1eefe220952c34
SHA512 c1c7970ae02585276e145f28734c974ce60e248bc03b47fb1ea7f2b34701e2f4ba499bcd79fbdc5e546e3d3434052314dd2f05c07c57ed0d569e754c2ce19c2a
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UQ:qQRQyi36YOcP8Lvw2gAf+PN3ugtsx
TLSH
T101667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 595e9bea59bfcb1fa4694e253551f4813b2292b0fa9b769cd07219bfd0491039
MD5 c885f1f62140ab1bdd26055ac85fbf29
SHA1 eab2b3d5f2105e55f9806324b981acbbc1ffa0e7
SHA512 eefd7126aa36a9ae282a4db72cc44ff170114a3f206e51119b61e416632ccb8de88cac90754aacab85443cf2f585801a80e1c0ea9f113b48b620d9f35c1170a9
SSDEEP 49152:E68Qg55nhMeWu7PNU3/0paZtGRddKEHX:uthbRc/0gtsx
TLSH
T131B55A33B2F600A9C44DE1769F4A872196E17C718FE0E7DB855172061BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1d4095057b0daaecd0548f47e9b4025c7e3d3d2c8fde2fd2c08d67a616e71687
MD5 15016c0c5fb97bc0bf6ace69f06fa262
SHA1 87c3ab2334aeeba9c926d3832da96ae213561b53
SHA512 9826010e2f00d37ee0d93a59ddffa2b8a895bfde6965cd9dfc103346d452693581389a5b1452b2a4291f745156b84196dd03df26fcf9568f0517fddf4c3798de
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99V:ny5112gYy5azzVv569nLKnhZqgtsx
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 418f73736c6ba279103659f83f46271b468951e3681a27255f71ee46c8678919
MD5 9e3943fc369b7d7c70447392affe1054
SHA1 0859d618016f526c67ee450c97360030468cdb5b
SHA512 fb5843407cddb4944c7ff3fe94e247500d1951c064109a11e92e0fb0983475d87753b6702699084b5b8b6304d04fa5a3bba4bd66a999b24407b9577269061c3b
SSDEEP 49152:eB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6paZtGRddKEHX:Mu6JmTxd2d6gtsx
TLSH
T1CAD59D13F1DA01E8D06DD478974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ab261eca0d2a4b9223b4bf9a36cc01ac5a31e59585ea7f8baef0a5fb3c0a5d09
MD5 7b1c4ac503eddeb2b4c854be9ed79709
SHA1 ef9456a074a6c1ea4ddb9fa8ba54deb511d698f0
SHA512 9b7c8307ef8c7423cbb0a060434de65025af6ca7579cc7018fd2835e4c1b3055ceddc0d7fb47a3d9c17fb55faf3ea3a6096e383a18af1c38c10c5d379489ddf9
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xPpaZtGRddKEHX:SmifPbRkgtsx
TLSH
T156B5BE13F29900E8D06DD178875A9232EA72BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f9320f1cc54302d8e5b37217ec45acfab9943df534490af7d4bb45d1d3c68511
MD5 af747dd2ae3733c3f723dc8a6bb049a9
SHA1 597c69fbd32c36d2b050766bd48e54388503a7a2
SHA512 9d6c796f1f16f378fef91ffbebbcf7eb33c3283c37af6ea01a4d80ca51f61f4f54f22d61178af6c687a2dcf858e52a94761d36f0aaef09d387fc0e113ea69fa9
SSDEEP 49152:QSuZQIY0Be2K6RVtOnks6NMHqhpaZtGRddKEHX:K5dKoi61hgtsx
TLSH
T168C5BF03F2E940E8E0BEE67487669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 20d0e8920ec64de943c1dffe117e06bb9f79dd705889b1d4359fc913f8150a93
MD5 d318b44ce6701143dc8ae213ed466804
SHA1 0899c131008bd9ffa1bcb592bf27c0137d6b93aa
SHA512 3c5b0f43d3c46ab6fcb6663f378acb3eab1f89c38b45ed411690873d2c722186703e72cb439a9c2ab5666e17f4e4046df439a7f25c7a566a26c44d416b764cb0
SSDEEP 49152:4htSn8EApI0figTgiDn0AP5wqpaZtGRddKEHX:pX2iyphtgtsx
TLSH
T158A5BE13F2D900E8D06DD1B8C7568632E962BC160B35AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 52a30dbf8993609cb9be79ec3b8fc88ef4f29130e280e58e86a98ffc5accd62e
MD5 0afa4e30527bc6991e08e845a9e55e62
SHA1 7bfa75bfdf0b30a763e625f8373cefbc64f53dbd
SHA512 f40a38a3c1e5190810b1790b660c7c13f5927f898f7b645e817822e49e0d8a77ec62123b60da626fbb9a3691cf335f3a8d0d5f2b2c89726dcc2b1d49adc5aa88
SSDEEP 12288:FwOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:FwOpayI7qWwfMaCGRdd3aEHX
TLSH
T119D42383CD3721E6E7E872F6FFEE428A49FCF4034291498A379495D59B623D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 e40900f0adac5ead5c2e8ad91395ee89a69480cd84b9932c96640ef1e08c2de8
MD5 184cdd8127527bd45447af4e56befd8b
SHA1 a5bf58d122a0b2873a62fad17524e91dac8c1f26
SHA512 afe05d96b5b85417108bd60c042833ca7b15b655c0c66417a2e5667d4925c489d4a0da58098d668e3bbb0a29a22c4f9394895df8aa18eb6cc8b4a41381826e20
SSDEEP 12288:bUOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:bUOpayI7qWwfMaCGRdd3aEHX
TLSH
T128D42383CD3711E6E7E872F6BFEE428A49F8F4034291498B379595D6CB623D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 d1dbdc55f3effd339488f05e1ce92653690a18c52ef339d9fc0b223e350038b7
MD5 5f1e740a2ab6b59288c173b7d136a136
SHA1 4922364c9e1e918aca9894b21d9768689095af63
SHA512 97bd4b5b492a3cf57beb9617cb8774e3c353dc9907e1e87577f58bbad8ae18c3e0276f8b0eeecef9a7104032da0b229478005fc82be71a6351eb263a8f0b3a18
SSDEEP 12288:Z4XOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:Z4XOpayI7qWwfMaCGRdd3aEHX
TLSH
T167D42383CD3B11E6E7E872F6EFEE428A48FCF4034291498A379595D5DBA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 04cfe7a07e0b2540886c4e6133a24acce71ab8fc16f407e45df607454c2b827a
MD5 8c0e8da84da3c703a226d636b5066e80
SHA1 024ec45d47cc297c8c670c798778fc980b35aae5
SHA512 b9dc8587efacdd28c6427b30c534bfb4ca661324724edcf0aefcbd18ad3780a6d7e449e400b54f63901480634d5ec955c6a16365f238a812109ccfa030a73e07
SSDEEP 12288:HlasOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:7OpayI7qWwfMaCGRdd3aEHX
TLSH
T18FD423439E7B10E2E7F8B2FAEFEA414AC6F8F44242715A8F675059C64F723929501F42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 96a4c111c353f7bdc091656688bc649656e2b8717cbca42a4c3032674bbd4094
MD5 639e36a187531697c9632a366e82554e
SHA1 4d12af374e8ea39d289f39f08780a562c1f89a69
SHA512 7cc92b7ca4a03491489fbef4482d0f336ebeb7979b34286469ec1a587f2fbcbdfe72137bf511ba8cdd513fcd61f8f8e880e1edca131c382bbab36b510f9c8650
SSDEEP 12288:4JrOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:4BOpayI7qWwfMaCGRdd3aEHX
TLSH
T117D42383CD3B20E6E7E871F6FFEE428A89F8B4034291498F379595D58B623939106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 6b62c8a05f99a8aa526223a755680e17a328a53e8cd4991e5c77cf9e0fcc4b03
MD5 c0ba88ff85aca645e04e481645259de9
SHA1 8e8497a938c364798590489348ebd226e17c4e5d
SHA512 758bbf40f610a85855dc60ea6260a1db48354dc67f60357f8f6fa9525dfcda4d4418f484dbedef358e2bb8c42e912039196938549f27d03e4e124fbf321d5e3c
SSDEEP 12288:rWOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:rWOpayI7qWwfMaCGRdd3aEHX
TLSH
T1C0D42383CD3B21E6E7E871F6EFEE428A49F8B4034291598F379595C5C7A23D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 7aadc30aa8e3226ecbfd68e8be7bd3118fdc32c7c877d08948b533a772686c11
MD5 7a7a3cfe9143d453c0640e8383b84de5
SHA1 1ad2d884959bed27ab4fdad26807d15301bf8358
SHA512 306b9eccd8b8d3b6a8c5f3cd49a3dc29316d13ece5acdba951f0aed5fe7fe4fac347e5d42ab817c788ea7d5831b18c4cac5d436670c7890993bd7cacec661f3b
SSDEEP 12288:y8OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:y8OpayI7qWwfMaCGRdd3aEHX
TLSH
T13ED42383CD3721E6E7E871F6EFEE428949FCB4034291498F379599C5D7A23A39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 74b1a321a79b7af3b13e4b835527a8cbb59662810ff18aa2f1f90fcec5be803c
MD5 0699f110292267e9e5acadb251976fdf
SHA1 9915530378a6f76485009b00519d438d5dd26546
SHA512 3986b09d2a0a1bed966fe8d492dd5b8990ec1ee651832281af3cc30206acffe25cb176f93ab724f3a8f537bc9500c2ee94a2f69bca3aa959e7011e724bfe6d2c
SSDEEP 24576:RZMszBBSB4OpayI7qWwfMaCGRdd3aEHX:RZMszHIpaZtGRddKEHX
TLSH
T135150195B36118F4EDA6817ECE668906C6F2BC160770CA0F13E436675F333A15C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 6763e055bec0218b49d843076ef0cba482324921d5c70a0fd82f0ae68ac135d2
MD5 8641dca857c05d2372cf35aa28fa0c61
SHA1 ec1f432ccb3e3b3f579e409c79e4deb9bb35cca2
SHA512 64800c47f224ae2e2164889085aabda2630cfb4a2eab59e3ab3fcc67583f0e4f2976c0fbb2ae278ce8de56b21e096284fb526c0156251ec259e38ca8cc265155
SSDEEP 12288:LwOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:LwOpayI7qWwfMaCGRdd3aEHX
TLSH
T19BD42383CD3B21E6E7E872F6FBEE428A49FCF0034291598A379595D5CB623D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 3a17c98eb090f6e2fda9f042512672eaaab10de5b4c79c6d0088631b4db92d20
MD5 2f8809fafd396de972a5db2648d42241
SHA1 c755e99999b8762b0684e709d1ba97b87cafe8ed
SHA512 8be492ad75abf691e7a0c36570c2377a1dddea5cb89a695403513fa4d9ca50384868b4edbb2706bc2f869c0b325c310521ce4119eafb404be26ab03cf1d5807a
SSDEEP 12288:5JxjOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:5JxjOpayI7qWwfMaCGRdd3aEHX
TLSH
T1FAD42383CD3710E6E7E871F6EBEE418A49FCF4034291498F379495D69B623E39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 0d1b6a860fb8072d7f7d3921ddaf5fed84f4ad6aceea53b08cdbf288c73fcd1d
MD5 e74b481e0a23a272b26f7c0ab6174b05
SHA1 39c63ed3e4f5abe0cb64ac766227923e70530d79
SHA512 4160972a22bc199a40babb7969836b4bae55d12b9b1b747ff06ea9f8d91075296a954d1515701e4acf57bc8a18ffb4e32c44f5817391ee83e9b71ae750334a98
SSDEEP 12288:dEPwDL8dBOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:mw0dBOpayI7qWwfMaCGRdd3aEHX
TLSH
T10FF41247677630F9D2B59279CEE60A06E7B5B43303608E5F13A047B65F233919D2BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 d206747d0761805f54b3c37890c884a67e44c0f596dd05f20bcfc2aa0dc9dbf6
MD5 0f777a5124090bb69fa8bbf808846b1d
SHA1 06c3ab32f47abdf05044985d7e6c8c28ebca28d4
SHA512 9f2e9781473f15b78b8aff13ed3ca853b8287b75d53837f2008d7cf5991e65869599d77df787e8c0cc79a6e190de0a03a58bb846b06cca14899788861f41c31d
SSDEEP 12288:Tl5OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:Tl5OpayI7qWwfMaCGRdd3aEHX
TLSH
T192D42383CD3720E6E7E872F7EBEE428989FCF4034291498B679595D5CB623D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 1a32fe1b9a5849f6b990fbc2d9cd82b454347b12dc2823922200db56103f8273
MD5 66ca80201ef079d46e53cfbffa84684b
SHA1 4a9ff9cb7bff178c6d79b1c54ff8ac0379b4e54c
SHA512 2eae81c3a57cb7d52ab547a8f5a973e16407da285dae3c370745e7a35304af124c2f1971d54d986c3b6665928fb6e40735c8ee28120265274984b915b6c5a7c4
SSDEEP 12288:TEvOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:TEvOpayI7qWwfMaCGRdd3aEHX
TLSH
T18ED42383CD3B20E6E7E872F6EFEE428948FCF0034295598B379595D58BA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 e9a7eba6ddd6d092430c5b3fec5a128c94f7b321007a13b08d860a888ce40182
MD5 53cccb4da72be1202fae4683201e026f
SHA1 47dbead34227700fde1f4ccb03f88f797ecb8bfa
SHA512 3d201084813b3085444cfaf62f8c3aa0feb8fd9ec72a4f0f2efbcf7cde3f97c6faeb48e4af25dec006e976d374397614defb02f3a7d648b566420d48bcbe45e4
SSDEEP 12288:4EPwDL8M61OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:7w0M8OpayI7qWwfMaCGRdd3aEHX
TLSH
T117F41247677630F9D2B59279CEE60A06E7B5B43303608E9F13A047B65F233919D2BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 5a7daffc28a18d468cfd5a33bba97e7e854f9f103a31430c8fa48639a4217afb
MD5 629a82eebd134877a5cea48b6a969c96
SHA1 ed4eec70bc794ba5110df3df9a9554526cf55752
SHA512 d8504f20b5272f09ccd7c5b32610d6e73103f771b8aefaf89a9d2f5da9e4a820367faf92fbbc91e8adb7ffb873e4cb03125c612ea3c8566168bf1494b07e95b4
SSDEEP 24576:sTIaLy3z0z9yQOpayI7qWwfMaCGRdd3aEHX:sT/LyjrpaZtGRddKEHX
TLSH
T121150195B36018F8EDA6917ECE668906C6F2BC160670CA0F13E436675F333A15C2EF56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 8a10bd2402661e333ba43048bb62716e8ae5e5a87ac31ea385e725476d53e854
MD5 89054b51cb20fd8129e8a7263358a90d
SHA1 1ff8b6a6a64046d2ad03cea51bfca1de7bb2fd02
SHA512 b66cf5c812fa3fe9251f85d12a226f3dcd8a1c37fbc703ffb0ec5b20b93223faabc29b8d3fb541df9c169a1f5a3c9559ce6f023f91f9f323abf33a1653a60a3e
SSDEEP 24576:s3+dVCHdy7eZdZBOpayI7qWwfMaCGRdd3aEHX:W+dVCHdyKZUpaZtGRddKEHX
TLSH
T1C335CE91F3E410E8F1B79A7589B64502CAB67C5A1B71CE8F03A4265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 a029f08426391fcbf7b7f76d4a187fd5160ec65d9fda630c611feb0fb9f573c8
MD5 0a50354fc3950735335feac22ae49342
SHA1 a177bf259074306ce3b39ab2ff5facd5eaca337f
SHA512 9fbe9aee1e2f748613de4fb8c7c4e23551552f4ef7201581405ebb07f36c8d17301840dd863cef3941abe4962d146c4f7266d2cc951cebb9f1418b64a38acc4d
SSDEEP 12288:XCTOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:XCTOpayI7qWwfMaCGRdd3aEHX
TLSH
T120D42383CD3B21E6E7E871F6FBEE428989FCB0034295498B379595D5C7623E39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 2af5f4f3bae28580fb2f469cb435bda549412f9b920611d35f68d69c44978041
MD5 03e8db28a3a6648fa2bd06144280c0c7
SHA1 87e7e63f5da6d2e383f8ff33053e9f549c4e7e87
SHA512 9d7fc3243c7e9a414ca3598ede55d471a1d4cb00e008b08e7b39c47f7139afc8f17d2b75615bb69d833eb60e12cf7030f52074bdf710561afcfa2eeb90dd9da4
SSDEEP 12288:74BOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:74BOpayI7qWwfMaCGRdd3aEHX
TLSH
T198D42383CD3B20E6E7E871F7BFEE428949F8B4034291498B379595D5CBA63D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 c9fd7a10f2f1eea1896e36982e3b1de09b91f109eeb24ef0a02e7acd8ae6d4b4
MD5 1551ea93affd5845282ea3e90fd62ade
SHA1 d6b8009e576e90075b853db97b634e2c2d6b1048
SHA512 fecbd7464c8ff7f7999a030735d8281aa80f1d76473eab601facfc0d042094bbe87319f77f486d8b21f1e1727d2e12fa212b07325e356bde9abdb391c0f0d6fa
SSDEEP 12288:KpQOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:KpQOpayI7qWwfMaCGRdd3aEHX
TLSH
T1A8D42383CD3B20E6E7E871F6EFEE428A49F8F4034291498B379595D5CBA23D39106943
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 d028828ffae12a8df2ddc52c2c72bb5306e7af867abb514103d33e25367e6ced
MD5 787f110bc63b05b86850ae2d06af01da
SHA1 5cab642d6ca73975f5f3d67154e5d181d2bb427a
SHA512 611c0668fc40ec864b34ae5a0bdcf3ed5c75ea83bcce64e73d9cc84cd0e029518e4aef9d4a7954b8a9a114acd3956a13d7355bc2c16c85af5c867e420b205092
SSDEEP 12288:ZlpOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:ZlpOpayI7qWwfMaCGRdd3aEHX
TLSH
T148D42383CD3B20E6E7E871F7AFEE428949FCF4034295498B279599D5CB623D39106A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 1d785dd2af4ebece21c7803dfb92248b5b2456b1ee7ced267d71de6c7ec5da5e
MD5 7573f6655c4b39aa98df683a17b0ee79
SHA1 e52c90d2b5f99e0f6b78a11c0fd0d20e0ce7893d
SHA512 c207d89a1a9e876be145b71ef8fec3357c7742a3ce73669674b0fd5004ca1d0290952f753d1bb1b1c168dbcff65196e3c75a27e4cedf312cdba714ee49cd3232
SSDEEP 12288:lzsfCOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:8COpayI7qWwfMaCGRdd3aEHX
TLSH
T10BF4014AC66811E8C2AD627ACB9A4641B7777C1283E1D3CB13D0F57E0F762919DDAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 e2a86a090f08d34a5a7aec698f2979456b18c5689ffa736b163d1b0a2a9aa0d7
MD5 e788f111e2d1cd883d74433ea4bd0987
SHA1 c1857474645b7fbbf1d51797230c0e3742e49a2b
SHA512 bddd2ca5677bbab4be703f54813754b058ad64265e38083f60ab5c1c6150f573686bba84620477cdedcbf116391051aee18e126dca7f0d0ce96c50eb5530d7a3
SSDEEP 12288:RC7cOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:kcOpayI7qWwfMaCGRdd3aEHX
TLSH
T101D42353CF2A20E6F7F872F5ABEE821945BDF013439089CB7644A5C59B723D2D912A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 76d72e34978e8a554520505bd9e3000832ffc26e7aa5e930847446b30cb8d863
MD5 129ef881df40634e7ad7b8e2f6efd4b1
SHA1 16d74753cacb8808a7831b13a68e2acdcd68486f
SHA512 066cb5a3e8955f8330a777a1ccd7880ad55fbd22ca21cb7e0481a2487ca0f0d4c0af5b976159dc34c5612091d58f51dac0561f668c7e1e92bd674d26df838aed
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYXOpayI7qWwfMaCGRdd3aEHX:Ygb4mBIBhGFXpaZtGRddKEHX
TLSH
T1A265AF1E22EC02F5E1F9E2B8DDAA4417D6B278160331D6CF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 464ea9ce74e55c6a6642183fd8172fae4d4a5478d35288a41538a083b47d1d93
MD5 b96b18d55a5edb9899c4321db1a81dbc
SHA1 365d29948a133401cd8bbb4e799e5803dce78182
SHA512 f43d0f5dd578ed10f0130656e37398e5665c22754f26e0a99a5aad1fa251fc06fb94834338607caa54b22c37519697bbe065c67e8275635de6a0e658ab31c079
SSDEEP 12288:fKGhOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:SGhOpayI7qWwfMaCGRdd3aEHX
TLSH
T1C2E4235B99B730E5D7F8A2BAEBFA415768F0B012431019DF06D0E5B5CF623E1A239D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 ea0afce079dbdcd3b3c4f832f56ef7f1f757e2f22d910a94f4eff16547185b17
MD5 51b4d5abad6b50f333a30c426b687cf4
SHA1 094bb9ea862f20e1e935c28e2d8583b2d097ae86
SHA512 ff2e8f6bbe7791b33939a31efc2934f0f727fc5be781e973a050f624470e1988c9fc6bedd27184eeba4a6b7af727fbb8c3589b429e83af5908bace2c66243f27
SSDEEP 12288:M+OpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:M+OpayI7qWwfMaCGRdd3aEHX
TLSH
T1CCD423838E3B20E6E7F875FAABEF454549F8F003439149CB2294A5D6C7663D39136A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fe0a94bcc79ac3d297893f8e4bc2434465271c1c9cf37dd7f41c0c0c8241f9f0
MD5 c6504286fe68e84b0e08a6e559cd55ac
SHA1 31926e1e911d48ef719b6006de4994ad77b8f92f
SHA512 07ce41ad0f8c4139c7d58d6e8e7cd2d543c434f84b0a413e8ddd9d45cdd32d67032f1973f99b17b633aee6d83e4297e87050956d923df95cbf3ba2e79489bee7
SSDEEP 24576:9wp8x8FpJqH1Mzria7/mAOpayI7qWwfMaCGRdd3aEHX:aO6FPqVra7/+paZtGRddKEHX
TLSH
T19135F166A7E101F1D5BBE1388A864663E6B1B4110364EFDF07A88B551F237E14B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 9f0873c1415af0d4e4588a7dde63948ca1172b22d24bb4ceed05ba39311a9190
MD5 dc43d466b8eff4774980ce2208cd6cff
SHA1 506c47068ca4c62d7d933dca190007edb121c0a4
SHA512 736551d9646b1607824771b60172a7b70ff7cac37de2b23b735abb6cd71852f5054ec43c3e768281f60a5dce47896177781351e8b6baa6f41feb0f28e6ea72ae
SSDEEP 24576:DPUr+NQ0tQOpayI7qWwfMaCGRdd3aEHX:DJQopaZtGRddKEHX
TLSH
T12605F11F66AD18E5E7B9E17D8A868709E771B4520311D6CF02E0817E4F63AE4BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f3a82d3937e220dc04312c1f845ab60cf465c75623a84c21717553f4fea0c6e0
MD5 bcd1a2df8ba7ede5d6a8e2599b2dd328
SHA1 29abee9d086b0536c691d834e3e818be1812edfb
SHA512 ab3342a287f0cb96af06d9d26fd542256ece21dd143da10ed697bb3a96d4aca809501d5321c4033199b74649c2b00e7f6a3ca1cb8e29d5571749359811fa226d
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOLpaZtGRddKEHX:WG05lO43b3Lgtsx
TLSH
T19FD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23415033556CF02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 2d59e414ae6f5cbb2d19d32a395754f953c982d7bb1922d2807c0d9dda51e564
MD5 254e44bf9dc887c8c8fe7dfa83add124
SHA1 dd31b8602ab3f26821a64fb6bd45626152f8b85d
SHA512 e1c8a5c93bf2bbf06662916626b8dfe5b5d3084fc44429023b3d0c6a3a918da9374c2f68901fc90763d654e149abac8bca60e320c3ee5c04cc0b6eb691d7fc6d
SSDEEP 24576:zFa5POZ3dpbWVM50JicR2hG0lasx2+47eidn4OpayI7qWwfMaCGRdd3aEHX:pa5POZ3wJt2pasx2+mRpaZtGRddKEHX
TLSH
T19965BF5EA6FC01D5D2B9D17DC683461AE5B1342253319BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0fc39394ee1e949aeb8963ae1ddb96c78227a55f9581945eec079534cfff0ff5
MD5 42d3ca22949ec904b99d873ea3e3aa58
SHA1 7b98742845b39671b3e9290f00ef3e76ad07b0f2
SHA512 360586a9e6f2c2711ad2128e9278807d747d3a76c7e9d2f35fac2c1903b5c588d664fb42fb022cabfb5c49e1974be8c8a60f86fb92979ae8aba7364e50d03bf8
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fk9OpayI7qWwfMaCGRdd3aEHX:PNc/zEOVHFNpaZtGRddKEHX
TLSH
T18E858C1623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 d17c6db646363453942a741eb50750ddc00710fb3427309ff237960672138688
MD5 7952cd9c43566f6409ef4968a14d5f74
SHA1 f0eb70bbe99d7dec7b7a910bd613ee6b1964bb32
SHA512 3b5c6a8e104b8d80063763ca71c6d44ec645b51260be882d47c21fb989e83cdc320f04a3df2fdb9806ea286267875ebd26ea9ec33725a7ae850f35f35464ae97
SSDEEP 24576:IJnJPbzB4SbgOpayI7qWwfMaCGRdd3aEHX:IJnJv6SbHpaZtGRddKEHX
TLSH
T11615E03DC2A810E8E4F6C2B4825A175AFF71346D2B2169CB19B4D5353F12FE0A939F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6aeae8a687ad1c8f48fcb97a5c49a37b9628abf0d2d067935765baf8e431540b
MD5 2ed7bd998df62619caca914f7e07b2d2
SHA1 0de42093521bcc351fc0acdde399ba0ba4d7461e
SHA512 1fe896be4cf310daf3de1bc11ea764fdc51ed1eff7d95249eca7ac5efdcc7900bc2ebb5bf12982c37d52e6475fe3124e7a768b0daa095f75f2ee6f0dc98002b7
SSDEEP 24576:DCLHGL0MoeVtFumTijCmlKQWDkyOpayI7qWwfMaCGRdd3aEHX:DCLHGeeV5ijCmlDWDkdpaZtGRddKEHX
TLSH
T1EBA56B05E7EB5184F9F3CAF5CA2694168A327C509B34F7DF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 78b1ade1db0838db410276b28f3ab792e58e210075bbb1ff1e04bc8a21d5151c
MD5 dfc1c2d2163244531c0d5530fb48e3e4
SHA1 424629b1ce338c39e0d8bf1e6f341c258ab13b6e
SHA512 1881b7124f305499c4b60253f0a242f8b149eea86f2242ec911bc24522f222dea358969285fe0f4f7f40e42259ec4423b9a4dfdff713860a9cab3563aecc93d6
SSDEEP 12288:v1Hck6j5ZI7yOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:r6DIuOpayI7qWwfMaCGRdd3aEHX
TLSH
T13105015D677A10F5D2BAE07ED6C70102C1B2B061836259CF07D4C5BA8FA3ED9B939E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 90e3223cdcab509e3d91e53217907be8053ce92f2fcebe212950bb8e7c65361d
MD5 0a6c433674d8c092983faa87d9dbc25e
SHA1 b94005e0e6f247ebd27f72602adca454e5b4d3de
SHA512 aaca83fc9552c6c51f4d70495eb726b727201af3463b951e6d3b3f4f8e918967cabdc2a632ddd5027b24fa0aad5a93bc9cb697abb7e7fd9b6533bcdcd4b0de40
SSDEEP 12288:2G6kyAOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:ftyAOpayI7qWwfMaCGRdd3aEHX
TLSH
T1EDF41242976920E5E7F822B9AFF742958E78FC11476146CF22D0E67E5F323D1A931B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 84ddfdb4949b1bb3c160648f413ed4674eeed5696991e3f7e0b5cab441dd340b
MD5 ecd2d0795bc4082c50497ffa40ea2556
SHA1 aae7bf62c68a0839c5d1d78565d65991dc2a51c3
SHA512 9b9ee57f1743d9a9eb5a63319f5c11b45b58228306e8dffb746a8bc918460170d82f1b38be4a2dcb744ef19e252cace69213f38a51c521c2902b06c2569db60f
SSDEEP 12288:Ij8AOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:M8AOpayI7qWwfMaCGRdd3aEHX
TLSH
T1D6D423978E3A30E6D7E876FAABEE424645F8B012035149CF26D0D5F5CB663D29136E03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 f58fa9152efa1f156c3a9fb681b7bd967fc643f5aac4192ef82fcd15e3f35f55
MD5 f94af4666ac015c9f18aa65ef81780fc
SHA1 6767834910359651330ec7981a6acf78dddd013c
SHA512 6d887c18e7503c6a7e2f504bddcde07d36de88064b7300eec70e927a82af5a6657a738f4ea08e9d4a76e97e01cbb4b15dfa9268bc60b8a9d9704531963aa4265
SSDEEP 24576:LEgBLoTfaidZtOpayI7qWwfMaCGRdd3aEHX:ggGTrZApaZtGRddKEHX
TLSH
T13E559C1DA7EA05DAE2B2D279D9721493D633B4315372C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 ac25e1fb2620d6f4eb039e16a90cfcdafc6a2abc9d06c6539d43ac07d8855260
MD5 26c9de53dd0aa24d1ca36fe9e58810d7
SHA1 c71776e0b857e2d8a235d5d04cdc3ac3bb88241c
SHA512 98420e8595a4fce74cf3b3397ef80bd1e24a3b52f0d4cc448f3e63ec4e60fe0cae3d2e350f0ff0bf588dcff99713840e0e0a4e4de181a76dd4f2b99686f316dd
SSDEEP 12288:PpJcm8CNvOpagJNmT3GLuqWPMrZNfMi3osu+KGRPwcd3ATzBEJWgX:PrcmRvOpayI7qWwfMaCGRdd3aEHX
TLSH
T1D505F14FB66E00E6E2B6917CCE864146E6B3B031135257CF02A1C77E4E676EABD35B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8e7d87e57aeb531fb99c46352473b1c162c333ca8066cbd5f6dfd109d679f211
MD5 320894f39ed762c8782b78ee04ff5652
SHA1 9f37403c5944895d399f8449609788a8f5cd7d53
SHA512 febb3b31fcda53e125a0c7e42b95079b4d0b039020dcfb20f34b0b07263f2109421ab019c0a9305167ca4ab9627f1d0adce61e894cda9fb664b1bef71b6d9385
SSDEEP 49152:tDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3XpaZtGRddKEHX:O3Upow8sBggtsx
TLSH
T120A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-431-0x00007FF691380000-0x00007FF691797000-memory.dmp

Download

memory/1040-300-0x00007FF691380000-0x00007FF691797000-memory.dmp

Download

memory/1040-302-0x000001F64B420000-0x000001F64B486000-memory.dmp

Download

memory/1040-301-0x000001F64B420000-0x000001F64B486000-memory.dmp

Download

memory/1040-428-0x000001F64B420000-0x000001F64B486000-memory.dmp

Download

memory/1040-380-0x00007FF691380000-0x00007FF691797000-memory.dmp

Download

memory/1116-364-0x00007FF767CB0000-0x00007FF768181000-memory.dmp

Download

memory/1116-360-0x000001D4D8250000-0x000001D4D82B6000-memory.dmp

Download

memory/1116-446-0x00007FF767CB0000-0x00007FF768181000-memory.dmp

Download

memory/1116-359-0x000001D4D8250000-0x000001D4D82B6000-memory.dmp

Download

memory/1324-310-0x00007FF68B0E0000-0x00007FF68B194000-memory.dmp

Download

memory/1324-386-0x00007FF68B0E0000-0x00007FF68B194000-memory.dmp

Download

memory/1324-312-0x0000021877830000-0x0000021877896000-memory.dmp

Download

memory/1324-311-0x0000021877830000-0x0000021877896000-memory.dmp

Download

memory/1404-25-0x0000019C1D700000-0x0000019C1D80D000-memory.dmp

Download

memory/1404-29-0x0000019C1D810000-0x0000019C1D876000-memory.dmp

Download

memory/1404-27-0x0000019C1D810000-0x0000019C1D876000-memory.dmp

Download

memory/1404-26-0x0000019C1D810000-0x0000019C1D876000-memory.dmp

Download

memory/1560-358-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1560-277-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1560-272-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1560-271-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1564-321-0x00000185B8060000-0x00000185B80C6000-memory.dmp

Download

memory/1564-322-0x00000185B8060000-0x00000185B80C6000-memory.dmp

Download

memory/1564-320-0x00007FF7687D0000-0x00007FF768A73000-memory.dmp

Download

memory/1564-389-0x00007FF7687D0000-0x00007FF768A73000-memory.dmp

Download

memory/2100-445-0x00007FF6A85A0000-0x00007FF6A882B000-memory.dmp

Download

memory/2100-351-0x000001C446BB0000-0x000001C446C16000-memory.dmp

Download

memory/2100-352-0x000001C446BB0000-0x000001C446C16000-memory.dmp

Download

memory/2100-350-0x00007FF6A85A0000-0x00007FF6A882B000-memory.dmp

Download

memory/2336-376-0x00007FF7713F0000-0x00007FF77149E000-memory.dmp

Download

memory/2336-291-0x00007FF7713F0000-0x00007FF77149E000-memory.dmp

Download

memory/2336-292-0x000001A540B30000-0x000001A540B96000-memory.dmp

Download

memory/2336-293-0x000001A540B30000-0x000001A540B96000-memory.dmp

Download

memory/2500-14-0x0000020196660000-0x00000201966C6000-memory.dmp

Download

memory/2500-13-0x0000020196660000-0x00000201966C6000-memory.dmp

Download

memory/2500-61-0x00007FF792F10000-0x00007FF793033000-memory.dmp

Download

memory/2500-12-0x0000020196660000-0x00000201966C6000-memory.dmp

Download

memory/2500-11-0x00007FF792F10000-0x00007FF793033000-memory.dmp

Download

memory/2684-391-0x00007FF6026C0000-0x00007FF6029FF000-memory.dmp

Download

memory/2684-392-0x0000021B34B90000-0x0000021B34BF6000-memory.dmp

Download

memory/2684-449-0x00007FF6026C0000-0x00007FF6029FF000-memory.dmp

Download

memory/2684-390-0x0000021B34B90000-0x0000021B34BF6000-memory.dmp

Download

memory/2692-378-0x0000023A6B240000-0x0000023A6B2A6000-memory.dmp

Download

memory/2692-384-0x00007FF638FF0000-0x00007FF63911F000-memory.dmp

Download

memory/2692-379-0x0000023A6B240000-0x0000023A6B2A6000-memory.dmp

Download

memory/2692-448-0x00007FF638FF0000-0x00007FF63911F000-memory.dmp

Download

memory/2704-338-0x00007FF651330000-0x00007FF651651000-memory.dmp

Download

memory/2704-346-0x00007FF651330000-0x00007FF651651000-memory.dmp

Download

memory/2704-340-0x0000027736190000-0x00000277361F6000-memory.dmp

Download

memory/2704-339-0x0000027736190000-0x00000277361F6000-memory.dmp

Download

memory/2704-344-0x0000027736190000-0x00000277361F6000-memory.dmp

Download

memory/2920-35-0x0000028AD24C0000-0x0000028AD2526000-memory.dmp

Download

memory/2920-36-0x0000028AD24C0000-0x0000028AD2526000-memory.dmp

Download

memory/2920-34-0x0000028AD2290000-0x0000028AD239D000-memory.dmp

Download

memory/2920-37-0x0000028AD24C0000-0x0000028AD2526000-memory.dmp

Download

memory/2932-367-0x00007FF76BEA0000-0x00007FF76C3A7000-memory.dmp

Download

memory/2932-368-0x000001FFE2500000-0x000001FFE2566000-memory.dmp

Download

memory/2932-369-0x000001FFE2500000-0x000001FFE2566000-memory.dmp

Download

memory/2932-447-0x00007FF76BEA0000-0x00007FF76C3A7000-memory.dmp

Download

memory/3848-373-0x00007FF74AF80000-0x00007FF74B6C4000-memory.dmp

Download

memory/3848-289-0x00007FF74AF80000-0x00007FF74B6C4000-memory.dmp

Download

memory/3848-284-0x000001D0FB860000-0x000001D0FB8C6000-memory.dmp

Download

memory/3848-283-0x000001D0FB860000-0x000001D0FB8C6000-memory.dmp

Download

memory/3864-337-0x00007FF7BD870000-0x00007FF7BD98A000-memory.dmp

Download

memory/3864-251-0x00000199C2B10000-0x00000199C2B76000-memory.dmp

Download

memory/3864-247-0x00007FF7BD870000-0x00007FF7BD98A000-memory.dmp

Download

memory/3864-252-0x00000199C2B10000-0x00000199C2B76000-memory.dmp

Download

memory/4236-50-0x000001E122DB0000-0x000001E122E16000-memory.dmp

Download

memory/4236-52-0x00007FF74E870000-0x00007FF74E9D8000-memory.dmp

Download

memory/4236-43-0x00007FF74E870000-0x00007FF74E9D8000-memory.dmp

Download

memory/4236-44-0x000001E122DB0000-0x000001E122E16000-memory.dmp

Download

memory/4236-45-0x000001E122DB0000-0x000001E122E16000-memory.dmp

Download

memory/4292-319-0x00007FF71FCC0000-0x00007FF71FD89000-memory.dmp

Download

memory/4292-235-0x000002149DFE0000-0x000002149E046000-memory.dmp

Download

memory/4292-234-0x000002149DFE0000-0x000002149E046000-memory.dmp

Download

memory/4292-233-0x00007FF71FCC0000-0x00007FF71FD89000-memory.dmp

Download

memory/4652-408-0x00007FF7668F0000-0x00007FF766A85000-memory.dmp

Download

memory/4652-330-0x000001DD2DDD0000-0x000001DD2DE36000-memory.dmp

Download

memory/4652-329-0x00007FF7668F0000-0x00007FF766A85000-memory.dmp

Download

memory/4652-331-0x000001DD2DDD0000-0x000001DD2DE36000-memory.dmp

Download

memory/4668-242-0x00007FF71FCC0000-0x00007FF71FD89000-memory.dmp

Download

memory/4668-244-0x0000028D2FAB0000-0x0000028D2FB16000-memory.dmp

Download

memory/4668-246-0x0000028D2FAB0000-0x0000028D2FB16000-memory.dmp

Download

memory/4668-328-0x00007FF71FCC0000-0x00007FF71FD89000-memory.dmp

Download

memory/4720-55-0x000001E9BD110000-0x000001E9BD21D000-memory.dmp

Download

memory/4720-57-0x000001E9BD2F0000-0x000001E9BD356000-memory.dmp

Download

memory/4720-56-0x000001E9BD2F0000-0x000001E9BD356000-memory.dmp

Download

memory/5224-349-0x00007FF7118F0000-0x00007FF711A3A000-memory.dmp

Download

memory/5224-264-0x0000020BF7F70000-0x0000020BF7FD6000-memory.dmp

Download

memory/5224-265-0x0000020BF7F70000-0x0000020BF7FD6000-memory.dmp

Download

memory/5224-262-0x00007FF7118F0000-0x00007FF711A3A000-memory.dmp

Download

memory/5320-0-0x00007FF72ED60000-0x00007FF72EF2B000-memory.dmp

Download

memory/5320-19-0x0000024D9DEC0000-0x0000024D9DF26000-memory.dmp

Download

memory/5320-2-0x0000024D9DEC0000-0x0000024D9DF26000-memory.dmp

Download

memory/5320-22-0x00007FF72ED60000-0x00007FF72EF2B000-memory.dmp

Download

memory/5320-3-0x0000024D9DEC0000-0x0000024D9DF26000-memory.dmp

Download

memory/5320-1-0x0000024D9DEC0000-0x0000024D9DF26000-memory.dmp

Download