999b60edba0f164c0b4fcf27c3b5098c740688e7d630ad9243e21b3c73eb791c

Analysis

max time kernel
139s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260808-d3yp5aswas
SHA256 999b60edba0f164c0b4fcf27c3b5098c740688e7d630ad9243e21b3c73eb791c
MD5 5c59a72fe2d50879e9d6be23029180e9
SHA1 3b9f5c9553509b499780de96ad367a81dc58b129
SHA512 e8eee3bcfb3d640fddc29c00fbb32918e56a55dcfb6a3dc19b1a30c00ad37f70a374a206aac15aa3bbf924d41a72e8b7992a9cd6f47e835d6b9699959496f208
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJOEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:zul13qcQFTIOZee4W2pTVtLk2PzFzc2+
TLSH
T1DD45E01ABEF1C032C12312319E6AD358A2B5F4B248264447BBDD671D6FB15D38B39B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4264	alg.exe
2000	elevation_service.exe
1132	elevation_service.exe
3960	maintenanceservice.exe
2036	OSE.EXE
3516	GameInputSvc.exe
5976	GameInputSvc.exe
4888	msdtc.exe
2232	PerceptionSimulationService.exe
3088	perfhost.exe
4468	ReFsDedupSvc.exe
4520	locator.exe
1744	SensorDataService.exe
4748	snmptrap.exe
4384	ssh-agent.exe
5764	TieringEngineService.exe
5228	AgentService.exe
3412	vds.exe
636	vssvc.exe
5508	wbengine.exe
1620	WmiApSrv.exe
5528	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e515aad183806d8d.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5976	GameInputSvc.exe
5976	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4376	2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4264	alg.exe
Token: SeDebugPrivilege	4264	alg.exe
Token: SeTakeOwnershipPrivilege	2000	elevation_service.exe
Token: SeTcbPrivilege	3516	GameInputSvc.exe
Token: SeBackupPrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4468	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4468	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5764	TieringEngineService.exe
Token: SeManageVolumePrivilege	5764	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5228	AgentService.exe
Token: SeBackupPrivilege	636	vssvc.exe
Token: SeRestorePrivilege	636	vssvc.exe
Token: SeAuditPrivilege	636	vssvc.exe
Token: SeBackupPrivilege	5508	wbengine.exe
Token: SeRestorePrivilege	5508	wbengine.exe
Token: SeSecurityPrivilege	5508	wbengine.exe
Token: 33	5528	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5528	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5528	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 5976	3516	GameInputSvc.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5c59a72fe2d50879e9d6be23029180e9_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1132

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2036

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5976

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4888

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2232

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4520

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1744

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5508

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5528
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 15cf257bfb6c37d0ce951bcd4b55c651f72d20467776f6bcf871581653f65621
MD5 c16e03ed9233ee8b71eae4b004f4fef7
SHA1 9dcaac4e5258ce2d5fd0f737562a9572e0f65cc2
SHA512 bd684606a53558d5f3a17f8cbb6e06a057df2f7fab4f487ed6bc87ce4c205765fe7ebd0c546043ace2a1838b007b25f84ae8128faf61c1faed279f25315c0516
SSDEEP 49152:vMG632BuPkFKRrdE6oh7stBhuXjfS4LWxn64W2pTVtLk2PzFzc2+:63q6gjBqW2jp3zFR
TLSH
T188D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 2a5251fcbd16d0be1ce2b1b01dfcd0b0eb464dd6b6ac3fc492033338dacacae1
MD5 364836a1e519ae2b84ca11cc83e39863
SHA1 68e3d4b62e530bbd6932e4a4406cc240d7f17b84
SHA512 242615a6483552abb4b338dd50a64f222e2a5aed23e2975fc374d0710bdb07e3d08a6d65cc0d247b4b25a6c66c09554321e2c856815a4a4ac6203f8d9ee6aa99
SSDEEP 24576:6XYF4VczADEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:QVc64W2pTVtLk2PzFzc2+
TLSH
T1E1050229B3E508F9ED6B823CCCA28505EA33B8554760E78F03E499655F633885E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 213ff4c1416c0e4089a48b53634fa5a9b147312fa455994c38b6790953e67d55
MD5 04b14101d1f59ca55c1eda55c62f1f72
SHA1 a6f74dcc3b4281754d111f8038c5d1d379ddcd52
SHA512 b98dc3ea397fb376a5a9454278d31bcbbb7cd9a33ffe28ff6a251755f04ed1f2cdeaeffecd96dc3bab8f8c4a1914a9e565de436109983568c2455eb18b6f6281
SSDEEP 24576:F0QedS60EaxOrMuGEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:FqS60LoVG4W2pTVtLk2PzFzc2+
TLSH
T1AC35AE16F6788335D073C0B9C5D2A68EE97230865B308ACB4286D77C7E677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dcd18606ab4c94a134a2b22bbc1300cfc8ddf8507f0abdde3fe97992080ddbef
MD5 94b251e34cbae077a6b1341767bf4716
SHA1 1dcd125e48dead57f2c0ebe89d937ce57f0dd03d
SHA512 c53c087bc1a82710d0fe927a5f1312ed82cbf891fbf97c2399dd4c6bbe326338d77141dd7d4fcdb44416d34d1c3c2b153c227bb466cf030bfe57fd7179d3961e
SSDEEP 49152:o/ezSC6vUzPvuHjyN4W2pTVtLk2PzFzc2+:cezSC6v2XuHJW2jp3zFR
TLSH
T167755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d857effb4f73aafdf0135553ba46dd43332b04b2e0685545499c32a0ab33b063
MD5 d1f8befb27ec17c995b6f790dea5b929
SHA1 ed462470c3a1e54ab70e14a4c0233583f033a602
SHA512 fd0a7f8fc218c0845af702ca0dbcac78d6a3361b20a691f941c0947c892928a3d48901629baf7109103927229af84c4db165c07662b8d0577e7672dc8e5c133d
SSDEEP 24576:eabrPWul6v/l+dkEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:eaGul6Xl+O4W2pTVtLk2PzFzc2+
TLSH
T116559E66F5B48331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 a6ddde51ba38e1df27c58abd53dfccb13a7149698fa1b0481ecac72c7fdd7f9e
MD5 5e6eaeb7665c82f435f61e6adc52f7db
SHA1 c0560b0525ec8a2ba3d7b64604df64386af46033
SHA512 1b392ff08d71746ee6a8f2308ceb1f18763e9332a1229979bc85a28bf3213f56a2bfcd1f682d3758378ae699e6d90520abfcfa706310d4952ee740f9193249da
SSDEEP 12288:Q9cPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:Q9cEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T171D42393DAAF5299FB6E1331B61237CC4573BB1D2A6BC60D03A67D94F0E9146C911F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 14b8e1b0dfcc2395edc36515e2a8640ef15e6a047cd02f181e8abe583cf18363
MD5 84fc517642962971548b7d19750f3b95
SHA1 a10837765ce898c2993ab923d2ec04693ef899e5
SHA512 3b667b34c42284d8d6b1b9a121b44f142d2af7a0e2beb9c5bca1ecc88992985a1efbff230713bab34a90e5b18b81cad6453c24ad006a65c706c61377237d691e
SSDEEP 24576:1JIUQEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:1JIUQ4W2pTVtLk2PzFzc2+
TLSH
T1A515CF7BEE28FCE2C27E49B86A518740D77274304F6293CBD165820EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 327b5a8cefd5a32fd17855e144f9ba17c9e2751a0d8d028b37b5ee50a2202983
MD5 cd694c3b9437cb103c4e411320097fe9
SHA1 e6d8ec56b4745fa507cff96af99bda6db3db8991
SHA512 a9ff78d2cf08b973412cd8de4ce12ed32dcf1efe6a7b13b68aa265087ed04c87395929f8cd498401ad3b2327e92ed6f2e3a0f9531ea2db08854fb0309c06ad3b
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3TH0:DQvGAdlCEL8c/NRNw5CKW2jp3zFR
TLSH
T18A367C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 8cd198e6b82e3479365e376fb0ea4ea6e9b55d0bc511188957ec54d9e5fb9b45
MD5 513deb3f545ee7a14d6b5287bf8df075
SHA1 129a1b4a9b8a64395419b7e4183da3b672d82eac
SHA512 10ba248a3393dc22aac59b11680e292bf9e58dd3702668cba661481334732fc862d53dc1f9ab4c4a648aa9945499176333fde03b47b1a52609f2f402498b22d6
SSDEEP 24576:fmewsAj5EVW2X9HPfT7BtXtf9k2P7XFl9c2+C:ulj54W2pTVtLk2PzFzc2+
TLSH
T1D215E031FE75E036C77F0DB22B26D70A143D7A204B621AC3E3E89D9D59602D22776E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e6adc4d24131c16755e1bb9d1b0c116c0ad8e127a293ec3814945237a6890e5a
MD5 9a445bde4238f1fff34f33379a2b19a6
SHA1 08db3ee6bad23a2e463952db69c5138953c9947e
SHA512 43b19c84e4a69906d3377ce2767f9001818d844ea014b91e77df4821c041fb9675830671e743a9951f9542367a443779dd6b22188dd4d822d94b38cae537af64
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJH+jp3x:FUEtQevvqc2W1cpV2X132+13x
TLSH
T110474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0ff115b374b2e760a142ddc6b9f0d260e6dd50c4a046a63080ef3a5f553dce3
MD5 129b61c2cea1d67301cf4fe6944146ee
SHA1 2f579fa38ab4440c3f0996d2f4e3658708cec48c
SHA512 22f1c8936a7d821707ba2c0c2999cd750a8ded22b5739e4f80a057b7d071cdcbc8527e245fff515b28cef6b9177ebfc54cc99b071f930dd37a199f41f258a526
SSDEEP 49152:JXbRquA/m2yL5zMfFiV+XenmE3/ze4W2pTVtLk2PzFzc2+:9oq1VjnmaW2jp3zFR
TLSH
T1EBD58D0976B8C2E4D1F6C37896A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 df6e7715fcb7e7e5a502f91e39af85225a9e412b469b5d9e48e3b7b1090af12d
MD5 722cae0de378a722588ef0bca83116a0
SHA1 ab1f0cd2e6ef433d7bfa6736a2f8bc36b1568c0d
SHA512 2a789da1b4b7d4a48f4354db3919362628e48f40d77b978f7498e0221509ad3fc8d561a2580fa17b55bb42c605fb2b37cfd2f7cfc0d53a32353219740b2b7c30
SSDEEP 24576:BAhGLvBFoiwtA5l7S53xEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:BAMtFoiq5B4W2pTVtLk2PzFzc2+
TLSH
T13645AD81E7F955D4F5B3AB78A9B69170EA73BCAA5E31C20F1160D11F1E33A409D24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 e6840348b922d09d124841eaceb8fe68f62bd1d417216b2e486adcdce084e484
MD5 df10c90b3f3175cd01c89840d122788c
SHA1 92108866c8a5387d4822b8055a307fa708011a6b
SHA512 a83c3dac1886eedca4bfc5774636206d91262e5bd5ae5ff5f3a8f4fcff7e4b6b129a0274cd5fce7c32f381925f3e3b17f826112ef79ff82d25e294edca23321f
SSDEEP 24576:Owu+OW+EVW2X9HPfT7BtXtf9k2P7XFl9c2+C:OwlO14W2pTVtLk2PzFzc2+
TLSH
T1B005F14677E90CF9E9674239C6579136E7F3B8062A26C70F03A0C65B6F67311AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 ab1d265aa26444c19571c5410961c740aad8b6170ff6261ef64dedb404f36900
MD5 50cd8e553b6ec7916c9a862cdc4d3ea5
SHA1 727ffffc879e712b301c4d917ef57ddd331a61f4
SHA512 75740bddb8fbafedab463e77ce1e6a499d69d7cff0e2b5d92d54d39e6fd70c43be4f8a3d8a1a6ffbcf9ddb0c8ba15a9225894fa97c5e5e7960a29157d2245550
SSDEEP 12288:FXt1IA7PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2D:ptuIEVW2X9HPfT7BtXtf9k2P7XFl9c2D
TLSH
T11CE4129673ED21F9E6A71338E9A11788D3737016277783CF036546A86EA36C24E35B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2636ec46f91c2bca9f941d4c56d89db07e5a61ad2373be9bf1956ab39c184257
MD5 7d4682033d58dbbad9f9ff9e02ed19a9
SHA1 5f23b9ac84225a0e5c34fb0ce406e353e0e6cd77
SHA512 e98e57e36ddcdb4b0f493ea6ff6866a702addb3279ad989f90a7959161f7325e0ea263947797a5c811184aeb1c5a7f78c0e3565630334c8d5e8f1344870bd6a0
SSDEEP 98304:9QRQyi36YOcP8Lvw2gAf+PN3eW2jp3zFR:0QyiKa+X+PNojp3x
TLSH
T189667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4af4360107ef2faf4eddf8e987f1d43a19efd4b89d6661f1f38dceb2d686e67f
MD5 f1766f13ff224301107ca192dfb0b6da
SHA1 aff58731aa39130c85eecc7674ad2beef2bb5300
SHA512 9580386e045897a3ac75230db180c49a1fe7b7b1347aede0f29eb2c6827a1014a2598b89cef554a362f617ec3700e14d633e2910f3cb2778f294e186a66b2987
SSDEEP 98304:9QRQyi36YOcP8Lvw2gAf+PN3YW2jp3zFR:0QyiKa+X+PNmjp3x
TLSH
T1F0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 30868386ac754f64aa3d122f84d08b45428e9a83982b5ea3badc1739c7fe9f97
MD5 ac27bf17b883c026dbfc84cda50873ab
SHA1 c55b30811ead3b9478c0f47400a5bbe624d1ba1f
SHA512 a778678958736468afdab5faaabd54c9e5363425ec6e7d3813fb1455b3447a06cf1e981e375c9d47c39b4999b930920674f188d186ee85e4aab7ef4df78ea165
SSDEEP 49152:R68Qg55nhMeWu7PNU3/f4W2pTVtLk2PzFzc2+:PthbRc/QW2jp3zFR
TLSH
T1A0B55A33B2F60099C44DE1769F4A873196E27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 bbe0442c6298faf79b4b6f3f87c5f3bef630b5ad25df2bb2e91029154461f978
MD5 850e080def9990dcbfb377606667abb9
SHA1 4a37fc268bee073ad6fe5bff8bd6fa36c7e0c372
SHA512 df60156e9ae024492606b0d4b14949476ff00a2719e8372bd396f5687449285f287a57d1eb2f51a26ffa2eb87b513813693e364c4b1a3cdfde54ed1a58708e98
SSDEEP 98304:Gy5112gYy5azzVv569nLKnhZ9W2jp3zFR:3LIHAWh1jp3x
TLSH
T19A168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ce94d98e758cab2313b4094536ae23594a86f9ed0fabbcfc1753d18b3e8ba401
MD5 57f25f873aa23f17a199519219f4ff6e
SHA1 94eee73e9dddda3460234476c286cccbab65dc11
SHA512 f9ae39a516ef6123b84c915b6482dd54b298776e7b4e1a7e598910f5017509656af56470d4e88ea79e231aca7186489421a94e113cb529fc82e95e874fed5253
SSDEEP 49152:I8+taZ3usBWOBr4tEGp0bqx0z+n217aau1gln4W2pTVtLk2PzFzc2+:vu6JmTxd2d4W2jp3zFR
TLSH
T103D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f5f2e698df8818f5c92cda75468c0a85fe881223eedf563fe6931c06c6f1e16
MD5 7e35c88b3b0713857c0193efbf527004
SHA1 21be351d64e00ed38927229af2e7924dd9b3118f
SHA512 1407749709f12f28b5cb22c70e559ca10d4548977ef9f22d6d68180cc504620cf37c1f5d3ad9ff45ab0eb7176cc6fb66a246ea6930cc389ec47659ca2a8f9562
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xe4W2pTVtLk2PzFzc2+:SmifPbRUW2jp3zFR
TLSH
T119B5BE13F2D900E8D06DD17887569232EA72BC460B35B6DF0A90B7962F7BAE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 381173e962e20edd29fe4f30a0a84e2935202b864e57915e09a883f94b4fa8a1
MD5 db31f21b092e8e374308d0bf26317b5a
SHA1 82da61f70e3abef296fa0890dc1a073e7162491f
SHA512 519f39929ef315636b7fd4162afa471e996ffd068d916151a18712bfd79f4a5b694c5f2ec5aded9260d235372112134d00a3a6264f15ab10d90e7d2bff426be2
SSDEEP 49152:BSuZQIY0Be2K6RVtOnks6NMHqrk4W2pTVtLk2PzFzc2+:P5dKoi61JW2jp3zFR
TLSH
T159C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 50797120bb9b17573138075ff6fb2efa0715ca43ca973c90895468b63e9d7b32
MD5 c90ae0b0d6c7d8f0c50f27159a01886a
SHA1 ddab8553a14427702e39f4c4ef758a5be8ed6349
SHA512 f9832dfa860a3a6ca083494a523c52666e5a4ee4eb4f49001326866cec2552e86c0a588d5917dd566dffec8419e91e213663b6a8a25d6c9891dda23f7b55cf74
SSDEEP 49152:Z4BSn8EApI0figTgiDn0AP5ws4W2pTVtLk2PzFzc2+:nX2iyphiW2jp3zFR
TLSH
T12CA5BF13F2D900E8D05ED174C7468632EA72BC160B35AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 ed8535d7f9480a43b5111b17d90a2f3faf280343b3f0e2a4fc46d1d2ce10f564
MD5 760d4407c17f39b583569f6855ea7431
SHA1 9e536ee098bba0da05c676ef6128fbaf5a55d807
SHA512 94af6b6a454ffcd0fefa2e11f4b39390dc624a6aff84211b96b4b7e0bb470d77a7dca8650d7499ed8c2f3d09c0e3360860f77c7ce20dc3ee717329a9d931c968
SSDEEP 12288:NGPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:NGEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T17BD42393EAEF529AFA2D1371B61237CC8577B30E7A67C24C03DA6854F0DA6064A11F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 936fdc98429129e09e799f1b9214d9a5229b2acb00f1c610cc0750031736d994
MD5 e601c6d996754f6afc81ffd635845f05
SHA1 d20483e140a6332a281e4affb8a3cedf0f0b1556
SHA512 9c1b2ce812592d3f038bee0c04250ab412c80a6ae00991189fff84251c8d4201f91a3c82d835e3f8a06513e53f6109dead1515bc7681fbc5d31e067d9674aa7b
SSDEEP 12288:vqPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:vqEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1CAD42393EAFF469AFA2D1371B61223CC8577B71F7A67824C039AAC54F0D92064A11F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 e94b74c6e53e0f85cd59c7b3d3ef1b98b5fe9d4682b0aea8ce5020ceff90d4ed
MD5 52304d2caa41eeb467d7787aa50bd314
SHA1 8540b511a04cbe445c701b7193515be1ef81bf67
SHA512 ed5168c21f10f2e5288d5519779d58bc707bb97626c9053a897a3362d6ff14c0c635011b413ebfe9212528f4b7cd5ebacfc30bc83bb4ae5483ee58017d746e61
SSDEEP 12288:xiPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:xiEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1CCD42393EAFF528AFA2D1371B61227CC8573B31E7A67C24C17EA6854F0C96064A11F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 5d01664cead5b152dd47e7f0fa0c85468d48b94ba158d36e292b2c42bd34b42a
MD5 41755a0535f27801d43bac28bf913aa1
SHA1 797a464f3579b9fe09676f54bd9aab6d15978f13
SHA512 d067fdc50eb717667619d3bc45b3533da0b65b3ebee16406de4885651ed25a528010e75ae73070c87ac2cf3c81759b67b3caef03133d10ed238f70fa017e5e5b
SSDEEP 12288:Vl8PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:MEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T11DD42353EBEF01DAE96A5371E62223CCD2B3B65E6A37C34F07921C58A8E53055D21F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 b04dd1e446059a0a946efa9999b4790a6bd0b387cc83c7760d5cfe75dd02e2c8
MD5 8edd2a9bd28e2e5d68ad40ab1f787c9c
SHA1 2dac6cf3475324a0a04a8684b514e3d0cc801dea
SHA512 aa13ecaa58b5ee4ca76ef579062439ec747c952b49e816b7c6b75e6a545f417a5236d055ff2740f70e9e6236540cc2b6db47f8de13ba6e959efa1b19131579a1
SSDEEP 12288:gfPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:gfEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T110D42393EAEF529AFA2D1371B61227CC8573731F7AA7C24C03DA6864F0C96064A11F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 9e58aa3ef6d624756beab41a43646a0a87c33696f6dc9f3a855f7ef99edb70ec
MD5 d64e4ba9af9a002eb738626cae3b40e0
SHA1 f0efea43cb8413afe75d32ea4dd00b0be1334551
SHA512 eb712faa8c726a10d945c810f2fcaf04c78733b87c4c3b61db2da3fd18bd67be2b0dd85f5497313bad0971ed3c26655c438cc1d9b2a2590d305367de35fa03df
SSDEEP 12288:zyJPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:zyJEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1FAD42393EAFF529AFA2D1371B61233CC8577731E7A67C24C139AA864F0C56064A11F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 ed5547ae4d4383055240e7adfee60a704f7114e2c295de48d0a2b0be5e1d35c8
MD5 85726f20a4dfd3b196b9ea222e63d33d
SHA1 feceb4213211a2d046432d868bacd398fd10812f
SHA512 1124944b5ac7d1756316d76b5e766c7b06859236ebdfc19e2d7e1262664e06f32c60b31eea84b988d35e3ea873e8b9627ba2e23138c172454c134d8e34066689
SSDEEP 12288:I1PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:I1EVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T134D42393EAFF468AEB2D1371B61227CC8577731F7AA7C24D039AA854F0DA2064911F74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 3c21c71fa4c7ba4c2c5e7eb708bc339d19623aa0f27746244287a381e3195968
MD5 98b84962ef615d9d884e3cd3d8ccb43e
SHA1 d12d246e137cc6aa732cf5f9776d6da43955fe35
SHA512 dac5787a9c1e309c723eed338c960a24d6ead2aad7d2b0fc3fb928fb75089b1cdea700b0d76dcd270f283fb154d1dc38985cec7fb0f0aa0561a6f3315bebca8a
SSDEEP 12288:eiZwb6szFEoSQcPvyMXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:BZMtzFVSU0LS0chkrP5lSgBj+iUWf0
TLSH
T1611501A5B3A018F8EC66813DCD668906D6B17C5A4A70CA1F03F5361B5F333911D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 2c2f533c22cb85eb88e0be5cb672857f32e351e55f487026be737330e4d03174
MD5 fa56c4a98b2b28b65b9539059bae2b87
SHA1 1e16f796f77628538d267cb293442fbe76d4219b
SHA512 a4a01c644662455c3f752b2b3384289d66dad5473e04c91a6ae5df1f61ea74ed753773d2f4c6d5a2a97a4adcbd56e4d3e47f29e902659001279aa8d08749ee88
SSDEEP 12288:CSMXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:CS0LS0chkrP5lSgBj+iUWf0
TLSH
T174D42361ED7A18FCFA04E1BC5DB7869EE98499DDC973F88202F3440E5F50584398ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 b3e1692685a5f7a753e3cd013d6bdd73739f4f2bf8a5642a3ec7c558dc21c6b4
MD5 ef7268be2e4e690d01e3743950a21fab
SHA1 bc89e4b23344d7fe70427196e30db1cd2c3f9f00
SHA512 d425cab839b358b5f9c1c9d5f3fd2f294f20b14347a4ac5aeb17927898de15e522ee2154b4e276b3a33c8f23453d5f726d327ad50c20be197deb5a09dd8468e7
SSDEEP 12288:sIXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:sALS0chkrP5lSgBj+iUWf0
TLSH
T1A5D42361ED6A08FCFA00E1BC5D77869EE58499DEC973F88213F3440E5F54584398ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 c94316ad0a95b6d9d3d9954f61ee05c1986290255457330de4deb931f729f41d
MD5 aef2fc46cf950b60573928dde4389708
SHA1 e27af7762e4ed3772c564c010ccafb52d9cb35ad
SHA512 66e8ff297be999dc0e5623b3742ec285dff7e98f6c3fc9eb51e8a74c9f60809b2247020217c02ff09c1578543883ad46173d0dd7acb88fcc1745915c6fd5de8c
SSDEEP 12288:p/P1lLt7XbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:Z1P/LS0chkrP5lSgBj+iUWf0
TLSH
T1E9F4021377A530FDE526923CCC625A06F770B8764731DEAF13A1463A1F236906E6EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 9e71c5c74aa881e7a3ee1fb8945072bc8601b9c0d5e640cba755ec0e9af79d53
MD5 a20363129bd9635d8825cdb298aa2172
SHA1 e1bc434c00e7f2055025dbd47cda41f67be1f6c0
SHA512 3709f702c8f92b2dd64779a1a42003838882e6ee52c72d9a223739e06f4edc901d6ac9260dfc892961225004cb10d182cec3a7e4de254aec7440557532ef7160
SSDEEP 12288:qXXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:q7LS0chkrP5lSgBj+iUWf0
TLSH
T177D42351ED6A18FCFA04E1BC6D7B869EE98498DDC973F88213F3400E5F54584398ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 0d133eb0ae6b808a87f59d7fbee7a77bf1302eb396b2b676ad2502e796ff18a2
MD5 0c2736246eceeb8e3754f1ca055e1fae
SHA1 1ae3bbc5cf614936af0f75771e940e0260477fd9
SHA512 3e95dbe8387d89ce3146c92dc48fb116ee66c0b0cacaa6219d2ddeaefb153f2bd0f627e446edc46d1f298422c043468e1ff7ba2054166fa0304383bd78a28b1e
SSDEEP 12288:OGXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:OWLS0chkrP5lSgBj+iUWf0
TLSH
T1D4D42361ED6A18FCFB00E1BC6D77869EE48458DDC973F88212F3440E9F54584398ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 5e5f76bb82833e22a676084f5f55243061532fda31eb241bd277dd8138b76f31
MD5 87e5e5a294c29ceec7a3e8f089a3b313
SHA1 86c51c00235fd3cdfed2d96ad209871a01ab95f7
SHA512 668f27ea74c1c3c1b1c4f2a5cb898b44cfb6627f4120ec42d23766cb6e76c0fb9bc94743cab54297ade12645c80540d47405c984e524c1c476aa2e4e1f342cce
SSDEEP 12288:o/P1lLtzXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:I1P3LS0chkrP5lSgBj+iUWf0
TLSH
T1A1F4121777A530FDE526D23CCC624A06F770B8764731DA9F13A1463A2F236906E6EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 d5cfd47f98a23abadc4c1ffc68c20e8a03df438d7abf0a5f7b6bdc0eb8114667
MD5 ccd188c0843d762b1f8f36682443fc37
SHA1 a8f6586588cb90458be93d684e9da5e0a5d0e263
SHA512 7d09d31fb6faa8b650971e6b93d2f4c67e9d7dfb4258ec5f96f507734c8ce284d49efc5876e0021489e8378fd09a993bd551918275793f8fdddab781d538c65e
SSDEEP 24576:cTqaLl3z0zJSnLS0chkrP5lSgBj+iUWf0:cTxLljzS0cW5lRKf
TLSH
T1331501A5B36018F8ED66813ECD66890AD6B17C5A4B70CA1F03F5361B5F333901D2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 b2ab61139cb2fc9dd5179176acc809b34557b3c43a2c36e1f3874a6a22a97275
MD5 97ec165f27fc4c5daa71e7715a58915d
SHA1 2720034c6d070d265c386e65ede3444d9b2b31f5
SHA512 5714542756e8b474a2b10f503269800434618eabed40d6b8cdb194483ededafeab63aa53f6b444b7ffd8b9d4c10262d8a1094029eee5c1feb94e20741e050b9f
SSDEEP 24576:y32dLCHay7/SULS0chkrP5lSgBj+iUWf0:U2dLCHayjFS0cW5lRKf
TLSH
T1F135CF90F3E414E8F1B79A398D764512DAB67C991B31DE8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 8dc918419aa8ad0752eba450c07ad7b1392b81f142f88b9d9bddd7091f014eff
MD5 dec4cdf34a25036fa2f5a7c34138c1e5
SHA1 49e321ec048783fa23be654f2e9888e9ac65a61f
SHA512 f5153a7d855569e2f21615410ca1deea32e502415a699f9538e99f763f55ba45ad0c97e3b42bf77faa4d7a3961bc9ec94caa8bf2ae0160fcdefa907195e8b68e
SSDEEP 12288:osXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:oULS0chkrP5lSgBj+iUWf0
TLSH
T1F7D42361ED6A18FCFA04E1BC5D7B868EE98498DDC973F88213F3840E5F505843986BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 9d9cb76a6ea47d54d7e600c4792fe3d5405e8471b37bc36ed12c8870a3dcbfbb
MD5 cb6022a97e825dceba2b9e61c24391fd
SHA1 9ad61a6e6ac5046f491ec766295fb5d27f7a5903
SHA512 3cc0bacaf4e0d34e3601dc6b1d300b0c4d479da3cb6a994ce9d5206f7ce41683edeae9dbad4c4cd6df2a0494a86224795f9e23c257438c08180c9f79da75916f
SSDEEP 12288:imXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:i2LS0chkrP5lSgBj+iUWf0
TLSH
T15ED42361AD7A08FDFA04E1BC6DBB868EE58499DDC933F88213F3440E5F545843D86B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 1f3d62febb52b7f2754146fab970a15876fc80f7cf77213b7f3ed7100c8f8e0f
MD5 670ceafde0e2413f48348721e1ba2b2d
SHA1 0175d04be86df26106005eeb55785c74f932d157
SHA512 00eff5121c0c60d64fafadd7f017ee7b006fde75f1420d9b3848e2b83476594eb2155525ebbb389aa96df3db47a335ea5eab88b58e7bcc93dd88941373c528c1
SSDEEP 12288:fEXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:fsLS0chkrP5lSgBj+iUWf0
TLSH
T1EDD42361ED6A08FCFA04E1BC5D7B869EE88499DDC973F88213F3440E5F54584398ABD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 b1ede3a2ddd017bbc81a902b707e18247fda54d875eb02fc20af139750a6c4aa
MD5 72eda90f183667e836d9b918b9682470
SHA1 90d0075a462d828cdc7e74cb9095cad5f559329b
SHA512 ac2780903fb070d82550276744eb26216f51634822d1235b3defe517f5d9ee08ea44bbe8ca8fd392b0cd22839d94c301bf1d8041f3145b8447c79bbcad683dd1
SSDEEP 12288:8hXbMFaXix+Oschu7D08n5uA5lBAjglhBj+iUWfUL:8FLS0chkrP5lSgBj+iUWf0
TLSH
T1D9D42361ED6A08FCFA04E1BC6D7B868EE98498DDC973F88213F3440E5F545843986BD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 a80f12ff35f1a93c588bd857602723b5e15eb9068f04fde388e43cd3f1740e42
MD5 e08b8edf9e3772bb75f51c4b57b5643d
SHA1 351a1ab95f4b77482d6e0727d0b776edda5e1b28
SHA512 a97f7b743d771a725722df4b36150a5cec3aefae58c13a29fd87c1c3a1c9b5e592c435f16fb506c65808c3995042217c67f6f97c62836b18bab7be3791b26573
SSDEEP 12288:99sfuPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:WuEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T130F4015AD2A902E8D06E2275D7125684F3337D2997E2C38E13D0F93D2FB66409DDAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 3d8e74a451cfe8507a11ff95d4364056ae906592f347cf0d7c1f4ee9798a8992
MD5 05bd04fc6b107c4bde00fd8f9f3c5f6f
SHA1 eba3f32352e12e91ed4dace9bee48180d3c42c19
SHA512 c212fe21f91f1ccf32ab7eb2cd6cded8f10a43c160bad8ccb126108f7cfb61c86c30bca08d07c119730b94c3964b1c73679ff7d3a2dda00ea99fb22ef7e97563
SSDEEP 12288:co79PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:F9EVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1CAD42363EBEF564AF93E1370B51623DC5137B31E2F23C18F52866994B0E56828E21F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 bc7d06fe630d3cf38f3a9d8d224c5ec7f7c6bb57c30d880d0866b219e750eee2
MD5 93b0818780d4caeb79528736512856df
SHA1 f24a560d81f2ed02256f15f57f83201b8809f37e
SHA512 11473d79d53a417c4c78e023b4edf68aea85bdb0903973c504a38c1d2fd533388bbbc38957ade8e1bfbb23c22df2a1f28099c226c2d85dd4cefa2b2ab639ca4b
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYREVW2X9HPfT7BtXtf9k2P7XFl9c2+C:+gb4mBIBhGFK4W2pTVtLk2PzFzc2+
TLSH
T16165AE1E22EC02F5E0FAD2B89DA64417D6B378161732D2CF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 ebef474a94af3fa16667ad6ef8ef435b4557075dbf06eb8138e0008e9f4daa71
MD5 cc8620243d88b6af99a40fbc78f9833e
SHA1 0c8318097c97bb37d2a91c39344336d73a48e1bb
SHA512 02dca915c2a7646c49d00a5e1b4bbd00543d95da5bb45240ea2857cbe1dd97ee5f75867c436d944d9098014cca863c9a2aac0033e7d0c2add4ad799175fc13c8
SSDEEP 12288:kKGJPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:fGJEVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T11CE4236BB6FF31C8D93E4335A52123D9B47332242B2782DF06E1E874EAD56D05A39E14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1ec1eaf3ed686af9e7471c78c6a8d89fd9fe470e8f897c2f5d3b78886d73a1e2
MD5 8a5c2e903915e1fc1b594ff8043eb8f2
SHA1 bf9ab07b614ae40e4ec8baf9c546a5d2bbb39559
SHA512 77fbcf52bbe71df4575eb6345621978b2986e28501f9a56bffe69a8c421f0d272f71c80edc213b7ac399f9c47b0c99d33107d7268faf83bd77cd565a0d83bd07
SSDEEP 12288:v6PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:v6EVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1F1D42393E6EF568AEA6E1371B51227CC4573B31E2B6786CF03D66854F0C95C64A31F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b0f6a385a2e268c025590cdd85fc20494ca996288be0c1e4ed85502a3555f2d4
MD5 5b2eaf2572d2426bf716b5e6c85abe09
SHA1 5de6a86faa3b07d3d326b26899446a06a7a2e55e
SHA512 5bcad14d3d1cbfb8e74706b94dda04179fccbfb883f2c4c2bb60bcbdb4d3440f5cec7e1e9ef88c5c3cb6cbb545417dcfc5941a9ebdfbfcf3576afc26592c202a
SSDEEP 24576:ogO8O84cJqH1Mzria7/m6EVW2X9HPfT7BtXtf9k2P7XFl9c2+C:9t540qVra7/R4W2pTVtLk2PzFzc2+
TLSH
T1F2350165B7E502F0D47BD1388A4246A7F6B2B4250365EBDF07A88B511F23AD54B3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 6e623874afa8e052ffe362e55d45fec17dee40b88c049dff4586c85a003000c9
MD5 941b9d946ae7b207992cdf9708c38fec
SHA1 9bbc16a96021a9b81dcbc4bb1f48853ce6d9b8ca
SHA512 11d9eb810aefcf9fe8d71d3a568e34980cd7c19e6a508c2b5f6352f1f09da102ac6950cc1bfde5a686107f41007b98fa4ae182d3b0ded355d1d24c841b537479
SSDEEP 24576:HPUr+NQCEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:HJQC4W2pTVtLk2PzFzc2+
TLSH
T1DE05F12F62ED18E5F67AA13C8542470DE772B4661712D2CF02E0817E5E67ED8AD39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ffec1651f18e539cdbc82d49948c06caf543473d929af144e39bd1999e941635
MD5 d01faa94eb7cb8d0d0c99f99703d9122
SHA1 573bfaeec5512267b8a6fba6deb20680edda3d1c
SHA512 3ce4172508a82a8e4d6167d3e5b62843f6d6a4b7343f7fbd311e21b2d61343baaa3446702ace183be530b096632c47e1f7673bec4955793c426128a239117108
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjX4W2pTVtLk2PzFzcr:UG05lO43bPW2jp3zFR
TLSH
T121D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23415033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0693a04c580a2e94300c9c9acb3662d50b963bbda2514e5a5625185fd31b2d31
MD5 045942c86ba3d3f6f6fb71f91c720ce5
SHA1 27b609a8a6d69bba77c11fe703c45aa5e7bc74a8
SHA512 8a47da2a10e723608afa921a64fe71b58ca1eb45c36bba58b45a20b0fcc368469d8fd6cd8f23c90e6c8c9ce588399a7fb4cb861f0fd8e37b2c053eddadc3f4b7
SSDEEP 24576:FKa5POZ3dpbWVM50JicR2hG0lasx2+47eidn6IkKFx6LMcFrlZ0pkeTWz8IJ8:wa5POZ3wJt2pasx2+mnhFx6LZOpkeTWT
TLSH
T1B565AE5EA7F801D4D5B9D17DC683461AE5B1342253319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a7d460f9d30b5ef27e700ef1e13097e37a4338581e9766f872ce93374e27e854
MD5 d680cca29b0caa8b30139e16570ea2d9
SHA1 265df393826f60316e675bc4b6c88f1b6fcb8a71
SHA512 9986f4532e39a6d24a8ea2ae7cdc2a38583732e66a03e0811fe31399ebf319977ae5ea6be28ded2d30719c59f4651ee54ee20b03861b0e5bec9a4f5e03402c0d
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FknEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:lNc/zEOVHF84W2pTVtLk2PzFzc2+
TLSH
T136858B2623E901E4F5BBE1BE89779646FA717869133086CF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 384327cbb64a1fc75602eb8f2cf5a1dd24997b64f00548def78d67f63f550f1f
MD5 e187f7d4dd59cd558bb1becab23559e0
SHA1 ef7354991d082db8ebe2b48a97cf1b3acefcd956
SHA512 7dcfea4ae408485f04a63a1d06d56f840bddb9d003292d287bfa4cce63bb905e91523275c01c56b0c53f1f1c283e013bad817ae22fd0bdf841921f3b21138a18
SSDEEP 24576:8JnJPbzB4SJEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:8JnJv6SJ4W2pTVtLk2PzFzc2+
TLSH
T17C15D03DD2A810E8E4B7C2B4811A1799FE72347D2F2669CB19B4D5343F52ED0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c5ea145dcf655ee49a309b4ce908b8e53b53520f8b8a548f52074396f9834551
MD5 8d11e460acf18690f01045617fd113ef
SHA1 247e761e5492e26b9a0eb8954e46a28e8f5c0131
SHA512 2601ca3d45af40a2004c1713497b18c8031252c9da660ba092f144eb65b1dd90992a0e9be7089ffec2ed441466fc8a86d107557401f70ba5304b5684cbd19ab8
SSDEEP 49152:ACLHGeeV5ijCmlDWDkWhFx6LZOpkeTWdJ:bAFxh
TLSH
T185A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 3d8d649d46fe16ce772a78e5171c9ed69b23f899f728cd4e59f41a6b7332b7ca
MD5 b23c8dda6435559ec5cdba18f91ed2d4
SHA1 a566772673eca3f0a22c527ce2e7f2efd79ef6b2
SHA512 fbad0d6a54adc5c5a512e8092a232cc37dd6d21628e8c31f8dcec4a81db8e0032a72b58e27ab3fdfbeb6189bb686f4b17af2f346bb11c8b734af0346aa66f030
SSDEEP 24576:/6DIEEVW2X9HPfT7BtXtf9k2P7XFl9c2+C:/6DIE4W2pTVtLk2PzFzc2+
TLSH
T16AF4015D73BB10F9D16B913AD6830245D2B2B17597224ACF07D4C9B99EE3EC8B938E40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 343facef159a54d429e09ae48b7e28b0da6327aeca19f454dd7cabf8e42ac46e
MD5 87b34cef1adeaeae1795c30ea741300b
SHA1 2658c85b8565779c9221a87f1f1c8fce8e7227d8
SHA512 c9f5e0f3297582e19b4589b86b6a73507381d576c543d9c1fc59e2b089a0f982f348ec9863693ffae9bc0b6a84d99ab1af133862dc0bd097dabd69fab63c7f92
SSDEEP 12288:XG6kyYPNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:WtyYEVW2X9HPfT7BtXtf9k2P7XFl9c2D
TLSH
T15EF41201A3ED61D9FA791334AA2342D88A32BD245B2283CF12D1EA3D7E767C59D31F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 27b7429475402207c5a155d5b8fcae757e07fbd9907c4d4ddaecd5d092f38f49
MD5 533a5d80eea307cd3cbbe67ddc7514a5
SHA1 0100a3e5777a9697db16eb9b29bf184efc2357b1
SHA512 dab5e02ae01ca855007ffc100f09db5788259c0d42c577ab2267c4ab7f891c9a5c5e92416c71600a67f76e77398afd6212b1c9c6d41f1f2c57360c8b420917c8
SSDEEP 12288:Wj1PNmVW9MXgnvIpEg3XWhnRsfTVROwBHN/PtCcyiTuXcM2P7XFiGkceWk2+C:i1EVW2X9HPfT7BtXtf9k2P7XFl9c2+C
TLSH
T1FED42396E6BF2289ED2D2371B61227CC8173732D2B6786CF16D5AC74E4D96C24A31F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 3262e723376c8b2dd3ded17b4fc263d6830f79bed71ffb3ed5363dadf6190621
MD5 437d8c0ed601fc26f002e6588d92874f
SHA1 673551268661df6916a204bc443d4133cc2bfe48
SHA512 f96049a077ad79699cda2d0285d51401c1f20e71e3b9fc59ae868f6ead2be3ee6fe1ed1b637ce41896b5b196b94a8d3bfa34333108ed2afb8011c83876fac52b
SSDEEP 24576:t0g7LoTfaidZZIkKFx6LMcFrlZ0pkeTWz8IJ8:ygwTrZKhFx6LZOpkeTWdJ
TLSH
T1DC558C1DA3EA05DAE2B2D235D9631493D633B4315772C6DF2458C03A4DABED8AE74F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 261c89c0d4f267045e6ef91dd752cbd73db505ed78cdb889114b4e489cdea904
MD5 fb708a1e5a6f853486df37e5f61c709d
SHA1 6bb909661d7a70ec7914121781153f71094d66fb
SHA512 35370679fed6e94b2d5bc7e95d8a92406c251c4ec63fc8f988ced82428dd7010e5ebd369b673a8b6fe1d802c5cebdab3646db4e9efcd1129de741b9736c9ff1a
SSDEEP 12288:vpJcm8CNZLsjoG0W/9jzx6L/McF6YnRz9nZCYQUcd1gUv+7l/kZ3OUWKSjo2CnIq:vrcmRZIkKFx6LMcFrlZ0pkeTWz8IJ8
TLSH
T13F05F11EB36E00E5E2BBC13C8B820145E6B37030676157DF52A5C77E8E57AE97A38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 770f3300bfb3ac35cd18e9be158d7d35e6c00b3c4f38e6ea44764d29c39a9685
MD5 4c4ba8d9cedff775357160e8eb5c1a15
SHA1 558683f408aba350abeef588160f31c447fa7040
SHA512 5344bb76cbdf05627c6d87d4c727ef596ce65cf1876f4c4b59399fbc7488e331a0d067dee9954cd846b2820a4faebcda53c8529ff813f2288da898cd57edbcd1
SSDEEP 49152:KDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3thFx6LZOpkeTWdJ:r3Upow8sB0Fxh
TLSH
T1E6A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/636-363-0x000001BBBE2D0000-0x000001BBBE336000-memory.dmp

Download

memory/636-361-0x00007FF61CA90000-0x00007FF61CF60000-memory.dmp

Download

memory/636-448-0x00007FF61CA90000-0x00007FF61CF60000-memory.dmp

Download

memory/636-362-0x000001BBBE2D0000-0x000001BBBE336000-memory.dmp

Download

memory/1132-38-0x0000021AA96F0000-0x0000021AA9756000-memory.dmp

Download

memory/1132-37-0x0000021AA94D0000-0x0000021AA95CB000-memory.dmp

Download

memory/1132-40-0x0000021AA96F0000-0x0000021AA9756000-memory.dmp

Download

memory/1620-450-0x00007FF7DEEF0000-0x00007FF7DF01E000-memory.dmp

Download

memory/1620-381-0x000001EFA5A60000-0x000001EFA5AC6000-memory.dmp

Download

memory/1620-382-0x00007FF7DEEF0000-0x00007FF7DF01E000-memory.dmp

Download

memory/1620-383-0x000001EFA5A60000-0x000001EFA5AC6000-memory.dmp

Download

memory/1744-302-0x00007FF7B9BD0000-0x00007FF7B9FE6000-memory.dmp

Download

memory/1744-380-0x00007FF7B9BD0000-0x00007FF7B9FE6000-memory.dmp

Download

memory/1744-444-0x0000018876120000-0x0000018876186000-memory.dmp

Download

memory/1744-446-0x00007FF7B9BD0000-0x00007FF7B9FE6000-memory.dmp

Download

memory/1744-303-0x0000018876120000-0x0000018876186000-memory.dmp

Download

memory/1744-304-0x0000018876120000-0x0000018876186000-memory.dmp

Download

memory/2000-28-0x00000227074B0000-0x00000227075AB000-memory.dmp

Download

memory/2000-29-0x00000227075B0000-0x0000022707616000-memory.dmp

Download

memory/2000-31-0x00000227075B0000-0x0000022707616000-memory.dmp

Download

memory/2036-58-0x0000023324D60000-0x0000023324E5B000-memory.dmp

Download

memory/2036-60-0x0000023324FE0000-0x0000023325046000-memory.dmp

Download

memory/2036-59-0x0000023324FE0000-0x0000023325046000-memory.dmp

Download

memory/2232-264-0x00007FF758A10000-0x00007FF758B59000-memory.dmp

Download

memory/2232-267-0x00000160200A0000-0x0000016020106000-memory.dmp

Download

memory/2232-340-0x00007FF758A10000-0x00007FF758B59000-memory.dmp

Download

memory/2232-266-0x00000160200A0000-0x0000016020106000-memory.dmp

Download

memory/3088-279-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/3088-351-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3088-274-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/3088-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3412-353-0x000002143A190000-0x000002143A1F6000-memory.dmp

Download

memory/3412-447-0x00007FF608770000-0x00007FF6089FA000-memory.dmp

Download

memory/3412-352-0x00007FF608770000-0x00007FF6089FA000-memory.dmp

Download

memory/3412-354-0x000002143A190000-0x000002143A1F6000-memory.dmp

Download

memory/3516-237-0x00000170C7ED0000-0x00000170C7F36000-memory.dmp

Download

memory/3516-312-0x00007FF6A7E80000-0x00007FF6A7F48000-memory.dmp

Download

memory/3516-235-0x00007FF6A7E80000-0x00007FF6A7F48000-memory.dmp

Download

memory/3516-236-0x00000170C7ED0000-0x00000170C7F36000-memory.dmp

Download

memory/3960-46-0x00007FF742980000-0x00007FF742AE7000-memory.dmp

Download

memory/3960-47-0x000002DF6C710000-0x000002DF6C776000-memory.dmp

Download

memory/3960-48-0x000002DF6C710000-0x000002DF6C776000-memory.dmp

Download

memory/3960-53-0x000002DF6C710000-0x000002DF6C776000-memory.dmp

Download

memory/3960-55-0x00007FF742980000-0x00007FF742AE7000-memory.dmp

Download

memory/4264-15-0x00007FF60F2A0000-0x00007FF60F3C2000-memory.dmp

Download

memory/4264-18-0x0000020ABBC90000-0x0000020ABBCF6000-memory.dmp

Download

memory/4264-64-0x00007FF60F2A0000-0x00007FF60F3C2000-memory.dmp

Download

memory/4264-16-0x0000020ABBC90000-0x0000020ABBCF6000-memory.dmp

Download

memory/4264-17-0x0000020ABBC90000-0x0000020ABBCF6000-memory.dmp

Download

memory/4376-2-0x00000000030F0000-0x0000000003159000-memory.dmp

Download

memory/4376-7-0x00000000030F0000-0x0000000003159000-memory.dmp

Download

memory/4376-0-0x0000000002E80000-0x0000000002F95000-memory.dmp

Download

memory/4384-322-0x00007FF605C30000-0x00007FF605ED2000-memory.dmp

Download

memory/4384-325-0x000002860D1E0000-0x000002860D246000-memory.dmp

Download

memory/4384-324-0x000002860D1E0000-0x000002860D246000-memory.dmp

Download

memory/4384-391-0x00007FF605C30000-0x00007FF605ED2000-memory.dmp

Download

memory/4468-287-0x00007FF65AA50000-0x00007FF65B193000-memory.dmp

Download

memory/4468-367-0x00007FF65AA50000-0x00007FF65B193000-memory.dmp

Download

memory/4468-285-0x000001260C610000-0x000001260C676000-memory.dmp

Download

memory/4468-286-0x000001260C610000-0x000001260C676000-memory.dmp

Download

memory/4520-295-0x0000020AD5160000-0x0000020AD51C6000-memory.dmp

Download

memory/4520-370-0x00007FF772940000-0x00007FF7729ED000-memory.dmp

Download

memory/4520-294-0x0000020AD5160000-0x0000020AD51C6000-memory.dmp

Download

memory/4520-293-0x00007FF772940000-0x00007FF7729ED000-memory.dmp

Download

memory/4748-313-0x00007FF62F550000-0x00007FF62F603000-memory.dmp

Download

memory/4748-314-0x0000019AB1B70000-0x0000019AB1BD6000-memory.dmp

Download

memory/4748-315-0x0000019AB1B70000-0x0000019AB1BD6000-memory.dmp

Download

memory/4748-388-0x00007FF62F550000-0x00007FF62F603000-memory.dmp

Download

memory/4888-331-0x00007FF6782A0000-0x00007FF6783B9000-memory.dmp

Download

memory/4888-254-0x000001D3D06D0000-0x000001D3D0736000-memory.dmp

Download

memory/4888-253-0x000001D3D06D0000-0x000001D3D0736000-memory.dmp

Download

memory/4888-249-0x00007FF6782A0000-0x00007FF6783B9000-memory.dmp

Download

memory/5228-341-0x00007FF7CC0A0000-0x00007FF7CC3C0000-memory.dmp

Download

memory/5228-342-0x00000262FD060000-0x00000262FD0C6000-memory.dmp

Download

memory/5228-347-0x00000262FD060000-0x00000262FD0C6000-memory.dmp

Download

memory/5228-358-0x00007FF7CC0A0000-0x00007FF7CC3C0000-memory.dmp

Download

memory/5228-343-0x00000262FD060000-0x00000262FD0C6000-memory.dmp

Download

memory/5508-449-0x00007FF744C60000-0x00007FF745166000-memory.dmp

Download

memory/5508-371-0x00007FF744C60000-0x00007FF745166000-memory.dmp

Download

memory/5508-372-0x000002A2F0220000-0x000002A2F0286000-memory.dmp

Download

memory/5508-373-0x000002A2F0220000-0x000002A2F0286000-memory.dmp

Download

memory/5528-394-0x00000192BA2D0000-0x00000192BA336000-memory.dmp

Download

memory/5528-393-0x00000192BA2D0000-0x00000192BA336000-memory.dmp

Download

memory/5528-392-0x00007FF6E7A70000-0x00007FF6E7DAE000-memory.dmp

Download

memory/5764-333-0x0000014E747C0000-0x0000014E74826000-memory.dmp

Download

memory/5764-443-0x00007FF63B9D0000-0x00007FF63BB64000-memory.dmp

Download

memory/5764-334-0x00007FF63B9D0000-0x00007FF63BB64000-memory.dmp

Download

memory/5764-332-0x0000014E747C0000-0x0000014E74826000-memory.dmp

Download

memory/5976-321-0x00007FF6A7E80000-0x00007FF6A7F48000-memory.dmp

Download

memory/5976-244-0x00007FF6A7E80000-0x00007FF6A7F48000-memory.dmp

Download

memory/5976-248-0x0000015996710000-0x0000015996776000-memory.dmp

Download

memory/5976-246-0x0000015996710000-0x0000015996776000-memory.dmp

Download