410fb383974bb261a088254ce9dc25932968a05572d3bdddf78122c1dacfdcfa

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe
Size 836KB
Sample260804-nrpyysyfra
SHA256 410fb383974bb261a088254ce9dc25932968a05572d3bdddf78122c1dacfdcfa
MD5 63bf8b40c43cd9bd8b319eeef0123b68
SHA1 9c2a554bdd54a847f83fae34b18df57d4a4fd6d3
SHA512 105a28438aca146e5749b9040a6769ddad68144ee81b3d5791ea6cb4708070a7ce24078f94fffa36fec6705f127d1b75f3b1c023dc86181885ebe233773c06ab
SSDEEP 12288:JNMC3npArW3RBiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtJ:JNn6ORBmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1E105F11A76E84CE9D95BC17C89868216E77278090731DBEF436042BB6F337E05E39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1972	alg.exe
6028	elevation_service.exe
3312	elevation_service.exe
5588	maintenanceservice.exe
5072	OSE.EXE
6020	GameInputSvc.exe
4420	GameInputSvc.exe
5484	msdtc.exe
1832	PerceptionSimulationService.exe
2260	perfhost.exe
2652	ReFsDedupSvc.exe
4772	locator.exe
5532	SensorDataService.exe
1324	snmptrap.exe
3448	ssh-agent.exe
1612	TieringEngineService.exe
4696	AgentService.exe
2128	vds.exe
2932	vssvc.exe
5844	wbengine.exe
3688	WmiApSrv.exe
4520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5348559683806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	GameInputSvc.exe
4420	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4216	2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1972	alg.exe
Token: SeDebugPrivilege	1972	alg.exe
Token: SeTakeOwnershipPrivilege	6028	elevation_service.exe
Token: SeTcbPrivilege	6020	GameInputSvc.exe
Token: SeBackupPrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2652	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2652	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1612	TieringEngineService.exe
Token: SeManageVolumePrivilege	1612	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4696	AgentService.exe
Token: SeBackupPrivilege	2932	vssvc.exe
Token: SeRestorePrivilege	2932	vssvc.exe
Token: SeAuditPrivilege	2932	vssvc.exe
Token: SeBackupPrivilege	5844	wbengine.exe
Token: SeRestorePrivilege	5844	wbengine.exe
Token: SeSecurityPrivilege	5844	wbengine.exe
Token: 33	4520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4520	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 4420	6020	GameInputSvc.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_63bf8b40c43cd9bd8b319eeef0123b68_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3312

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5108

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1832

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5532

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1324

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4696

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3688

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 07a64560baa8d74ec5563862e5792fd53afe30ae579a11b9d5de7f5d21da5789
MD5 e75ce14e2b9628e957d7070b4e85c07e
SHA1 015299fba366cc9040e828827ea856546e34802b
SHA512 9c91c543916ab054d7af81ce3bca89337041d2de0367bac1526b5059511e8fe205ee4d5a6a931b8ddee5ae320136d8b845264e4098a93950235c3d144a394a6f
SSDEEP 49152:fCv632BuPkFKRrdE6oh7stBhuXjfS4LWxnEsQsYYtvezi+mtgb1:/3q6gjBXsQZEvcZV1
TLSH
T193D58D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 eb3e0c74225a2a963ed017c7ccce0b1d82258a5387a6b79c8864025dddc38974
MD5 b6cd6e2fcdbb6af46a5d057603b15ff4
SHA1 e96e85803110c331ce247467fcdced9b2c650d2f
SHA512 3aceb19b96b2606b080b0c298b0288eb1d21a5818642f017665ffa99b45df0c83fa9cb01c229fa5216ca2721e017f0dde173c8a8566aad59b8db0a691cf73587
SSDEEP 24576:dXYHx/czA2mN2QsU/OBtvntszdQ+mtgfjH1:u/cysQsYYtvezi+mtgb1
TLSH
T12B050129B7E409F9EC9B813CC8A28516EA7378554760E79F03A09A754F333D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fa07b185b03abb59b804057137fbca7f867880935c558aefcc38d6a025e6c40f
MD5 4508e3570077568f825c909d6e702bee
SHA1 689119ece7b3284ceb3a22b536a482cc04e5be65
SHA512 e320b147f8dc2aaafdcf60ad3fa374ab0eefe90757d2a7af0ea31d54ff8ec3923e1f9a83c63579e23e3215eba5f61698247b4fa277322909ce81a2a3d53e335c
SSDEEP 24576:W0NeKkS0OoxOrM9mN2QsU/OBtvntszdQ+mtgfjH1:W6kS0TohsQsYYtvezi+mtgb1
TLSH
T1FD35AE26F5748331D073C0B9C5D2A69EED7230865B308ACB4286D77C6E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8115931817b62d3c09ca39f1d850f22b8e38e500d8c816771e4095c2717ec0bd
MD5 74df12376c2911001da3019df0d35086
SHA1 2db554430002f9f0d1ef94538edfe29797fdc886
SHA512 7af79cdee5683f4e4982a51e4760876f48c0fa77f33d4b77b44d57035ea829d9756e4b4881f43ae120594c4f40f9672bab38f0c78eb113bb525e54e1b45384f0
SSDEEP 49152:u/ezSC6vUzPvuHjytsQsYYtvezi+mtgb1:qezSC6v2XuHMsQZEvcZV1
TLSH
T12A756D15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 94b1b50da15c47b0542373fc374bf06a219a0492b98123b58203a595d6a70208
MD5 75c48b713ee20ef7867b16c8fb8affe6
SHA1 58f14d2a65c902b94d5c3c298978650cc108dc06
SHA512 0c993eddd2ee3246513032a441e146bca400b6adf3160571e528b753cbc7ce371cdf95dcb356b1b8cf4fa82540a989f7d0a5551151a7586e0abb2ef1e5181919
SSDEEP 24576:AabiPTjXhv/l+d5mN2QsU/OBtvntszdQ+mtgfjH1:Aa+jXhXl+2sQsYYtvezi+mtgb1
TLSH
T101559E66F5748331D073C0B9C5D2AA9AEE3234425B318ACB1246D76C2E677E6C73A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 9aa8ad503f0eefcb507a371da3d1de8f09d67d10434b03f99767ed9f3d42538a
MD5 914d4577345e7bb5fb95ecb5ab528344
SHA1 642cd882d3ca7cac7f1f4d81e15ad1e686e90759
SHA512 9ec12411837aa0f540926f74ad033638c3c9c0519d3961982571967ff3e7776da9b15c85e56e105b8f1d6d2f05ee84d678c21f1ba429d493b9b31a1eae2b3cca
SSDEEP 12288:OfDiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:OfDmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T146D4236ADC74A6C1E5CEE93435DD51BB8E7139144B050EBE8321FFE98C3B2B08A49746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 c0c8559d867fb0cea7ec6fae4a0b49a67003f49faabb6a0f71c0ca920e079983
MD5 faa758d2bb2da7737c978f75a071b216
SHA1 19e86a18bf0ae5bb1b6d44dabf4325c57da6101b
SHA512 e992e171092ed09c0ed41833904465209376902d350654c65f526174c65a6178855ac2df0ff459d38c980c3bbcabe9cb5f30676ffc806cf760a7b2e1424a104d
SSDEEP 12288:7eBNUbTVO86UgiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtJ:7JIUgmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1CB15BF3BED38FCD2C27E9DB85A918640D77278304B22A3DBD165834E9E235E04E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 6ba096f97754709c03f90cd0a959352094dda7b1ec86e7fbb33a4bc358b6b52f
MD5 7d7df0b0f5fe091dbd39328fe7449527
SHA1 5659b7d1f0688433018c321e6b763f9f14bd8430
SHA512 f86347dd3512833fe346795a1a629e97ee1067814fae0cd7b7c902c0abb1bafddc4a634b065bbe5914be8ab078645c413f2b0d6a05508e618cebcddd3eecbe7d
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJj9DN5J8NRV3THc:DQvGAdlCEL8c/jRNw5CRsQZEvcZV
TLSH
T19B367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 145ad4e2bf7d62562c164158d88db6273ecc4dbe7f4136dd7015011d0ed1734d
MD5 333ac8abcc5587c5d5dc147cc7326367
SHA1 31adc2558a838b095e33fd87592407d21ee1c2f7
SHA512 bec7b9798b032427e9d5591f740af5fbf5528573f0c110709d5245925e550c05dabe198dcd04cdc03bdea7f999bc1b6a951541d36c9467e811497523f38bf5ee
SSDEEP 24576:TmewsAj+mN2QsU/OBtvntszdQ+mtgfjH1:qljLsQsYYtvezi+mtgb1
TLSH
T1E315E031FE74E432C2BF0DB62B66C716587C79204B511AC3E3A89E9E49342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7d29368ed0e3f8a0e328ec2846bb76785baccbb509466cfde29e758c2d2a1c4e
MD5 dbcdbf22f89c4215dd793d306f037ee5
SHA1 aeec2cd1be81400524ef0d761abf41f5d630a759
SHA512 2c55de14ec91e3f3f981bc28ab610b522c592d0d3f9912a30833fc0d690ef2fc160c3954466255e273403fdf47e41a6da17b43869d8d9316f6a6e89473f81213
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX7ldPlbuJHPQZEvcZV:FUEtQevvqc2W1cpV2X732oZEw
TLSH
T1EF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 717f77c281a7a305a8f8f93b99d741af40899bf68e833a6632b2f7a2958dc302
MD5 3c569094ffe38cb59b1f6e00849268f8
SHA1 a4575cd6fb6b02a0ae67f9c7b610200922386f20
SHA512 0be8588348a87b4949898c7817e93190b198e2f0086948ef95549a821cc72fbdb8abcaa5d8d01f02552780bdea0c242b665177ea63be5db5afdc6167c9776bf7
SSDEEP 49152:KvbRquA/m2yL5zMfFiV+XenmE3/zBsQsYYtvezi+mtgb1:soq1VjnmasQZEvcZV1
TLSH
T184D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a53df2ecb8cf2395b19038fb2021467ea1fb70bc4d7c5de269d81179c470abd3
MD5 211f2974dc4f02b3cb2b4ec24a8159e1
SHA1 b909cb848d5a084da4f10ec609693aba6f4be4be
SHA512 2aad943932e9303fc94e7b90cdf3094b8a8640953bea2d65236642340b96e643bd923e2a542a262250fcbdc10ef88092ee100815d3e621b725408e4500e0ad34
SSDEEP 24576:LAhGLvpFoiwtA5l7S53dmN2QsU/OBtvntszdQ+mtgfjH1:LAMVFoiq5QsQsYYtvezi+mtgb1
TLSH
T13245AE81EBF955D4F5F7AA7899B68171EA76BCA55E30C20F1220D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 fa637252d954f75a45c83b1698132a0af629aa7e4f02bf9368c581b159ebdad9
MD5 f49c1417a96de5629804ed8b5a073b9a
SHA1 c767015aea4f21ba037f84d778b57c8810bf9504
SHA512 5f7c5f7f9d1846d14485fc8cfa6d65552e75cbc784bb737384801e935ac80c9c10ce26971e7755b35b5caa5a2383b25643acf0768d6cbd085450ec7e72fe630e
SSDEEP 12288:vmw5HEjsChNhBFgl0WDm+C/iUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIf/:Owu8OW8mN2QsU/OBtvntszdQ+mtgfjH
TLSH
T19E05F14A76B41CF9E5AB91388597C136EBB278112B21CB2F4360CB5B5F373616D2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 674KB
SHA256 984c051bdcd5b43e557e2865b93d77c98b5d132f960d2efc9572ba0004d6fc87
MD5 ec86ab5a2647f269cb47c6c67de9c691
SHA1 0ec8044ba2e152cd6b5349b1d764e9713f95780a
SHA512 1509bd6959fb70e18e470723988858fb3eea201c6339c8071fa94423923014705a4c4a672e8d43bc571ba3d5f1073c5cdcd43ee31193f76a9aee56a711e6004f
SSDEEP 12288:AQz1Iz6iUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:Pzu2mN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1CFE4125E35B461F5E0CBA23C99E9465ADB723462173243DF43209BEA0F376E10E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c4b8856fe55a08b02692774f6731a29416208a093094394fd34574efe52d6577
MD5 0d69a5f9e05877781acb59670a63fe87
SHA1 373e552ec15430fd9a5d8ec8eadf977c9a83bc61
SHA512 3fd3b46b696597ce473694cc1cd643bbcbcf33018c5423cb8fd82d3dc894ec471bd6f9e1688ba732012b60e828b7e0459a85a56ec9bb80c4e04b21fce6825c18
SSDEEP 98304:nQRQyi36YOcP8Lvw2gAf+PN3osQZEvcZV1:2QyiKa+X+PNrQZEvcZV1
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f0e6434b2ba8019f0b0ae75d7dcb170131b4e11d1cdf0a463b532e0dc327e2ee
MD5 d6c434f987c3253472343ecf417f8150
SHA1 8948cd2fdba542f85e1c45f2050af1fb48200cd6
SHA512 32cf8fbd5dad066e71583db386ca36619d8e21e62bab69938fc4ebae94e62529cc7c55c5f4e26d090adb99508d9501e103a6d54a6d2a98594f4ac6b756e525f2
SSDEEP 98304:nQRQyi36YOcP8Lvw2gAf+PN3ysQZEvcZV1:2QyiKa+X+PN5QZEvcZV1
TLSH
T192667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c7dc29e410eb9fb4e66d1ebf789616417940b8716cc26862c7ca055dc64dd60d
MD5 ef39dbe18fbba77ae9c9888a1f34109c
SHA1 e5ee1bb0611b3378eadceda7bab92a2c21798f61
SHA512 ed73a658d6c7354617c2384af13c55702d49e29fef4283da018cfb5cb823bf2779484dd274651aef69ae8617012a85f13e51d6e48f9f2e7f67b7a0034be9a218
SSDEEP 49152:A68Qg55nhMeWu7PNU3/rsQsYYtvezi+mtgb1:6thbRc/rsQZEvcZV1
TLSH
T180B55933B2F20099C44DE1769F4A873196E27C758FE0E7DB811172561FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 457513780280cd507c75646c6949e7ff32b835116036c7ce7fe6b7d74f7fa91f
MD5 6c457847f2c0c8606093ef8067d32e74
SHA1 a57ed7c09d2a3393701f2387417311bc379b0027
SHA512 3a99b7ad499b7d61e134b2b9950e41c0a3dea205c27f51b6eae6ad814157f30d4452ae89149703be20b3edd24aa625a1e1ee51b978b49ef87648092e44ecccf1
SSDEEP 98304:jy5112gYy5azzVv569nLKnhZMsQZEvcZV1:+LIHAWhpQZEvcZV1
TLSH
T16B168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0885174bcfc14aeacce33a3bf059a7e6e7472360a06531f3390e203fb6194af5
MD5 febe43b75b879e2036c4a1f713ef4b6d
SHA1 69a614a34bcaf1de8c97c8236139eff8b18f48d4
SHA512 47467704f24d6c1ca2e37a879a9d523a7c88609c99d305580a0e4078eaa7cec6d203b600fb8d706ecf15fa961dac43f1f03165136ff60b4efc04ca86e5506e91
SSDEEP 49152:pw+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBsQsYYtvezi+mtgb1:+u6JmTxd2dBsQZEvcZV1
TLSH
T1E7D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a7c06f4487b748ff30184501ee28e7ecd7235cd6af4b3e22a5aace7f381d7fb2
MD5 c252e69f3fe01369ba1ea5a3a15f4b73
SHA1 1b3f288970766e7f2bf52cee3d468acefa79af73
SHA512 bec2ad7f3a5f0a575702dc461445e01d062540bc30810866313d8025d5fd2c7810e501d6e1776c43bd5b660f972ff167c59b50a3eeef4e76cac57b241be11a46
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xNsQsYYtvezi+mtgb1:emifPbRAsQZEvcZV1
TLSH
T1D6B5BD13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 60ef8b03ec45d5cd68ca7f2210f15564fde68ec90ac0c0404843c943b699dd40
MD5 7daedfebeab9d5289e3b9d29b5a221e3
SHA1 91656f956ce537cccfdee85edd636171c9f0423c
SHA512 f830d3234fa26dc9574934e1be453413da201d95ce63d7d354ecf7d26017256509f543dd17c6c9454f718c03408605490489d9c3445051ea463f3ce7977f8522
SSDEEP 49152:2SuZQIY0Be2K6RVtOnks6NMHqssQsYYtvezi+mtgb1:Y5dKoi61ssQZEvcZV1
TLSH
T149C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 26c4490ce5f232066f9fa19cf013037b43aa5c126a980b7294b8791a9673c1bf
MD5 de439e834c52b0e184988d45a102d623
SHA1 282255e1b86b44c159987b33bc0024fd3e836fe4
SHA512 3f31e0421202b5f8cb18f2ec36ed873b5c9083cac875634fcc6aedcc20ea0085f6c0b04e9cb4cdb5d464c4da5645decda7ff6bcfe162665a0629960aa4d3bff8
SSDEEP 49152:JzLSn8EApI0figTgiDn0AP5woMCQRjg5wv7SG2u:sX2iyph0jwiG
TLSH
T1CEA5BE13F2D900E8D05ED178C7568632EA62BC050B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 c59e3e89f439ff35c588068149751da0dc52b9e874003177d7a21f278c54d89f
MD5 a337427525d11cbe3c0f8ee462c80d94
SHA1 52db9f9c6b23bd7393c31c513af55bd2efdf4fab
SHA512 da086984f1b99d4b950118fd3cf43e72278a828748f1eca5b9ce7ff7c7460d480dae30c12b6682b566c3750e3ced4161481a5a811efb965e76aeefb2943d8dfd
SSDEEP 12288:7pb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:7pMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T122D42316EE770F1FE04825FAC06E1ED164E4EB84FC82555E398A8D052ABBE450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 78ace2c8f9163850bb34ebc5c2992257a91c55f3a9cc6a7542b4ca8479b7882b
MD5 46699ea4f326c6b76e5917077392f559
SHA1 75f7a40972720418ad26271be69a100af8642fe8
SHA512 b7e39facfd3ae38ce5f90a53792026f765309a1b29f3a29ff1ae848946b1b5dc30d627594c2e93aacc8d2fbd218ff9c912fcd6190cb1f54250da08a16d3ffef4
SSDEEP 12288:1Nb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:1NMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T17BD42316EE770F1BD04864FAC06E2ED164A4EB84FC82555E398ACD052ABBE450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 f01b3c7836d11decbfa74ee7729cb767968f51a486c740aa2ea92a062558c8f9
MD5 70086b35832011d36f2b677b344888b8
SHA1 d73e318ba6656c99b67eb49fd97ee55a352475d4
SHA512 216bf3981a0c0a2c1c888b7678ac9dbf1dec199f6c70805829082761fecd84e84bb283a3b557e015221a3a779dccfcf9d4e7578768e1dde28152f5dc064793e6
SSDEEP 12288:j3b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:j3MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1A8D42316EE770F1BD04825FAC06E2ED164E4EB84FC82555E398ACD052ABBE450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 ac88f5d0c7e7a479c7287bf6c63710adf3e914ad960f4001de993f0abec76eb6
MD5 d367ac28ad389ffd6741fc0ead64775c
SHA1 39277fe4a5270c2dfa316a4f513b1ed8da356f93
SHA512 5dda98386f8107386c3395667ffe6d27c447b4336565bc4b6118f3085d2c8d4d0859a8a3aaf364844662b1e13403bc353ee387e090aebddaea47e23e136146a6
SSDEEP 12288:3l+b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:8MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T160D42312BFB60A5BD499A1B9C07A1A91A5F0FEC4FC42924F29418D0A1EB7B445C37F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 2d1fcd80dd2cecfc4822922faae6a8261785c41deab301df21d7035eeec723e9
MD5 ad1392b143710233d34eef5a2cac35b8
SHA1 9c356af8bba8355016e7a031190879c52965c216
SHA512 5ffc6a0a2388d286e6976d388ac531d57e5908df9cf9b02be90e8d80022ca0b909a48c481a373166a8515a62055fa51b0ec22edf4571c6717194c7ba480f7a23
SSDEEP 12288:Sib8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:SiMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T140D42316EE770F1BD04825FAC06E1ED168E4EB84FC82555E398ACD052ABBE441877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 7792da5ad660c5c4003f0b769c096c9f5580aa7582c455cf4483907513f87370
MD5 791da04378d7ad0dee6a67ebfb4655c0
SHA1 2e2d6bbba49759c4498109bf811fd18d4d42c15a
SHA512 f6bf17c2eccb1fae495c598d9f9a8ce70a3fb6e43cec7c429f56ce1c1f61929a6f231f153b0e1b34ddb3cb6cc07044db60d28a85e08137a755427ba2696210ad
SSDEEP 12288:Z6b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:Z6MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T158D42316EE770F1FD04825FAC06E1ED125A4EB84FC82555F398ACD052ABBE450867E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 2fb13a6e0d23185a396268766fd67f01308ba53f03104d940d6adc06c3bd2260
MD5 a594cbbf740e2025016de562c0a454c1
SHA1 a80a9cc96c25015eecee4d92949327be9069763c
SHA512 f4cd6f8c2e646c01ebcc906a62d41e8875fbb055a5d78cb46765acab992a5c9c04f8b0327e90be17364908216319d2c9d6a106abc025b50e9c3dc4bb717e858f
SSDEEP 12288:cIb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:cIMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T12DD42316EE770F1BD04825FAC06E1ED125E4EB84FC82955F398ACD052ABBD441867E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 57e2fcd86c74ff0090ca17aaef6111e16d0371d71eb46a84a6abb55d97aec4ea
MD5 86f2317a5dd4478813c029bc6e7d25ee
SHA1 f30cf3f4d1ffa308753256de21958ba8e6e172cf
SHA512 1b1a819d8501767f862d906071ba85e2a17fbeeed14594da19f0937b19e83879cb6357f9d78f5953ccb2cc921d9599b0622812cdc7606319841ba1b2b4eac99e
SSDEEP 24576:BZMLzF0SnkMCQROmcOI4WHlxgo4v7vKG2ue:BZMLz6PMCQRjg5wv7SG2u
TLSH
T148150155B3A00CF9EC67817EC8654906D6B2BC495AA0C61F13E83A1B1F337911C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 c15aba4b61098166540a8d734484b5ae72550f5813481ff73b99e9e35783d9ae
MD5 23722eeb17214e2a3c8b52f5c896cf3e
SHA1 7b931f48aa964da8d3b778c93e1c6b4dd2aa6d81
SHA512 5281309de2fb53af754c79d94cbb5e2f75daa0f77c48d74b3ceba172fe2383460160da6ae7a0b9d906b8d0ed17ee344f7f4bf4aaacd2da457d51cf89dfdd6d92
SSDEEP 12288:p6b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:p6MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1E3D42316EE770E1FD04825FAC06E1ED168A4EB84FC82555F398ACD052ABBE450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 a8b16b77c2d3781e075b5b71375c0e2ba78f46bedd1034a3801394824149e018
MD5 0a5793f6fcf7566b78c7bc9875a9018b
SHA1 b4fad958c5119eac943ab3b964de79eddcef30d5
SHA512 eeb037f3cce8c14b46f0a6f454691e86e0e8050efcaea6aa6a0602cc0275d9a76f9c513821a0c1f015328e3357d2f133c4660ce3f2053ea6336ac6f65c534266
SSDEEP 12288:rmb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:rmMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T10DD42316EE770E1FD04825FAC16E1ED124A4EB84FC82515F398ACD052ABBE451877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 9c7e6819b12d8a2927cb55e273e2f27fdbd7b641827e57e1ae4d565115785f55
MD5 5da97710ae709788bbcfaae613a3641d
SHA1 3b536c687d458060aa907419bb255724a2e5d7ae
SHA512 e8ef24d630f1f17b9949cb269357d487da0fe0714078660f76dc2661cc3fc60248df36196b75f5673fbe2aa71c3b390a111bdcf4a83114d4156fa054d4653a64
SSDEEP 12288:1APz5LAYb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:KzWYMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1FEF41207B7B221FED0669179C8661E42F7B1F8215B508A6F17A44B262F376805D3BF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 1fb3dec04e5be056da9b7d6fc11d355cbd97b8544d7756d08ebfd06acfd01e3c
MD5 b4e6a31ee874f1987249aaa32b400452
SHA1 26daf6f9c0b42f0754e6e1696f454d18879062b8
SHA512 30677d01358f7fc4575e7821f8429cc06b1c7c1dd3ecfed91c8885ac4fc68cdf4febde9005f1d97065708160b653199ba2d0dec39eb2a61318fb00538ae248d2
SSDEEP 12288:Znb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:ZnMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1CCD42316EE770E1FD04824FAC06E1ED164A4FB88FC82555E398ACD092ABBD450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 8bf18e73df0f07af12534422cbf6a42edc31576702142f8e0094158e893057bb
MD5 0270637e1c753d8b63eddc9ca1864411
SHA1 3bfe676c1571327575e6baee3c0de1772c78783a
SHA512 467a79d6ff888609cd3cc76d4c1e6c6c020ffedbb46c1049a2339835edde94727d8d15c71ecba2b9339da2d16bfa0b1aa41d242e27c1bc9578ead12259de8a07
SSDEEP 12288:xPb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:xPMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T198D42316EE770F1BD04824FAC16E1ED165A4EB88FC82554F398ACD052ABBE450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 c39ada6ee2cd1776fef4107573fcc0ad043ff6e5d67d70d991fe26f4a0442448
MD5 045e79438121f143aba18dc553447a70
SHA1 40d777f895ee19641af25ed62e154571173e4bb7
SHA512 0f0658e47fdd21750da0d0d461242def2f115704aa329db7e2684512cf30ab28b585430b590b0d8bfc511a7ed9ceae0e03dec3a34aa663776655974c2133d4b7
SSDEEP 12288:4APz5LAQb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:DzWQMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T197F41207B7B221FED06A9179C4661E42F7B1F8215B508A6F17944B262F37A805D3BF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 420fb8e9a0201e54acfe1bcb44002a024be284a2a3bc3c12a739741fca4dafe5
MD5 63e16d574921a2e5be3d62686547c385
SHA1 dafb094a4b886becf00604fa4dc341e98f188b40
SHA512 168c91252ae621b610c950f5ccfbf79f612f3a026bb89180f2ee23ef92ea94c9fa979f8e247cfb7dffb91ac5932974d676b152b797b0b327899373c8db854f04
SSDEEP 24576:cT4aLl3z0zRXMCQROmcOI4WHlxgo4v7vKG2ue:cTPLlj8MCQRjg5wv7SG2u
TLSH
T1B3150155B3A00CF9EC67817EC8664906D6B2BC495A60C61F17E83A1B1F337911C3EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 826410e13c400ec0dc60f074440bbc62b6bdca1598bf75011803e4c4d5c56321
MD5 b1d4d630a90150f5a71cabcf35cac822
SHA1 7beb21fecfff3367663a9b9c4c5027cadc8d6c30
SHA512 f61967296c478eef8d997b29fc311a4194ae071aea8ebd35c524499ccf38d1538ce3dc92db2b87ee012d62e3af1af664d49ab839b64dd72fe5f66338301489d3
SSDEEP 24576:x3+dZCHuy7rwKMCQROmcOI4WHlxgo4v7vKG2ue:h+dZCHuynjMCQRjg5wv7SG2u
TLSH
T1F935DF90F3E414E9F0B79A35C8764511DAB6BC995B21CA8F03A4661A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 dd26a66e5fbd86dce15ed374e324cc7d4834d845ffa0d351ea72038f6e0b813c
MD5 ea11a8da19a4d45c793dfd8c141c0a51
SHA1 a03427897e8bfe62ce5d38cb01a89def41358d8c
SHA512 78d27c9fd6ba5d574207ef412f96608a7c80733c73dab75403e288e5bc99eb2d45c33fac979505496701a288cc9e85e638e7918d100b8bc1fb044411edd895ed
SSDEEP 12288:V6b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:V6MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1C9D42316EE770F1FE04825FAC16E1ED165A4EB84FC82515F298ACD052ABBE440877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 5cbdab75bd071826730483f28915279c997470a6778bf9f75fe4756fef91717b
MD5 b14ca4ca6294e5a5d19d70cb004e8a24
SHA1 31e8b2c62d365102f4aea0660bbf5bb2fe67177d
SHA512 516e7f18a5b54f7512306f3d3f05cc3418d9cc24959c22c67fb3ad155e2200ef4f567d54af822943c9eef7e63b6f73edf896a601e943816ef6409e25cff93c52
SSDEEP 12288:V6b8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:V6MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1ECD42316EE770F2FE04825FAC07E1E9125A4EB84FC82515F398A8D052ABBD454877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 a43afb4160a3abc44e8ec1a22ba146306990824c977149320bebeef6bf5c336a
MD5 ea5eea96af35d0f29622bdeebbd52ddf
SHA1 4f8d0d6a3b69cffb019f985439a916bb3a8c0573
SHA512 fab8b94fdfa005915341eb8e43dd16fd3f4194228feb7b62e59a1a9839fd5e356c94efa77579fdabedf8f34591a99f323a36f92eecb56b4e62a5dc53b4a0ade5
SSDEEP 12288:4DQb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:4MMCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T119D42316EE770F1BD04824FAC16E1ED168A4EB88FC82555F398ACD052ABBD450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 9111f44363b53827c48a93933297ddac46365408fa803dc5f158e2fc9b527100
MD5 6b67cf816f2fa81b06276c15d4617d1e
SHA1 15fb962fab2bce50b9dd657d2da50c371be09c78
SHA512 5b01f04fa313b922e77cd287a6bbfc22dd95f267cf36e7e292839c64e0817327408feb1824b433c1ff1c12a216bf4c33e8a1bd597a840aa6e0219e37565ab0b8
SSDEEP 12288:PhQb8XCyQ+7RugImc2jfJ+M2Co4WWAlxi7T704v7vMlG2uoty:P2MCQROmcOI4WHlxgo4v7vKG2ue
TLSH
T1C4D42316EE770E1FD04824FAC16E1ED125A4EB88FC82555F398ACD052ABBD450877E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 2ba99a5320c132e150ffeef8eaefff0d1539ac64b7b7d1967867fee8d26c959f
MD5 38bff371e9a831f0dc00949de91e4e68
SHA1 c49fb059f0425fedf0432f2674f312855ac722dd
SHA512 0ccdb5ad1e81db2d422a2b86c1da07615bd7dea8edf69ce1e8105194dcd3ab6fb54779e2ffd9420e10f94a45a79f118e30bdcbe8a81be6a793ccb5141e979e3b
SSDEEP 12288:awsf2giUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:E2gmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1A4F4F11AD1A452D8D09EA178C79A4656F7333C2587E193DE53D0FA7E0F362A04EDAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 96998f1583a85988c24513cff647c2cfaeb38637fbec1ec1fda9f918fc40bbc5
MD5 ff1267b68ea33aa764a57655d9ac1d2c
SHA1 830a85fc1245c2a8a19d87e5d201b3cacc040f1d
SHA512 2597528170898fbe528b4fe985f2d39d9945437316bb36a26adc204815912569375350715b8e1802262ada5279105998749dd35e3fa06ea6e703093c819ec19a
SSDEEP 12288:6E7HiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:zHmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1E7D4232BE878AA85E0CDE57425DD417A9E3935244B014AFFD311BFE64D3B2E04E49B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9a1ad71dea553f741689dab837f6f516a9e9483462b6b07c91314067ddae8a8c
MD5 a9efeddc89bcf904505b7c7cb33a4aa8
SHA1 0debd96ec641b1ee588fdb8a3a6d0af7a0ee910c
SHA512 528a16e936a2660b5da20c5c67a59a661bd0acecaab9eb80ef0d53ab0a4e99bc4af541f8eff0d580d9e2b27a731229c8a76cef89d84156884759aa981e52eb98
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYCmN2QsU/OBtvntszdQ+mtgfjH1:5gb4mBIBhGFEsQsYYtvezi+mtgb1
TLSH
T12465AF1E22EC02F5E0F9D2B89DAA4417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 02aeda970979a779c5791a1c2af91f557880ef26b5a877e91b7ec87ac626c9e7
MD5 d31dc31fb042347a567694a81002bf48
SHA1 f0f1a1a33636b5de8f22844047c4cbf0c99d0348
SHA512 712de892ef6536b92f456f72347de5a7cd17f3159ba152ad45cda500d66d7dcb642ca5087c89d6e00bae37e941e1ba6ff83ece39a190ee08f11b49a2ed7e0ede
SSDEEP 12288:mCGKsiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:VGbmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1DAE4122EA8B575C4C4AED63864D941B7BDB1346047101AFF8261FAB58F3B2F04A3DE49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 ce9a00e6e928eb0f6a931b7c89966ecb2733bbce606e3dd861da435cafca3179
MD5 56b28206150edab0d3977d0121e91316
SHA1 39d853d7fbbd09b34748e8fc81d571850f41fd59
SHA512 23a999915373be0c65b558ffca268d33ee84992da8417b0b6c4111aea241142a08825f666f88b675498d1a3f61fff22bf1721311aedf27dce8d005d7376306fa
SSDEEP 12288:XYiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:XYmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T11FD4236EE8749AC5D0CDE97825CA417A9E7035154B160BFBC321BFE64D3B2F00A39B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fbbdc5070da5b4a943a2cd92651a6ca2379ff4bd308d7489f56bd2df4712aa8b
MD5 d76c805faa775d00994f5c67d6fb90f0
SHA1 0be807abb7b366a617828b5356b15871040feaeb
SHA512 6fbcee0f8369543a30c152ebe9d103b5e7a6835755c9f481557ebaecec21a042ebb93af3ac07fb045a3e38dfa76397257f43bc65dc03fc8972ebcd1e72613942
SSDEEP 24576:KGT888DTJqH1Mzria7/mcmN2QsU/OBtvntszdQ+mtgfjH1:NYjDFqVra7/asQsYYtvezi+mtgb1
TLSH
T11C35F165B6F101F0D47BD13889864667F6B2B4250324EFEF07A88B951F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 925c26442bd7f3c8789b71974267e8d8e20c39f767ca67ad187431f0b321cac9
MD5 1471a03a991d4ae912b98af1cf1afa23
SHA1 14883bcf31cee47ac5beba1b6df33cbbe91a7155
SHA512 d3085a158ce057f67ce4608eae8af225b452f89dc79b17bd508e74898ed94eb3745da00573fa52b4411a4f8377b208192d3db81c0b6302c6038e1dd86d9912b1
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7sQsYYtvezi+mtgb1:WG05lO43besQZEvcZV1
TLSH
T15BD5BF6E62EC11F9D0BBD17CDAC6460BEBB23415032556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 488488dcf4c0f33f2c6d57192948e9c4b6e6f5a0126ea4238d4e7c38752fc5fb
MD5 05eb07db91195c289cdd168ca19947c3
SHA1 dbdaf8c41c588add0f8da0a2f845bafb1c04bddd
SHA512 6dd4de6b3918c734cae3dc6c6c2891aad949459801b1b9bbff60b00aaa55379f02588a02a3fc0b7f8228f62c6153c79f1cb2d6e4707563f9708011a2e4acc7d7
SSDEEP 24576:k5a5POZ3dpbWVM50JicR2hG0lasx2+47eidnnmN2QsU/OBtvntszdQ+mtgfjH1:6a5POZ3wJt2pasx2+mgsQsYYtvezi+mK
TLSH
T1FB65AF5EA6FC01D5D5B9D17CC583461AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2edf1386a9c7c7633202be6d3eafddd013a7723a8bf49c0a72a05f3f67bb5296
MD5 18894e9d9c88d596f41ba4d6e56536df
SHA1 81efbd1701e20e1ce3565b6ffbecdc1089dce10b
SHA512 65dd7d77738706e0da2d906fe7a25a3cc7278abd2865a5cf86550628a4b922adf2103867a6b13fbcb991245c9ed46e32b4c4eb792455c8e3abda14bd7d077336
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkumN2QsU/OBtvntszdQ+mtgfjH1:7Nc/zEOVHFAsQsYYtvezi+mtgb1
TLSH
T142858C2622E901E4F1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 d65d5b253720d7a63a64e140f9ab672420977e592f6cad1ee5f2c16c9e5c1ad7
MD5 b3c8918bd6a75d55df0e1e78231ff927
SHA1 f0f7004f16af1b8f51092c8f456d2fa756b9411f
SHA512 5e03eb186bf1df5b45dc0ec84ca89565af9803433f29f2b18d7e366bffe2260bda7cd36fba49dd4d0c95ffb95f2cd1278a23b499f7b370c993c305d5d9d45d4f
SSDEEP 24576:+JnJPbzB4SlmN2QsU/OBtvntszdQ+mtgfjH1:+JnJv6SIsQsYYtvezi+mtgb1
TLSH
T15A15D03DD2A810E8D4B7C2B4815A166AFE31387D2F2169DB55B4D5343F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a63427b2c76367c34a06b83d8b3eb36edb5ca91a97ebc2785981853e1f4e5c7d
MD5 f457112b3c1116e19aaa50f79e885cb1
SHA1 d380b931d31f7e3fc45e961ab24a972b964dc0d4
SHA512 62671f67138bb933d59a5264817180a9d58b5889e3183ca8a87122abc29c737f62d21fc7307efe50de2a329184d690bb27570a1897ee0ce2984f4e0f59ee0afd
SSDEEP 49152:+CLHGeeV5ijCmlDWDkNsQsYYtvezi+mtgb1:1/sQZEvcZV1
TLSH
T19DA56C05E7EB5184E8F3CAF4C92694169E327C549B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 ec7432239976220f2096948432be892e1bb4640a13d29b8c8a908465186e68bd
MD5 a66e23add1d6e9b2db06f0a1070e5760
SHA1 661ffb40e7aa6a127232a53121b49a9dd88d51fa
SHA512 1090a0d8886e9cac8ab0de8856dc639a0917615865ddb7bb94124c4d1d9cdf2e23adf81d89386aafe19e87239c1f90ffb918d496c26df63659927eaafad05278
SSDEEP 12288:61Hck6j5ZI7QiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjV:G6DIkmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T17EF4015D727A11F5D0ABE03D96C30116D6B2B07187121AEF4790D9BA8EB3ED8B93CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 756a7675e961444bb0cfcdf4ccd85f5b9e6d3f7e9e0b5dee2e54daa82ed9735c
MD5 0a6adba6ad19db00f27534d4ea5e29f6
SHA1 4d238db87f34f5349e9e9d49a423929e64c5b50b
SHA512 06425524ab9378035a6f1fd7b6b58e6eaa80d30172775737a4b3d9542d3749904db27802315783bdf7a89ce71ead043848e6ea26b59d4bd12901cbd883d4d00b
SSDEEP 12288:2G6kypeiUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:ftywmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T10FF41209A6B461C4E5ED96389AA641B5CE317C204B1147FF8260FBBE5F373E09D35B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 8ce755f1d09f49c84fdd05d9eded65e2708111d27a33eb2b644410787a3b20c4
MD5 37a5a8d361ceaba155255101734998ce
SHA1 12a45967c9e884bed051534e1fafb8809e530171
SHA512 d1a0f411d3e0f2a71f9816464f028ae81812b2c6190a3589ab3e0e29a4f3ffd2d9a002e6d9441ddfe5b2a8d22df41d74c058047d81f49559f28eca98aa9204b6
SSDEEP 12288:BJ/iUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApaRv:H/mN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T117D4236EA87466C5D4CDE97821CD427B997134240B161AFF8360FFF58E3B2E00A39E46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 30a25f4e3c8c943fc073bc979b83555d9b2b291da8d38076f21ebaa6396fba1a
MD5 b5ec8ff120066da481cba2f65ac6cd6d
SHA1 1630990660430a51f5aec58ff2ad94c6ff97d725
SHA512 a2208348ce64491cc44964e245315bebd85d9cca4683f302179f50ea3ac6837e5a246cb1cae5f6d4f63bb10ed3dd822402194bc67675c29103c4dbae3ff2d18b
SSDEEP 24576:1Zg5HoTfaidZSmN2QsU/OBtvntszdQ+mtgfjH1:3g2TrZ3sQsYYtvezi+mtgb1
TLSH
T1FF559D1DA7FA05CAE2B2D639D8621493D633B4315772C6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 de5dccb2036499ec6e6967ffeb838ac61cdcb8f7e05514a7f926b0cb65b08952
MD5 712ece27c2495c75e78f87752c6b931e
SHA1 e0d863a1960bcb99daed041676ecada852013fc8
SHA512 6b6c21b543f7665ec4551c865c191667db199ed0c98ed423c10937b1cefd1facb7143db27d8922d939cbe3d058c5ac211673736be2930c0010c5e1eb4b7d6502
SSDEEP 12288:FpJcm8CNciUEN2RpcNfrtsM9uW/zJcb+itvnNxp4fZ/RyUQIfcht/qXYohtjApa1:FrcmRcmN2QsU/OBtvntszdQ+mtgfjH1
TLSH
T1E005015EB67E00E5E1BBD13C88854156EAB37030171257EF42A1CBBE4E276E97E38B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 ff4e304db3b611e8a57209c65e6310354a44017bba03d68232c3b068d34721ec
MD5 6d4ae54a1b001fb19f2e49504669c57e
SHA1 14c1e1e89b1f6cc4f9cc3fc2bb137e831f4adad2
SHA512 98206906e4989cbc78b8e006e42acc0d6ced5266215c63e35e5c5818a44df310068fe1666743b0f2683f8ab6f6aacf7fca43cced70815b968bcd988118808f98
SSDEEP 49152:yDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS35sQsYYtvezi+mtgb1:z3Upow8sBIsQZEvcZV1
TLSH
T17EA58C3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C5B8BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 9ad125c3b5482b1fab31f5756b703375882d40e2b3d63be1b24910e3f1b950bd
MD5 45dc08ab4a949d11e0d054066ddf95d3
SHA1 138d3c7d1767fdbe193d1ed12d790f69c768bf64
SHA512 631d53a212d118720664546910a13e4331695a13e287c295d6c4fe06d5a2454f3507600d11d787ea1093e0a32ae2c6cd33d28fea97944f9327f53ee3dfa3c81a
SSDEEP 24576:BPUr+NQ+mN2QsU/OBtvntszdQ+mtgfjH1:BJQLsQsYYtvezi+mtgb1
TLSH
T1B305F12F65BC18E5E67AE17C8586871DE7717462071292DF03A0817E4F37AE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-378-0x00007FF79E790000-0x00007FF79E842000-memory.dmp

Download

memory/1324-311-0x00007FF79E790000-0x00007FF79E842000-memory.dmp

Download

memory/1324-312-0x000001FDD2EB0000-0x000001FDD2F16000-memory.dmp

Download

memory/1324-313-0x000001FDD2EB0000-0x000001FDD2F16000-memory.dmp

Download

memory/1612-388-0x00007FF762C90000-0x00007FF762E23000-memory.dmp

Download

memory/1612-331-0x00000245E8F40000-0x00000245E8FA6000-memory.dmp

Download

memory/1612-332-0x00000245E8F40000-0x00000245E8FA6000-memory.dmp

Download

memory/1612-330-0x00007FF762C90000-0x00007FF762E23000-memory.dmp

Download

memory/1832-262-0x00007FF638E10000-0x00007FF638F58000-memory.dmp

Download

memory/1832-265-0x0000023413010000-0x0000023413076000-memory.dmp

Download

memory/1832-264-0x0000023413010000-0x0000023413076000-memory.dmp

Download

memory/1832-338-0x00007FF638E10000-0x00007FF638F58000-memory.dmp

Download

memory/1972-14-0x000001FD76CC0000-0x000001FD76D26000-memory.dmp

Download

memory/1972-12-0x000001FD76CC0000-0x000001FD76D26000-memory.dmp

Download

memory/1972-11-0x00007FF734480000-0x00007FF7345A1000-memory.dmp

Download

memory/1972-13-0x000001FD76CC0000-0x000001FD76D26000-memory.dmp

Download

memory/1972-43-0x00007FF734480000-0x00007FF7345A1000-memory.dmp

Download

memory/2128-412-0x00007FF780A50000-0x00007FF780CD9000-memory.dmp

Download

memory/2128-352-0x00000187CE600000-0x00000187CE666000-memory.dmp

Download

memory/2128-353-0x00000187CE600000-0x00000187CE666000-memory.dmp

Download

memory/2128-351-0x00007FF780A50000-0x00007FF780CD9000-memory.dmp

Download

memory/2260-350-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2260-277-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/2260-271-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2260-272-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/2652-285-0x0000020826CF0000-0x0000020826D56000-memory.dmp

Download

memory/2652-283-0x00007FF70E930000-0x00007FF70F072000-memory.dmp

Download

memory/2652-284-0x0000020826CF0000-0x0000020826D56000-memory.dmp

Download

memory/2652-361-0x00007FF70E930000-0x00007FF70F072000-memory.dmp

Download

memory/2932-365-0x00007FF7DE7E0000-0x00007FF7DECAF000-memory.dmp

Download

memory/2932-446-0x00007FF7DE7E0000-0x00007FF7DECAF000-memory.dmp

Download

memory/2932-359-0x0000017A882D0000-0x0000017A88336000-memory.dmp

Download

memory/2932-360-0x0000017A882D0000-0x0000017A88336000-memory.dmp

Download

memory/3312-37-0x00000249B1000000-0x00000249B1066000-memory.dmp

Download

memory/3312-35-0x00000249B1000000-0x00000249B1066000-memory.dmp

Download

memory/3312-36-0x00000249B1000000-0x00000249B1066000-memory.dmp

Download

memory/3312-34-0x00000249AFD90000-0x00000249AFEBC000-memory.dmp

Download

memory/3448-381-0x00007FF7B7B20000-0x00007FF7B7DC2000-memory.dmp

Download

memory/3448-321-0x00007FF7B7B20000-0x00007FF7B7DC2000-memory.dmp

Download

memory/3448-322-0x0000025907D20000-0x0000025907D86000-memory.dmp

Download

memory/3448-323-0x0000025907D20000-0x0000025907D86000-memory.dmp

Download

memory/3688-448-0x00007FF736450000-0x00007FF73657D000-memory.dmp

Download

memory/3688-382-0x00007FF736450000-0x00007FF73657D000-memory.dmp

Download

memory/3688-383-0x0000026F99930000-0x0000026F99996000-memory.dmp

Download

memory/3688-380-0x0000026F99930000-0x0000026F99996000-memory.dmp

Download

memory/4216-3-0x0000029F990E0000-0x0000029F99146000-memory.dmp

Download

memory/4216-0-0x00007FF6F4B60000-0x00007FF6F4CBE000-memory.dmp

Download

memory/4216-19-0x0000029F990E0000-0x0000029F99146000-memory.dmp

Download

memory/4216-1-0x0000029F990E0000-0x0000029F99146000-memory.dmp

Download

memory/4216-22-0x00007FF6F4B60000-0x00007FF6F4CBE000-memory.dmp

Download

memory/4420-242-0x00007FF72F790000-0x00007FF72F857000-memory.dmp

Download

memory/4420-243-0x000001E778A10000-0x000001E778A76000-memory.dmp

Download

memory/4420-244-0x000001E778A10000-0x000001E778A76000-memory.dmp

Download

memory/4420-319-0x00007FF72F790000-0x00007FF72F857000-memory.dmp

Download

memory/4520-394-0x0000021F81160000-0x0000021F811C6000-memory.dmp

Download

memory/4520-396-0x0000021F81160000-0x0000021F811C6000-memory.dmp

Download

memory/4520-395-0x00007FF744180000-0x00007FF7444BD000-memory.dmp

Download

memory/4696-341-0x000001959EDD0000-0x000001959EE36000-memory.dmp

Download

memory/4696-348-0x00007FF6C8E90000-0x00007FF6C91AF000-memory.dmp

Download

memory/4696-340-0x000001959EDD0000-0x000001959EE36000-memory.dmp

Download

memory/4696-339-0x00007FF6C8E90000-0x00007FF6C91AF000-memory.dmp

Download

memory/4696-346-0x000001959EDD0000-0x000001959EE36000-memory.dmp

Download

memory/4772-293-0x00000282B4880000-0x00000282B48E6000-memory.dmp

Download

memory/4772-291-0x00007FF643F30000-0x00007FF643FDC000-memory.dmp

Download

memory/4772-366-0x00007FF643F30000-0x00007FF643FDC000-memory.dmp

Download

memory/4772-292-0x00000282B4880000-0x00000282B48E6000-memory.dmp

Download

memory/5072-57-0x000002B875DD0000-0x000002B875E36000-memory.dmp

Download

memory/5072-58-0x000002B875DD0000-0x000002B875E36000-memory.dmp

Download

memory/5072-56-0x000002B875EA0000-0x000002B875FCC000-memory.dmp

Download

memory/5484-247-0x00007FF6FB550000-0x00007FF6FB668000-memory.dmp

Download

memory/5484-329-0x00007FF6FB550000-0x00007FF6FB668000-memory.dmp

Download

memory/5484-249-0x0000022137E40000-0x0000022137EA6000-memory.dmp

Download

memory/5484-248-0x0000022137E40000-0x0000022137EA6000-memory.dmp

Download

memory/5532-302-0x00000284CF060000-0x00000284CF0C6000-memory.dmp

Download

memory/5532-389-0x00000284CF060000-0x00000284CF0C6000-memory.dmp

Download

memory/5532-301-0x00000284CF060000-0x00000284CF0C6000-memory.dmp

Download

memory/5532-391-0x00007FF7F13E0000-0x00007FF7F17F5000-memory.dmp

Download

memory/5532-300-0x00007FF7F13E0000-0x00007FF7F17F5000-memory.dmp

Download

memory/5532-375-0x00007FF7F13E0000-0x00007FF7F17F5000-memory.dmp

Download

memory/5588-45-0x00000213E9C00000-0x00000213E9C66000-memory.dmp

Download

memory/5588-53-0x00007FF694750000-0x00007FF6948B7000-memory.dmp

Download

memory/5588-44-0x00007FF694750000-0x00007FF6948B7000-memory.dmp

Download

memory/5588-46-0x00000213E9C00000-0x00000213E9C66000-memory.dmp

Download

memory/5588-51-0x00000213E9C00000-0x00000213E9C66000-memory.dmp

Download

memory/5844-371-0x00007FF71D970000-0x00007FF71DE75000-memory.dmp

Download

memory/5844-369-0x0000024BAA640000-0x0000024BAA6A6000-memory.dmp

Download

memory/5844-370-0x0000024BAA640000-0x0000024BAA6A6000-memory.dmp

Download

memory/5844-447-0x00007FF71D970000-0x00007FF71DE75000-memory.dmp

Download

memory/6020-235-0x000002533CC30000-0x000002533CC96000-memory.dmp

Download

memory/6020-310-0x00007FF72F790000-0x00007FF72F857000-memory.dmp

Download

memory/6020-233-0x00007FF72F790000-0x00007FF72F857000-memory.dmp

Download

memory/6020-234-0x000002533CC30000-0x000002533CC96000-memory.dmp

Download

memory/6028-25-0x0000023776A20000-0x0000023776B4C000-memory.dmp

Download

memory/6028-27-0x0000023776960000-0x00000237769C6000-memory.dmp

Download

memory/6028-28-0x0000023776960000-0x00000237769C6000-memory.dmp

Download

memory/6028-26-0x0000023776960000-0x00000237769C6000-memory.dmp

Download