67e74cc2ed975864d52440b0a3f495b719d167b69079d6eb0c8aa88dfa08a52d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260808-c8qq2aydqd
SHA256 67e74cc2ed975864d52440b0a3f495b719d167b69079d6eb0c8aa88dfa08a52d
MD5 c8817d561aeb978193be8a6c5aa5c5c9
SHA1 fd7377284e0b7ab336076e2b99755c2deb58aa67
SHA512 18e0b250db7f7e23f617494a68b90bc672e0687a350aa58c1d233bf0b64f143d518292fa5725dd53f871d678abfa6f9fb9fece047a1a906466c05d414939b4a5
SSDEEP 24576:ivrHWdZcy2NKcWXvHQHzTqTMV87BbkjCMvGdLtO8ikAROpP7yrOTtoPRd:2sGqPQTmTb7mGVt2qWJ
TLSH
T1BD75AD1277E58035F2B36731993A931899BABCB29839840E73DC676D1F70691CE24B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
256	alg.exe
4548	GameInputSvc.exe
4116	GameInputSvc.exe
5632	elevation_service.exe
4836	elevation_service.exe
2464	maintenanceservice.exe
4528	msdtc.exe
5344	OSE.EXE
5136	PerceptionSimulationService.exe
2748	perfhost.exe
6084	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\698d3490238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	GameInputSvc.exe
4116	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5368	2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	4548	GameInputSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeDebugPrivilege	256	alg.exe
Token: SeDebugPrivilege	256	alg.exe
Token: SeDebugPrivilege	4548	GameInputSvc.exe
Token: SeDebugPrivilege	4548	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4116	4548	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c8817d561aeb978193be8a6c5aa5c5c9_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4836

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4528

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5136

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6beb1b6e919e94b37f4e10cf313bfc99c9682fcfd4e86acc4459f8d54117041b
MD5 9d6d45d7698f698d184f1e2e7f36f44d
SHA1 1a2dcaf503bf25689463da47263958c9ed0d4e25
SHA512 38d54b41724645def73e012d621b2c134c2e81b9f54046853ad60829a060dcb1a3f3d57a0854268635ee3d5335bdde746674f8acf6d975bfffe007923616bfe8
SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnMqWJ:G3q6gjBpqA
TLSH
T125D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 cc22c5b6b900135317adfb732a3ece8d5023f78b2135ddb3703bd8d92363ae91
MD5 1f1b7639562ef3609a9bec8786f3a069
SHA1 70ac649b1314e76f24d6e36ed17392d5ef6bac4e
SHA512 dde5cd85eda19356ae3b2869385704f6e04417eb8cb95cca9131db06ed6be0d249fefe783ee1786229578eb4fd7ee30f4df708e2d1dbbc1eb630bf5fddb844fa
SSDEEP 12288:x1XLstIeOxy2lRq2czAE7RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:/XYmJtczAS8ikAROpP7yrOTtoPRd
TLSH
T13205021967D508F9EE6B827CC8A18415EB737C514794EB8B03B8CB660F232945E3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a6bba5b3cba4d67df3516b8e691f44da2a98a79ef731debf35f3f743cfa997b8
MD5 c8953c3bb30eaf2aad1852bf15d6345a
SHA1 486fe8ca9e6801bec8d07183498f4b652b3e80cd
SHA512 d256ba55a78030bf6d4a2daf1747471e8bec41032abdeab0513227def3ba4ce8d40983750a7b1c7d21135a3b03948f48be580aeed26670cb7acb78bbe24c7db6
SSDEEP 24576:P0QewAO0zmxOrMy8ikAROpP7yrOTtoPRd:PjAO0KoJqWJ
TLSH
T18B35AE16F6748735D073C0B9C5D2A69EEE71308257308ACB4296D77C2F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 483eaff3daf747662552d7e0f0e8f48d449745f888b80b6a966280e67b3527bc
MD5 f3d8a1b006a6f278462b0b9a1dc52559
SHA1 25c33cef4e3a8ea01e6878573bb157c977394932
SHA512 d3a22d6399898c287cc2da70621c5ef2fc9260c76a4161dfab93e328f88499668c889949d53fd0f387ff94b381d7befc7677eedbec45343e4a519db0ad9032e0
SSDEEP 24576:6ML/ezSC6vUyD/aqgrvW/6q8wyu68ikAROpP7yrOTtoPRd:7/ezSC6vUzPvuHjynqWJ
TLSH
T1D9756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4bf0367a3306ec3307ff07baa497b8e5429bd4d77b5314ccfcfc5a186ddeef4
MD5 f5a1ebaf696c081dc87fe8c8442f155f
SHA1 182489af442b014d1351471d598bd655fbfb0a79
SHA512 7b6aceb862e42bf24a5db87a0892d82391f1e3a5709f3bd4dbf9a9c636bbbe352a1afc50eed0803390972ca5665a7a15c7306789ebad953d06984dffce49cf9d
SSDEEP 24576:eabRPWJn9v/l+da8ikAROpP7yrOTtoPRd:eakJn9Xl+AqWJ
TLSH
T13E559E66F5748331D073C0BAC5D2AA9EEE7234425B318ACB0246D76C2E676D6C73A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 7638724d7e2025556200e95c8ff7c1988a5d00a3c2b4c97ca5b8d3b8b79d58b5
MD5 048a36760d80782c9e074868cbd54aef
SHA1 1bb6f36578a7f93f003f9c478c877b76dfe6c480
SHA512 733d6e968cc9cff1eeffe997c1a6366be90d5154bb0bf28e2a3425d3cd8edbfcc3ebc2381094efe93e034fdf3b76ef5512024453b10391b55065e3e7026ea3d4
SSDEEP 12288:Q+URmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Q+U8ikAROpP7yrOTtoPRd
TLSH
T112D423438A4A3875EBAD12B555D998EDDBF2ACA0E6CCAE10423CEF9E0434413D71B375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 ad569324e5245a0daa098614aa73de05c091766c938e217eb8e31c9521493aa9
MD5 a26fc0557a3b1c30062477ef2dacfc1a
SHA1 473cf3b7206bed9103d807d7c00eea41d1d63138
SHA512 40e9846af0d69eae248794433a4737e572ff9d37a22264893d9bc5e3b04ec30b387310f281f05244ebca49b7a741d574f8f5b57ad8a839b8bdfef7a307f39ad0
SSDEEP 12288:aeBNUbTVO86UgSRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:aJIUZ8ikAROpP7yrOTtoPRd
TLSH
T1DA15CF2BEE28FCE2C27E4DB956918640D7B278704B51A7CBD174C30E8E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 8e9619d551a627b9eb95a9f3de005fa53276aee1d0a07fe418c445c73f2afaa4
MD5 59c262c5a79308e20ad5122ed53ca367
SHA1 b5546b1740f078daf17fac9f92adefa3bed0e580
SHA512 4235eb2b8b8cecc5b30bb0d3df2f0de71c403e2bc1cba8ee4f511767e0c7a3111efcd5a2f2a511049609a52f777576b3f9eaf259cf0c85c2f02e3ec435fff209
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJa9DN5JoNRV3THH:XQvGAdlCEL8c/aRNs5CqqA
TLSH
T1A1367C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 b00de4ccb0fe60152787dfca9a6ac844c84cb3137708e5afd0393779f31356a2
MD5 9b2586d3039e79a191d254fc2f21b775
SHA1 356bd35e239b3e599c8a594e7172163b2c1ec246
SHA512 baf5f23290bae64f753b3f8982cb65342d35eee9c8d569b4204e88a7aa9aac3578bb9c697b6d7b0f55bf188084f51e5d7ff2eb19953481be130bf42df6f0d959
SSDEEP 12288:jHwSfxL/2Dc3bDLLmt0LDQewsAjnRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7J:7mewsAjn8ikAROpP7yrOTtoPRd
TLSH
T14B15E031FE75E436C77F0DB21B25C71A587CB9604B951AC3E3A88E9E49301D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2f43cb76608fa502a8bd650594d11ce2e061ac08c62bf63320ddb0816973ba25
MD5 31ef4436b3187e7862f9996eb9943b2e
SHA1 b175714137e47fef95a60fb70e0ff5bb9ab9db63
SHA512 d7b250c51bb000f09ed07a6102a1c22998e4446ad8beecbe8c25f311ace4d3d04fcc78460142d51782d5d6ef16cd513e06711fff82739c8089c05cd8cffc4cac
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrQdPlbuJHaq:xUEtQevvqc2W1cpV2Xr02a
TLSH
T1D1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8acfd417eab492142d9011999d45150a870edc7e6d7ea25bcefc1b0653ab214e
MD5 82da2c099dd2c47a22cb054423e08246
SHA1 7679dddefe17f85c88a972390a1c9789b9859c21
SHA512 d4d1030a3e7882d4e702e72fc0c7b07915a806e07895aa7494d6912cab1ab4f7e0c3e95873137844eb722842347aef486c4e712d828acbffc39d5279dfb46368
SSDEEP 49152:JObRquA/m2yL5zMfFiV+XenmE3/zVqWJ:Koq1VjnmcqA
TLSH
T1D9D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 cca0a4fa6e86556a90fa628741f7a0705c0ba67987dcbd79a5808ecb49c7d2dc
MD5 ee02e6ee5a928af28d010cc51474f379
SHA1 78642b08da7bcbde8400f5419c6c86b49b6a625e
SHA512 bccb6772f4523f1c510799726b0eebea8dc1514a096734298ecb35177e524e6b9c4db0378c5da6550823303c2b13b21cdda6d8cf0523a145548f84c1bfe7dc23
SSDEEP 24576:BAhGLvcFoiwtA5l7S53g8ikAROpP7yrOTtoPRd:BAMgFoiq5wqWJ
TLSH
T11E45AE81E7F955D4F5B3AAB899B68171EAB2BCA55E30D20F1164C21F0E33E409D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 389f5060d9adc55a8227193fea31fdcb630105836911e0a661d25a7012cdc861
MD5 ace355e6e31e126321089a92c6f691a8
SHA1 365fff92a42e5cc3e8cbea636591338f38154491
SHA512 c71403259a99fb505165849a642789e7b426990cc1fc6f102ea7314f63444702826dc307c6a881604f2522293a6f0cc6c37edf686c68cee4e9db00158f70bce8
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Ct/RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK0:Owu+OWU/8ikAROpP7yrOTtoPRd
TLSH
T12705F14666951CF9EAA742398597C03AF7F2BC112A54DB1F0374C75B5F33221AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 7fa1a01c6e074c7b77643841427982d61f56307b32f401284f1f6bd08ad67ffd
MD5 ecf748f459e83afe9a5c5959f860340e
SHA1 801ffdfa3b09195c30d2277a7e6d259f10ff8fc2
SHA512 f1033d68290128845ef55b2cc568c8f04ae1b6d593581681e5ccf126d647a0ca7d9a90fa6450a97530cf5b9d812af80cda36e29d1a68800c380eafb66f28d744
SSDEEP 12288:FXP1Ild+RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:pPuu8ikAROpP7yrOTtoPRd
TLSH
T1FCE4124627D834B9D7AB4278C9E5858DD7F27892636857CF0238879A0F229C25F3B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b5febe3a6ceffebb056be6b511104e983c1bcf4899ad6dca7582a4307dfdd335
MD5 e2004375d1120c1a184ce18d57b54a4d
SHA1 3381ddd862421444840908448c9feb4a0c56b575
SHA512 940f12e896f98a22604c380feab49dd58c154c322e660ddda18d683b82bd5f32b7544e05627658dc09172c8bbf9fc6221ae6f4908489607089abed98d1641a00
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UP:XQRQyi36YOcP8Lvw2gAf+PN3JqA
TLSH
T16F667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2b9e8cfecdc6de561c3afec3fda4f945be44f6e45ab1e5d89ec350c260af334e
MD5 3d1905d992d924eceb5608e42d116837
SHA1 44008929cc01cc27cc25cdd192eff6d67f427dfe
SHA512 c4b634ec5fa190ffc904338aec7bc6687e39c278aeb15d1c9aed86d3aa7d98966bb0573f7f1aa57153890f439fdbcfea2fa62eed04a6011798ca8014b2ddbae0
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UV:XQRQyi36YOcP8Lvw2gAf+PN3XqA
TLSH
T1C8667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 04b9934bb38d32ac2b2fb07effdcf072e9226e2b986a50d77cf86c9b812cbe67
MD5 b8dcb14f9e5f8878f4aa33dcb263f7bb
SHA1 b3808b77372f8899d358cb7aaa3bdf0abddba292
SHA512 27561eb427ca070dad912cf7e32d97a4a20ae573663d05a70df3f56e035950f9a8a06e732443c2807324d3213f490b9631a9f8d04d1b535810251c4fd9107aa0
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0t8ikAROpP7yrOTE:G68Qg55nhMeWu7PNU3/oqWJ
TLSH
T1B6B54933B2F600A9C44DE1769F4A872196E17C718FE0E7DB851573061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e264a1694797dca9b19374fe235569b35de788e267dcfc122ad965d902d83cf8
MD5 79c1f04670ed1039a40c167cab7e401b
SHA1 6fe8589b05a0565a7463f9803891924921bd488b
SHA512 c4f50a7cb58f4483c50695025d563f9c0057b2b0b5a09a1ca2f16c3a7dbf03adfd19905f20968248203f5f404dd921af36bc3a9ecd7a8b5b7bfe0d88df8b674b
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99g:py5112gYy5azzVv569nLKnhZ3qA
TLSH
T18A167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7738836896c4866437742471704c40e82a2d27b49248b1d413a01183030110df
MD5 04e575f28f0c5aaaf6c20e059e2dcfcd
SHA1 4564b25116cd927bcebb5e1da48107932a4cc21e
SHA512 2e8f6106c006cea2dd19223ea7bc35576d4f38af96f4175103732d2a032431c7a83b705147c7338f30e84dc2bb39e5989df9e928b8daac84f50cdb03152a4a33
SSDEEP 49152:EB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glrqWJ:eu6JmTxd2drqA
TLSH
T1F3D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 26f367ad26287d69c5b963ad75a62404e059ce4fd45051300875e8280f9672ac
MD5 4c0b2c2bacae09be506eb78a96df81bc
SHA1 d30d52b842e9caaadb71a08af8e3c4c079c20531
SHA512 b165aa362de1bf4f8e361d0b303b8aa3dd7c093f96baae8c2f5fef3a369b0367cb4a8e295387257a1a30bb21959929ef7bb09ccb80cb242e12ffc1a2137e3b8c
SSDEEP 24576:khv8E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3J8ikAROpP7yrOTE:I1hpsNoJpF1A6UU44CwH7R4xvqWJ
TLSH
T182B5BE13F2D901E8D06DD17887569232EA72BC460B24B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b8b661ae3b59580f431d8550861dcd10d8965b790d95429a6cd90e9e1d1c037e
MD5 6a5b4bd7dd203fdd615d9a7b68804473
SHA1 d941ffc63f61528f678128e559139375082c24a9
SHA512 4e96f2092f6257c1bb0df697e7f1f78291495ed910ac0b6832ddcac6716360b69c50a0d780cf631ff8cd248e725001be432bf31d7e73be6f884438b47ed81153
SSDEEP 24576:x4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSMHnq7k8ikARR:HSuZQIY0Be2K6RVtOnks6NMHq7kqWJ
TLSH
T15EC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4616267777e9581763b4c3a8da6709b293c4e813587501971ff447439e85d852
MD5 e661a5213f1edde292c7951bb29715e9
SHA1 3d3a43675c861485f4fb7d6c20aacc2b7276eee6
SHA512 13ffe788854330557ac02999c6c27a5ad7c5e17f0199cb8c8a33187a9b94957906f08ead7f58f56871a519599a51231bc814379e216b9b5ba94d4819c659cf0d
SSDEEP 24576:FhiavrPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLy8ikAROpP7yrOTtoPRd:FhtSn8EApI0figTgiDn0AP5wmqWJ
TLSH
T101A5BE13F2D901E8D05ED178C7468632EA72BC150B28BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 376e52ac1eb20cfdfad5c3a1644217fc455c1946941c0bbf6410de48089d0824
MD5 282117aa18b0c923238302c378d64cee
SHA1 23e128d3564303aa935637868496ad21287fae24
SHA512 70d6345b7a05fba091e212be748fc3a89c2cfdfa985d04d8c902a1b4f4f15c15e5f0ac436657a3e8d5aa7a1952d80bfb7e2febbf85d66b2262d650353d482934
SSDEEP 12288:o63RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:o638ikAROpP7yrOTtoPRd
TLSH
T17ED42346898B2C7ADB6C52B586C584EDDFF1ACD1F6CC7E24523CCB5A0A20813571B7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 c585b721394387ad8d584c7fe976073c7565c6f1228731c1593e085dcc4617e3
MD5 f48d12ab9e09d877ffcaaff7cbd16f5f
SHA1 44d80f04188b315c239efb6bdc7f82e6f6933f86
SHA512 b307169153751f7888ac18393d3cf3c512492d7b1f508db6b562d30aeb63aae86910263a8bf382478153b229617541202d8b61f1729758d795118b290064c638
SSDEEP 12288:O4RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:O48ikAROpP7yrOTtoPRd
TLSH
T1E0D42347898B2C7ADB6D52B646C584EDDFF1AC92F6CC7E24523CCB4A0620823571F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 90cf96fd4d48dcf2844d8c4b7a7a08c2487a5fc146763aebb9aa8aa90ef8c923
MD5 f1ec61aee2ff7b4aebee3e99e210b96a
SHA1 9e71b2724c94c840e543c4c42c9fcc89c3a31c2f
SHA512 e9405ca0e40d7f730041780186d2dfca9cac36b2e3310c778228af6a5790bf14667ff71e1013a2499681fd09f4f09b68ab42923480d196eb356ab986f49609e3
SSDEEP 12288:QC1RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:QC18ikAROpP7yrOTtoPRd
TLSH
T10BD42346898B2C7ADB6C52B646C584EDDFF1ACD2F6CC7E24523CCB4A0A21813571F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 e40d94d178fb0d93f09079dd78beb857ce299369be94fd6be084eaaaf268ba8c
MD5 d55944e7574df7dc4f615918fcdc6a7b
SHA1 a5aff086568606395f43cc8d4d92066bc64dcaf6
SHA512 bc1f64867ea779451c4d96a4312f199c9f7e8560064b310be1d8bdfa754a87daf78e2a8f285bec9a9022317657f54a133ef93710051d4e76dcbff3085d508a5a
SSDEEP 12288:+llRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:28ikAROpP7yrOTtoPRd
TLSH
T18BD423024A8E28A5DB7D92B5C5D584EDDBF1BCD1E78C6F1A43288B4F0E30512572BB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 617a501472f44fd73bc5eb892ae9573f815cb0c23082bc015e64e0c33f7f115e
MD5 b4fd0d28bd2a668e7ce7f49876f47712
SHA1 cc23025353491c5eac58bfd89a932255edcc7694
SHA512 499f2fde2f1abab578adeb7322f1574f3032f957a7c81e7f0e366218a3ea06ccbe659d2f13fb3a72ec17a7258a81e9a6dc6c0bc3978e9e47207128d55ea11551
SSDEEP 12288:ePDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:ePDpfNtGiR1lbYylrI/A
TLSH
T1CED423189D8232C6E946337BAD5F13D982FCBFD48290BDA9F119A133B6A09737949740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 469466037af4c843bc2a60df9915bbf8375172d51f813e5bacc9d05708752b3a
MD5 691506b80c30a5d5108bd2459e7645e4
SHA1 ccf91bc8d5e40653237657435b427737247bfb0d
SHA512 707a42bf0bbe96b9abe9f1becccaaa2a169fbc6271f1673633218e2dc6f591ceab21c9cf41c50bcfae7129a7bc63ca80aef0fdbc01199bdbc9413bce87dfd7e5
SSDEEP 12288:dJDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:dJDpfNtGiR1lbYylrI/A
TLSH
T1A0D42319DD8132C6E946737BED5F13D982FCBFC48290BDA9F129A123B2A09737949740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 26e6dc0fd8c2ec4c08961af0aa18687e27f74fef899be4d77de26895f7dda60c
MD5 b2241fb9fe4c5a32ad0ba38ed462f038
SHA1 059634637673284e06a6aeccffa4e1267b7ad9b3
SHA512 8d1bab144e620bdaead11923edb9b7ebb4a578c9729c3c305151a6a860c935fbf5f8d0864555a65922abcfd28a4c81f5ddb9a2baed753ab2da474b99fc29a34f
SSDEEP 12288:GuDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:GuDpfNtGiR1lbYylrI/A
TLSH
T1C0D42319DD8132C6E946737BDD5F13E982FCBFC49290BDA9F129A123B2A09737849740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 7865ddc3150939408a5222fd710ff4fd9ca0c0599dd0ab6f39d881bc471da45c
MD5 62bdd08e203082b3f0a322c9c2ef52cf
SHA1 d2fb92f61f3fae5ac1b357a3f0b7dc71be7b2ab0
SHA512 15938e853909b3cc2ebe274b962b4c1ed923ae982b8d6346286436eaa24b77aeee1f6c0e946f25a5c5fe914c7c42cb2ae63b226f7428cb10b219adece8810137
SSDEEP 12288:eiZwb6WzW5ESjcPvyODHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:BZMvzWaSzODpfNtGiR1lbYylrI/A
TLSH
T17F1501A5B39028F4EC67923FCD264996C2B1BC5946A0DE1F13B432276F733612C2EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 5eb2f74b8c05316e55023e370fc05cb503775b391f9875c94434bda709d7d098
MD5 647aee65ab6679c7e247e6e810221619
SHA1 3c5bcded73aebebe40cdb2fa79a4c4140d2e88ba
SHA512 5f3534e8fdfdc24348224cd0f60e5e890f1963b17df0c6f395f3e5fa2219bcbc7fe0d7173473cfbd41b3bfef7b016977ec7c6879ef73785713719bfeb65fa01e
SSDEEP 12288:/mDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:/mDpfNtGiR1lbYylrI/A
TLSH
T11BD42319DD8136C6E986337BAD5F13D982FCFFD49290BDA9F119A123B2A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 6b8af4548123969d3e199aa97eca1f800cdcf8d8743546474e7e328a9e1635dc
MD5 83219be4baf818c6e79a4f3dec551ba6
SHA1 4d0264efa1710de19fa7ed128cf9dfde476ab232
SHA512 16d6a94572cbd9169ba3463fb02dfda511e0f22549031fb31161808d58758bab7eb2837433abe9cbe22968abfc12f17c5f3cc0ef95302e67e08e3211f1a2b95c
SSDEEP 12288:1GDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:1GDpfNtGiR1lbYylrI/A
TLSH
T147D42319DD8232C5E946337BAD5F13D982FCFFD49290BDA9F129A123B2A09737849700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 bfe7b7848da9327aa4544bc3134a460fac09e7d3a6a4c857c9d0b4a538786e82
MD5 9ff45b10e02ffd0dbee41a84f7ea3b81
SHA1 4d4227f78acdf4c1288fe3520ac6acdc1a73795d
SHA512 bd2794bb2d151ce50bea9f4c61d00fa4d13a22afd05d04da632f3d6365256f58ad92e46bf7009aa76067825d67d3e6f42d3a26aa69dd66afcdb7166b7f2c23e9
SSDEEP 12288:dIP8HLN+DHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:e85+DpfNtGiR1lbYylrI/A
TLSH
T1BCF41217779131E9D567633ACC671A82E3B4B8714760AEAF536443333F236A1AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 bde0dd961443d6c5949ea4e67ed50a435f48ca41712b115871bf0580f6ec776e
MD5 b6e3250a4d165a6bb76757fd55605bda
SHA1 be0673b38d057abe224ddb48303ea9dd46066910
SHA512 3da3cded7cc94dee75d57304624263fb0ae5877d0493315adcf093a1edf585064fb9573247d17a1d716942426a1db37427f8883b5237b6047b885e585038196a
SSDEEP 12288:z/DHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:z/DpfNtGiR1lbYylrI/A
TLSH
T1A8D42319DD8136C1E946337BED5F13D982FCBFD49290BDA9F129A123B6A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 a7fa850063f3fdc2aa76eddb954573cc846a6a5c2a7b8daae56d77ca0bbf631b
MD5 7dbf25a2391b962d4743ea499336a81f
SHA1 9ea7b9634eb4d6940869dadcbe3cc96b24a72888
SHA512 58599a45edad709b40a1b6cdecd707db056d22ca28cb0ff5eec43910f1f0252db9209abd45d37ae7a4b241e78c96fb0bd8a3605c5756ed91bb12ce09432ac21f
SSDEEP 12288:jjDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:jjDpfNtGiR1lbYylrI/A
TLSH
T190D42329DD8136C1E946337BED5F13D982FCBFD49290BDA9F129A123B6A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 01a977389c84c11579339afc57e13e7ae3d109088c9744a0d7aebf1d8ff33ebe
MD5 3f5e6ae045ed12e23dd5bef059588ea5
SHA1 031efeb670d51df13130ef5d17ecaa7cfe012a53
SHA512 a68817cd8e17d6044254bc9b917d2084b7ea87243ebc545e325fc8fd7a62e03478efeef0581a77d31772b78ccbbe1f18477f8ec556a7fde7ccdd6de3b748240d
SSDEEP 12288:cIP8HLNfDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:z85fDpfNtGiR1lbYylrI/A
TLSH
T1F5F41217779130E9E567633ACC671AC5E3B4B8714760AEAF536443332F236A1AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 14a300b9e3dc3227951c3cd9802a39cef3050abe7b90f7f4fea362341bc13fef
MD5 2835b84b32942e77537976f796e7e6c3
SHA1 a966da8ac9dfb9610f56acaccd718b44f5b3a2db
SHA512 993f2b723ff5ae6925374143a6ea6a31a4b723fcc08d96016b3e9e9c3af15e60090de6074ce54d6ea3d34380437be76486a41890b7e8985feefd22d19daa5f3a
SSDEEP 12288:hCd98V1oaLHF3z0zk4PDvhWDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:cTPaLl3z0zTWDpfNtGiR1lbYylrI/A
TLSH
T12815F1A4B39028F8EC67923FCD564996C2B1BC590760DE1F13A832276F733616C2EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 3902cc19f70fd43d38b5ad3d7606adf96898ab865e232b40460eddb99764ea8e
MD5 fcc1ee4fa57a45db937cbf389ae0b57c
SHA1 e4f2e36f607d4ac4fa55000940f4394d39411bb4
SHA512 901ef07ec18b41aa03b3a2ebc5d68115fb4ea1ca0065026bb82992210ab04d18b42ec4ccab9beded99b99729fb149dffd6a774f687b522682ff2eba1952e9fad
SSDEEP 12288:yi4e70udafgwCHay7+LbbdIvFDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:y3adECHay7+Z2DpfNtGiR1lbYylrI/A
TLSH
T10D35CF90F3E410E8F0B79A358D765551CAB67C991B70DE8F03A8261A1F33AD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 a73be34e63f7410a65c02d5664775e621076ae834387402f1f62441c4f0be080
MD5 9fa9e31656b4eb72e04b99982c5a1f9a
SHA1 7f4e93fd4e5164ca426c3c4b520a6f54971b5f55
SHA512 37b27ee2d3ff13a9b05da6b585a8084b9fea923d39ab8cfde2918c6d225904efa88ff416a85eb6c6ed64e32e212abe87a75e73a222ce1081a9267db1a493d518
SSDEEP 12288:x7DHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:x7DpfNtGiR1lbYylrI/A
TLSH
T16AD42318DD8232C6F986337BED5F13D982F8BED48290BDA9F169612376A09737849740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 5553fd4aaeb3e9bd590b30abe2e932c041f646d8f393db2ae63783dd2135fa60
MD5 042224303aefa37fcfd0c3de0d387429
SHA1 af6c873d54a6604dd6794bb8be021c71f4b81fc9
SHA512 7a42622c490f059b16b6563d36f3de1b07d01f877f29600a519d7257024ab03ad38b6494af139aef4c40d3aef0baf2e162d332f68e690557cd649dc568ca424c
SSDEEP 12288:ZBDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:ZBDpfNtGiR1lbYylrI/A
TLSH
T1ABD42318DD8132C6F986737BAD5F13D986F8BFD48290BDA9F1696133B6A09737849300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 55ac2096c79cc1b51b815ece61f67728a1b5845b90246d5557571687c66f4a39
MD5 112db2f12dc831fa3d90e6e16560fc66
SHA1 3d7987846030bc5fce1bb3560664ac16709e2544
SHA512 ee4eade717e1a7e3e0d2717e107cbe00335be2fa2f7fa10618b185b66330673a5e8e876b3d3b85651bb1b203097ee6f49e8e751495543e33acad5755c4200987
SSDEEP 12288:+ngDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:+gDpfNtGiR1lbYylrI/A
TLSH
T158D42319DD8132C5F986337BED5F13D986F8BFC48290BDA9F129A123B6A09737949340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 f4775e2a227ccf2bbf99209eecffed474c1264e02e217d6646cbcde46249461b
MD5 5aece17dd4eb34cb06e70f7ae5fc331c
SHA1 02204e6f0ed730f3201a6c4ee96d09e72ac3b869
SHA512 2576a6d0e495f9baafc66e5dacd10a05999fa69b1f2d1beff4a185ab89eae11c346ddcaa3e2f5a1b908180419299f725d6d545a72b6c42aacc528259a5fd2029
SSDEEP 12288:J8gDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:JTDpfNtGiR1lbYylrI/A
TLSH
T1A4D42319DD8136C5E986337BED5F13D982FCBFC48290BDA9F129A123B6A09737949340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 27fa8e8f8b53a0ef9d455c8f407fba11ed96c10f3592bd450eb0ae4b78973205
MD5 239b531f4ba523d4557f0eb59fe44de4
SHA1 4ef5b8d1d871a36465c603ef1931eca63cf6ed8a
SHA512 88ad0924a4101e8454bf6f5496c5ee674f2d57fe9666dd846dd9acc3296fa3244286cb9f8dc49fec4d619d6b786529ab96a913136a4e6bfce05a2b751f665b91
SSDEEP 12288:b/DHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:b/DpfNtGiR1lbYylrI/A
TLSH
T125D42319DD8232C1F946337BED5F13D982F8BED49290BDA9F129A133B6A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 4f39b47495bb0b7272cbcc48f9697c38b61be5d3f858af583a926f655a4fd2c2
MD5 ec72a69c0e46feebb636193d2ecf8427
SHA1 5cc2dd9c823f025464b6cce3f240722540308372
SHA512 8e403cd78f719824ff07dfcdc1160f92c1ed030627ff010899591f88b8335b41dfc8a524369ca1ad3db15cdeb94831fbcc285eae49dd13929aff4b69d32ed2e4
SSDEEP 12288:QrDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:QrDpfNtGiR1lbYylrI/A
TLSH
T176D42319DD8132C5E946737BED5F13E986FCBFD48290BDA9F129A123B6A09737849300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 7eb9654fd9aedb4c54f75d16f0fa05c401a5e73b345aa4cfde7eb50b9916d228
MD5 0820774e1efb7c7489db251b370e6106
SHA1 b4ee0682442cec2069fdbdb2f58ca98e38feedb0
SHA512 d9117c6a075c8f3bfac6325615e9d34128e33d6cd2a150bf796fb142ccac9c7f1c0c44fbf5d78ee815939fb57fab6cf7fa5ea08754545680e80fb12cb2199440
SSDEEP 12288:nqDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:nqDpfNtGiR1lbYylrI/A
TLSH
T1DAD42319DD8132C1E946737BED5B13D982FCBFD48290BDA9F129A133B6A09737949340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 cd6d1d98359354d2049530cd645e7e8acb99fe0ecae9b4781071ed69204ca57b
MD5 b970d50022c50d1b70bc61961ecab047
SHA1 e38f6d139979ab16be33599ea4325d3dbb341b77
SHA512 b38ecbfd15043298efa35a12975348583c6d5d676b130f718d9db43dcd32f4b3bdee7301ae8a8ac908e53cac2c71ceeddc90715d44b048c0a2a54abedb422d27
SSDEEP 12288:2VDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:2VDpfNtGiR1lbYylrI/A
TLSH
T172D42318DD8132C5E986737BED5F13D986FCBFC48290BDA9F129A12376A09737849701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 598KB
SHA256 70db384d80a8111765e35bbcbbaef9213c71215a396322a6a5991d108a0694dc
MD5 39b868dd02b04a5006dbb0b4ba2af9ff
SHA1 4d46195ad01c0a7f8d13e50eb0208894676a8596
SHA512 5654ea3e393b55fe62067a2a994962f69a822168b9c45badecafac72cf3965aa145914a791a57539fe1be2246abd422fd77acc4ac584fc7f6cde62ddf9a89595
SSDEEP 12288:iQDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:iQDpfNtGiR1lbYylrI/A
TLSH
T13CD42319DD8232C5F946337BED5F13D982F8BED88690BDA9F129A13376A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 598KB
SHA256 d947a3c422a0227bac22632aed652caf5871444d0474b1481943e1dfdf123ebd
MD5 8013076d3b2d67415553f3a02a493ddb
SHA1 aa6dec907717aae2f7560547bad24fbd0721a264
SHA512 cded0efea0bb83075728d76e5c824e98d8da6f46877bd627e99431dac03b2d7cba7d4887679b78884209b0e10aeb72ff7a4993cb8f0645918cb22bb967e75d2e
SSDEEP 12288:IsDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:IsDpfNtGiR1lbYylrI/A
TLSH
T15AD42319DD8232C6F986337BED5B13D982F8BFD48690BDA9F129613376A09737849340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 598KB
SHA256 e28b533ec92197849863cc2fed784bf4e11516ffe924f9caa160dde0c24fb963
MD5 07681791fb41c36446204e4bdd0d5db3
SHA1 e58ea23c2870ffa02d76e8ca377b8308def16535
SHA512 84eb8dd2994ad6c909eea4131c87c7f810faa8a5773a786d5f7a97c8cf1878552ebe607f80846c0ddd3da6711ac882f3c06f4fc6decea3698a7239835d37206e
SSDEEP 12288:yGDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:yGDpfNtGiR1lbYylrI/A
TLSH
T16FD423299D8132C1F946737BED5F13D982F8BFD49290BDA9F129A13376A09737849301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 598KB
SHA256 e41cbffca47f417a14734971c97ac9804235afea2b075c4d8aa5204b82af9101
MD5 a507dc7fdd61bc0a935d4689d04fcd13
SHA1 7b42be9c39d6bf1fb9f2acfd9f5b5ebabfa6db97
SHA512 a29f0d0391181e8685a4a9200584d4117e088a7ade046d4cd48b5789f4a4f80ef9d0f2d84c49390df48b21cd3fb20d8d3fbd9212f7d362102ceb604a3b0c8fd4
SSDEEP 12288:HCDHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:HCDpfNtGiR1lbYylrI/A
TLSH
T164D42318DD8136C5F986337BED5B13D986FCBFD49290BDA9F2296123B6A09737849300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 598KB
SHA256 522aab53f6b5ba437a3418bf726a3a638d8e968b1bf1f3d0838f744707af2568
MD5 d28ace519e04d9edc847efd52a74354f
SHA1 f68797c8e37a3fcaba9fde2ea6d6317546d69adc
SHA512 6f47819bf675baa02a7b893b9d36370aa459e6416b0bf135c7afea6d1ca879354407c9916ad4cb54fe6d4809bb58f7fe51d084e6fe8c706c0d5969995a456564
SSDEEP 12288:k5DHJUoB2gtGujqMRCwT24FNbWzs8oVgsbry9HfA:k5DpfNtGiR1lbYylrI/A
TLSH
T16ED42318DD8132C6E986337BED5F13D982F8BFD48290BDA9F1296133B6A09737949740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 9406e6667b86abcc840b4dc3ca52f627d291e5a1929696ee83b7c8182b2f676d
MD5 141ebc81173d201ca5464fd6e4bdd1c9
SHA1 ea079914a95e577852f5940687492b93bb665f6e
SHA512 3a37ce15abffe510699f2b20551787da41249270aef99f68b7d6e4e1446cf05ff9fbaba1d3ebbbe01e0f9dabc041d1d1044fb5379574dea71e368ca89f07f70c
SSDEEP 12288:tTsft/RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:8B8ikAROpP7yrOTtoPRd
TLSH
T175F4010AC28811E8C26E6275C7858585F7B37C6193E4E7CA13D4FA3E0F365519EEA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 a179491ee85aa35d6d088334924556764363cf4b18aaaade1338f0880d0c2933
MD5 36e2108795207ced6a557960e68325a5
SHA1 ab0e3f3d44734c585724d39c5229d8e3f3b671a6
SHA512 3c997b278447c71ff86530104a18d7730197901b9ad0b21ff541a9807b3cbc59f81193ce19429512cc2793793f4579b0b06e89f28afc03693edf6bf4e42e7366
SSDEEP 3072:aw3BGbdjkiV0IghBM+x10b8arKQ//tBd7xbJKwL5MBS:qosV
TLSH
T1CDF343CA956FC5BA30234E83C77A6C754592355B835E0A2C62CFC29F76459038B2F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 f8002358aabd57748e689eec6d1dc9b25d3e4056bd0744866cb2b2c082959930
MD5 f8721768c18b8164cab57034d169ab55
SHA1 59b3793ba9d007fb2cd6ed8876fed8ab60dd95d5
SHA512 306cb1cb37edcd18172fb9c5b2aff581c28b37cf6556dbf3ed7e0fcf2851660bfd7dd21b78ec8c05d7361632379f569b095c24c82926bf6f4f629b5456266ca1
SSDEEP 12288:ct78RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:k88ikAROpP7yrOTtoPRd
TLSH
T1EDD423038A4E2C25EB7D52B545C9C4BDDBF1BCA0DB8CAE96912CD79E05308128F2B775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 4c3f28f319f735b3ee066d613dc01c91c23490c3c2dd5daafe8171261d048266
MD5 a6bbb64d80f181ac034b3c1e011a2282
SHA1 5995e74e26d59d8b967a00fd82f0b84d4e43f43b
SHA512 1addd681f79788d0cc4faa9d24f14b7a3f45196dee09a1b08a61a7e6f85630996d7541486601cc0874e37a38a90d26f3e4c11187f57cb7eb62e0fb9062aff95b
SSDEEP 12288:x5G9RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:PG98ikAROpP7yrOTtoPRd
TLSH
T1CCE4230A15DA3868CB3D8375449584AEFAF178A097487EFF0168D77A4B208E1673FE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 9975eb07910bd5d66a4fda4908e438155b952caf74b4ad4a2960edfe46ac3e6e
MD5 b7b40b71f9bd976910622b4faf44e060
SHA1 2a1c63a35a987d5c286e839f6763e72f56f18fae
SHA512 338475e4b7719336ad99074ed1762d2de20620388351269cf4dc8cbdffc10623c0f5eb18daef19ad12ad45af462cb783d5ecd460786348abf775a789212a4fa1
SSDEEP 12288:8QHvUrBFrEjwaQKRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:5PUr+NQK8ikAROpP7yrOTtoPRd
TLSH
T1D505E21F669D1CE5E77AA17D8582861DE771B8621741E6CF02A0827E0F23DD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 89d51362c362fe3b03d160c643a7444add52a89cac135cedf9a283804944b3b1
MD5 eb0bc7d0c38c8df28c241995960124f6
SHA1 981e36192010426369d23c8922d3c09a404ac03b
SHA512 640520b67410415f44802ee39b0bef03df434d21667cc17e289738badcf2bc8916b679ccd3709de7c5bfbb6a000567d420dfe1f7bafe4afaaa43d5df400e7ccc
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuqWJ:RG05lO43bFqA
TLSH
T1CBD5C06E62EC11F9D1BBD17CDAC6860BEBB23815032456CF02A486A91F27FF4567E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 395cd82d38c53d49fbdb9b0ab1e798dbd54e38daa8742472af74c22878e0a176
MD5 abde9d5d48fd47e0e18ad4d0e85a21ab
SHA1 33ec8c1f86e3f0baee3645c4155ece5c31285d28
SHA512 29fe834dd7eae3ffadb98593594975e4b1eefb772df0249969cc42b96a323dc57867ba281cf04a0770ceb2a64124adde5e0986c69bbd1c5de97f563c262435ac
SSDEEP 12288:A1Hck6j5ZI7rRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Q6DIP8ikAROpP7yrOTtoPRd
TLSH
T1B8F4010D236A10F5D27BD03D85824056D6F2B4B0C7456ADF06A8C6BE4F63ED8BA3EE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 4c360ec8d05d67b313340818dfbb1ef9dcbed1c17834078410cc78a7547862ba
MD5 b0d1f0b54ce9d401d8bc7a5165d73823
SHA1 600f0147d957ccdfab12131367a561fe7df6e210
SHA512 15bfedf2d7efd347235176b4619b92c8659f83813129d82ad490adfbea1e0f1647bc897c67d6bc117df0af07f02b49b13f581b174b91c10b500a3311a24570e4
SSDEEP 12288:YG6ky7RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:5ty78ikAROpP7yrOTtoPRd
TLSH
T17CF41305538834A4EBBD02748AA280E8DFB1BC609B446BDF5164D73F0F35BD1AA36B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2c12f897b8b0c82dba63d00ffe01d2c2949cac1f46a9861f833950b827299c15
MD5 73d43c7026497bbbeaf950db86d41032
SHA1 81dbc5c1f09e5ec12cb1eb48c59f35bb1d7af9ef
SHA512 ef158a734b36398cdf8ec8b55e5cd26808c2a16f663b1a206efc914959518883482cdf099ad6367dccc9bf8d90a7219d55d6aa25ec278cfb227eb5be894d27cd
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmV8ikAROpP7yrOTtoPRd:QTMwBtOm7qWJ
TLSH
T19E55AF6EAAB805E4D1FEC6B5CD238516E6727461173293CB5390C13F0E279D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 d278dc46bb1116bf31501f30c7059ffb93c275108956467059d47b08bab34fa3
MD5 31dd86d12b00103bd7479ebf8a430711
SHA1 447b8a4dd2c9452ed006a915df66b9c303d4312e
SHA512 d30b85d555daeaca441922f29cd2664653d813eda1915964c4cb5b90529cab177890e50ae28c31031ba679027273f19331ce81a00ef53e2afd0e22287595059d
SSDEEP 12288:pyS6b3IkxjbBzQRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:76UqjpQ8ikAROpP7yrOTtoPRd
TLSH
T1DCF4124E46C528F9E67D427489958069C6F1BC7217986AEF22ACC77E4B319C1863FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-15-0x00007FF6A7810000-0x00007FF6A7932000-memory.dmp

Download

memory/256-16-0x0000017C419C0000-0x0000017C41A26000-memory.dmp

Download

memory/256-18-0x0000017C419C0000-0x0000017C41A26000-memory.dmp

Download

memory/256-88-0x00007FF6A7810000-0x00007FF6A7932000-memory.dmp

Download

memory/256-17-0x0000017C419C0000-0x0000017C41A26000-memory.dmp

Download

memory/2464-76-0x00007FF7B6F40000-0x00007FF7B70A7000-memory.dmp

Download

memory/2464-77-0x00000187D6210000-0x00000187D6276000-memory.dmp

Download

memory/2464-86-0x00007FF7B6F40000-0x00007FF7B70A7000-memory.dmp

Download

memory/2464-84-0x00000187D6210000-0x00000187D6276000-memory.dmp

Download

memory/2464-79-0x00000187D6210000-0x00000187D6276000-memory.dmp

Download

memory/2748-155-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2748-119-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2748-125-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/2748-120-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/4116-47-0x000001EE95B90000-0x000001EE95BF6000-memory.dmp

Download

memory/4116-48-0x000001EE95B90000-0x000001EE95BF6000-memory.dmp

Download

memory/4116-46-0x000001EE95B90000-0x000001EE95BF6000-memory.dmp

Download

memory/4116-136-0x00007FF7B8900000-0x00007FF7B89C8000-memory.dmp

Download

memory/4116-42-0x00007FF7B8900000-0x00007FF7B89C8000-memory.dmp

Download

memory/4528-89-0x00007FF631660000-0x00007FF631779000-memory.dmp

Download

memory/4528-153-0x00007FF631660000-0x00007FF631779000-memory.dmp

Download

memory/4528-91-0x000001C14CAF0000-0x000001C14CB56000-memory.dmp

Download

memory/4528-90-0x000001C14CAF0000-0x000001C14CB56000-memory.dmp

Download

memory/4548-118-0x00007FF7B8900000-0x00007FF7B89C8000-memory.dmp

Download

memory/4548-33-0x00007FF7B8900000-0x00007FF7B89C8000-memory.dmp

Download

memory/4548-34-0x000002B043030000-0x000002B043096000-memory.dmp

Download

memory/4548-35-0x000002B043030000-0x000002B043096000-memory.dmp

Download

memory/4548-39-0x000002B043030000-0x000002B043096000-memory.dmp

Download

memory/4836-68-0x000001E238780000-0x000001E23887B000-memory.dmp

Download

memory/4836-70-0x000001E2389A0000-0x000001E238A06000-memory.dmp

Download

memory/4836-69-0x000001E2389A0000-0x000001E238A06000-memory.dmp

Download

memory/5136-111-0x000002ABF1640000-0x000002ABF16A6000-memory.dmp

Download

memory/5136-109-0x00007FF667F30000-0x00007FF668079000-memory.dmp

Download

memory/5136-154-0x00007FF667F30000-0x00007FF668079000-memory.dmp

Download

memory/5136-112-0x000002ABF1640000-0x000002ABF16A6000-memory.dmp

Download

memory/5344-102-0x00000236E30C0000-0x00000236E3126000-memory.dmp

Download

memory/5344-98-0x00000236E2EA0000-0x00000236E2F9B000-memory.dmp

Download

memory/5344-99-0x00000236E30C0000-0x00000236E3126000-memory.dmp

Download

memory/5368-2-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/5368-6-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/5368-0-0x0000000002940000-0x0000000002A55000-memory.dmp

Download

memory/5368-7-0x0000000002860000-0x00000000028C9000-memory.dmp

Download

memory/5632-60-0x00000189DDF90000-0x00000189DE08B000-memory.dmp

Download

memory/5632-62-0x00000189DE0E0000-0x00000189DE146000-memory.dmp

Download

memory/5632-61-0x00000189DE0E0000-0x00000189DE146000-memory.dmp

Download

memory/6084-275-0x00000279DBAA0000-0x00000279DBB06000-memory.dmp

Download

memory/6084-277-0x00007FF625DE0000-0x00007FF626523000-memory.dmp

Download

memory/6084-156-0x00007FF625DE0000-0x00007FF626523000-memory.dmp

Download

memory/6084-140-0x00000279DBAA0000-0x00000279DBB06000-memory.dmp

Download

memory/6084-139-0x00007FF625DE0000-0x00007FF626523000-memory.dmp

Download

memory/6084-141-0x00000279DBAA0000-0x00000279DBB06000-memory.dmp

Download