1e2445c63326812b997dc7b5ec5e871febdd246ca94e0420b8a2b90fbb2e6c52

Analysis

max time kernel
145s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260808-dmnj8a11gy
SHA256 1e2445c63326812b997dc7b5ec5e871febdd246ca94e0420b8a2b90fbb2e6c52
MD5 937c6767ee7fb3f2b26a08d0cebe0eac
SHA1 acbb8a1d770857b4aec41b9e7302f46724113fcc
SHA512 456c9db5fcb77bfe4f325aadc90e5fca7d4cafd63762c3c462b9b2fe4e60a69afaf32bf39b0a507f937c36a4d519370a04dd0e7b98175b98b62a105ee452366a
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJLT7Jckdwi6i9bNrqq4E41WFpW3oRos:zul13qcQFTIOZeH7Jckdwi3N7+WTW3
TLSH
T10345E01EBEF1C032C12352318E6ED358B2B5A4B248264847BBDD675D2F701D2973AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
924	alg.exe
4604	elevation_service.exe
1568	elevation_service.exe
1164	maintenanceservice.exe
3664	OSE.EXE
5212	GameInputSvc.exe
5672	GameInputSvc.exe
3432	msdtc.exe
5116	PerceptionSimulationService.exe
3384	perfhost.exe
1756	ReFsDedupSvc.exe
5484	locator.exe
2464	SensorDataService.exe
200	snmptrap.exe
3080	ssh-agent.exe
4648	TieringEngineService.exe
4912	AgentService.exe
1084	vds.exe
5272	vssvc.exe
5548	wbengine.exe
4684	WmiApSrv.exe
3928	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5ab3193bc618523d.bin	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5672	GameInputSvc.exe
5672	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1328	2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	924	alg.exe
Token: SeDebugPrivilege	924	alg.exe
Token: SeTakeOwnershipPrivilege	4604	elevation_service.exe
Token: SeTcbPrivilege	5212	GameInputSvc.exe
Token: SeBackupPrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1756	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1756	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4648	TieringEngineService.exe
Token: SeManageVolumePrivilege	4648	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4912	AgentService.exe
Token: SeBackupPrivilege	5272	vssvc.exe
Token: SeRestorePrivilege	5272	vssvc.exe
Token: SeAuditPrivilege	5272	vssvc.exe
Token: SeBackupPrivilege	5548	wbengine.exe
Token: SeRestorePrivilege	5548	wbengine.exe
Token: SeSecurityPrivilege	5548	wbengine.exe
Token: 33	3928	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3928	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3928	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 5672	5212	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_937c6767ee7fb3f2b26a08d0cebe0eac_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1328

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1164

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3664

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5672

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3432

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3384

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2464

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6facba8bde4616d6049ae9df40d3ebdac35f57df4844a7e2013d0fe0ff2e5e81
MD5 8c01675a200c06eba92fc6763adf1e7e
SHA1 57ddc8ac281f3fa3a4b65a7456edf3fc5027723a
SHA512 73e125f6259210c0cf2767ca4866b3e84e122c849b3f2beb0f8fca5aca37b41bd9cafaf1589082585f1e2add3d07382eda54eb71d87d86adf0cb7fd9c673518e
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnH7Jckdwi3N7+WTW3:L3q6gjBePdwi3Q
TLSH
T131D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 1a56275cd7bea3d2ee0fce5b3557febbcd3cfd48bf9a39c939ed5215d338440e
MD5 30ccf4f95bf7c5403b39d35bc6ee80d2
SHA1 d78747dc1bcb17b70af59f2e1af4cbf4f8e31b19
SHA512 a2c4c0526f59171e90c3c2c800c54ab2c85c6131f04e27db67e18574cca5d6460a975ef0a90e5af98e4dd25bb989e1e1f0f56d02431f0386026650ffa2152dbb
SSDEEP 24576:TXYHDxczApT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xc47Jckdwi3N7+WTW3
TLSH
T150050128A3E409F9ED67C239C9B2C515EA7278514760FB8B03E496751F233846E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3f7b00b67367c89def824537051fff309e9019ac9686b3433c26db1d37de4aea
MD5 a29eda57b6c0e4db670eedbacc8ff7b8
SHA1 c5e387fcd220436c8e9feda184b689dca486ac48
SHA512 02ca777925d9dd6fa2af8b790b919b9369f0834193c2c47f77b6eacd765a883e4c70dc799ce5ef717a231820233360b04e7dd03fa600535f248f7b1a11289160
SSDEEP 24576:T0Qeky90nlxOrMAT7Jckdwi6i9bNrqq4E41WFpW3oRos:T3y90lo77Jckdwi3N7+WTW3
TLSH
T1DD359E16F6748335D073C0B9C5D2A69AEE7130825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 71959201cca4c19353568da5ba56924fb265a84747c8aad300985cb238073b35
MD5 e2abf7556903c6ced0e9d9278994d8f2
SHA1 6208722cb7480775a1f9312bf0bab2a95e246713
SHA512 1b58397a5acb13cd3f15d7d67e248a79a35190a6ea48dcfa9e8b1d4f62f1567789b1120e354bb6a7db96f7414802c57946309c907f6a697e19aaac897e4fd6a0
SSDEEP 49152:I/ezSC6vUzPvuHjyU7Jckdwi3N7+WTW3:8ezSC6v2XuH7Pdwi3Q
TLSH
T199755C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7987e2e6f902372a860f55adc58e5a5e70f580413597693c1d115401125d400a
MD5 ced4a576fdd9f01a13e390c07b41b853
SHA1 bfa123d81a12bf2c79568dea599a9efeb86b3e7b
SHA512 585dc0cd38a009af65cdca4ab230105c375872d7180253de0fb31274cba201485754334ff503edba8bc6b485d60db7f729ae83e537fb5958a2344549004dd02f
SSDEEP 24576:eabdPWwkYv/l+dgT7Jckdwi6i9bNrqq4E41WFpW3oRos:eaAwkYXl+I7Jckdwi3N7+WTW3
TLSH
T1DB559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 b095e1a677628de905abd2642f7cf9cce250bc49dbfa5f6ed66095f2e5dc1248
MD5 954a47c6e6a95e90361e756dbb080804
SHA1 c35f675e73b634abbda4e5023eb62f5ea0ffc0a9
SHA512 bce320bda641e1a8842cbd1ad9e22a4d1bff84e9b49dfd59f1b746017ecaa42c5cf75e1f7336d401ea988ef147538474a57094a65c378b960fb9831195e4a60a
SSDEEP 12288:QUkT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:QUkT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T187D4234C865916ABE7A7D231837DE6E4FAA82E423955BE05439073E0542D340F39BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 f3c6f7d0b0f385a3a9ac0553dc8c3a993c2e8f923a0fe21fac8b91640dcd3097
MD5 867a7ae7efdef39c43ffc3b45e03fa47
SHA1 f7cba28954e5a1c3cf2aa32f574988f7d55eaa96
SHA512 2eadf0e8d7b92f99690d3ce20362e516ca7a54ce61c57c6811dd6448a848a635a2b8e8155cf257ef46dd678bcc66a12ef7e8b8903af2297ac6f44ab2dda6d359
SSDEEP 24576:TRIUvT7Jckdwi6i9bNrqq4E41WFpW3oRos:TRIUr7Jckdwi3N7+WTW3
TLSH
T1F115CF2BEE28FCE2C27A9D795791C640E7B278314F62A3CBD164820DDE135D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 cd4c1680fbd02cacd3b2a6c71da2abc4787885f9718e23d93900eae437f8dae3
MD5 fa71e116ab5ef9a7b818a8b0f5598beb
SHA1 a83218c78f62f60ca4d8990c7f7a72f82b4a9d28
SHA512 be7e2eae548094bef93979fe654682bed8c5720e60e6985f75291886adc4c1b8ccbd5763b7d2f28e90e3b09a224f21e44a84735aea888a927df6c4f71698f606
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THO:DQvGAdlCEL8c/NRNw5CqPdwi3Q
TLSH
T1FE367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 1abaf192ceed90832ba03b3747fdff195b7bd1113a6ed98e9bdfd6c3c680ae16
MD5 f35cff778f353f40cefe5a8f281dd60c
SHA1 6c987b0deaa6d29eb7357597222dbdcfcf91fa76
SHA512 68fdc0056676d920d9667312c61a4f1ad96d2102b472a1a5db362e3ff6af2d7f01a0212fe658f1e7751f8da3bde7b0c5d918ae91dd7e48f3f74f37aca60044b3
SSDEEP 24576:7mewsAjZT7Jckdwi6i9bNrqq4E41WFpW3oRos:Clj57Jckdwi3N7+WTW3
TLSH
T17315E031FA74E436C37B0DB21B36D716647C7A204F512AC3E3E89A9D59342D22376E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 778564255207beefb1827ce483d8974e462077c37975d016ac8b9884ca241368
MD5 f82cc165192e1b0d923921e9689b8536
SHA1 5b547672130fe57b4da7e93621e20df432856d6d
SHA512 897942182ba223a40d480e82f42000644b61d18b9c4148d2528c037de3b409b03973c1b9815ee5bc5936bfce0b23417f604d83390985a8c8995be37ed7e62bfb
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJH2Pdwi:FUEtQevvqc2W1cpV2X1322Pdwi
TLSH
T101474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b558dee1492d5c41531df6a9bb99b4f2fa4ec1439053492267c67dae8a056ba0
MD5 c19c521bfc835d7e77e1ad24dab93ccd
SHA1 2e99d617682f472a51deff3165e480eab61ec7bf
SHA512 dea76d098d831a353845281d0c88d65d2c2fd3a8ebbf0231be6a02272c4a9e7d14b4257e987e4746ffb71292f1631866ef8cb899ef06a0df48f703aa74e9f46b
SSDEEP 49152:JKbRquA/m2yL5zM9FiV+XenmE3/z/7Jckdwi3N7+WTW3:ioqLVjnmCPdwi3Q
TLSH
T15CD58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5403f94bfce5952500d0b7912489aa7a0d2c7cce8f6446f8337acf775c604345
MD5 ce30915be95c6a7cfec9e626dee94523
SHA1 adc446e06020fa642d7d6e7522db0b363edce11c
SHA512 da515b62e03e9eea20dbcd8a3698bb4f6b5aeb96be9e44d1beee6098da757df189cd95ed3b764b556248647bcda7f2a620be4e9cd4a1b63421780087d5b7f81a
SSDEEP 24576:BAhGLvbFoiwtA5l7S533T7Jckdwi6i9bNrqq4E41WFpW3oRos:BAMPFoiq5T7Jckdwi3N7+WTW3
TLSH
T13945AE80E7F955D4F5F3AA7899B69170EA76BCA65E31D20F1260D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 8a85573cae9017e4ae841a0a1ca5332b80e81e7b2457b32dc15419fdefc8a9db
MD5 207b6c763a080989b7d2a560af390c79
SHA1 073d41344237244c1b3488e0ad7dce3239080379
SHA512 e7d04c130655e03c688f617dd094217e49ea6816e3995ffd5de7e91936100feca6d8101a6a42aa960cbf436f4603f10d55cd3636bb4cb5edf5c4514778f142de
SSDEEP 24576:Owu+OW/T7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOc7Jckdwi3N7+WTW3
TLSH
T11905F14972A40CF9E5679239C65BC135F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 ac3b1fafe3f94d59e713c07dd76e86a20ff03c68376856be556701d05f5970e9
MD5 151d78d143bc2e9f104d163575ef63d8
SHA1 ea3f26bc814f5061fe3df7104497ae503e85f530
SHA512 5039d08fe41d1b06020b2e6c155297746227a30c753c4029a4ad248301480f498872106dc86a105bb5d893e6e04096b597017272df4f83997f0f606dc6883a9c
SSDEEP 12288:FXL1IBsT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:pLu2T7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T158E4124D239421FAE2A3D239CAB99644E7B138533775A7CF066443A41F277C16E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ede6e91465f34733aec2b55eafc4335ede2611af92ad5c4a6b820cfe186864d1
MD5 2d6bb19277bf76ac9c8a69721e016322
SHA1 8b26bc01f14112385abb34bf62f2c923f545ef69
SHA512 881f0a682d11af74de98401c445eee8379ed5704cfcf716254666b0255513884c98a3c9be220983dd183901b43b2709241009a34b65531858536f0597aba0722
SSDEEP 98304:rQRQyi36YOcP8Lvw2gAf+PN3z5Pdwi3Q:aQyiKa+X+PNNPdwi
TLSH
T197667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f24a6a3822bb593524301598b9fd7522aae6a82219fe237896758f2cd820880f
MD5 63a1ca53e3b7f947c9389d4103ac0461
SHA1 cf117c7b3afd25ba6a6e481055e49c2586e4c55b
SHA512 caa23f2332d723de984d1c03961cefb403006d7423caa9074b05f390f877d3f5d45de17fb276591aa662b419224f6ae27bfb33f07e1ebd97b1b657a47c5dd9d7
SSDEEP 49152:CJsdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UK:rQRQyi36YOcP8Lvw2gAf+PN3XPdwi3Q
TLSH
T156667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5eddf7cef5786d7d0bf7c3a32abdad7230bc89ce8d26bd0b4d1af6a3497716c6
MD5 6d7b8bf1dc4e69a943f91cb75474d273
SHA1 91dd14f84b103a3e6088225eba3e8586f97c1257
SHA512 eb291aa3c30a0c812dc073f582383be3d1c6f6c588ae28d17a11fa5f75b5f0cd6bb8653baae89740bdbc5da64309a233927dc0d50d9bfecc413f11d9cfef92f0
SSDEEP 49152:E68Qg55nhMeWu7PNU3/q7Jckdwi3N7+WTW3:uthbRc/4Pdwi3Q
TLSH
T1E6B55A33B2F600A9C44DE1769F4A873196E17C718FE0E3DB855172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 aa6f5b5f14d9cceaf2e2ccf5e7805bb55c45fa6fe58ec221fd5602946a435ce3
MD5 e4e989ed1c851a6f10c59501199510c8
SHA1 277862ca467292c85777923f9876d26b27255211
SHA512 1e8853d5143f99c0aea75a0b930f28485fb2e33649b08ae8b1a82f32aa87c97a48c57fb5e8ac02186309a8de8544cd7a637d3bafdc1f08de71c2552a372a5d75
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99l:ny5112gYy5azzVv569nLKnhZtPdwi3Q
TLSH
T137167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e4832d9f071e3422397e73dcb1ec6a799d99bdbe894e1ad51bf04d45ed09ed37
MD5 84778bb7ade974bb9a3666031ef3d76a
SHA1 f4d4b8b01f2cfdc3b77fe3e86847961d0ce28ae1
SHA512 29d8644746e2956ab486f7196cdc30e9b3d81788d89cda2b0c197f73da654535746546ee0f8853e8ccef8cf6d17f42a38fc4d681155d841afdacf8c6d251e063
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glq7Jckdwi3N7+WTW3:Hu6JmTxd2d4Pdwi3Q
TLSH
T142D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7405aaf4db1270baffd27291c4d4b466e4261762d285d4493bbde102b871cb21
MD5 bfd4f35e43c2c7423936e35d3b22f403
SHA1 1a411f50fd521580fc698f9cbb36798b1495a70f
SHA512 a0410c93d39b10455b5a0bb50daa9e16043c2776ed40acdd4bac686e2db9e0f91ae47f9aea3e1accf36e56d58da512b8994dd69117b713cffc91437bae87b85b
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xe7Jckdwi3N7+WTW3:ImifPbRJPdwi3Q
TLSH
T112B5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7951F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 511163297dbe23f8ebd9ef893a6c85077705edd466abb659c421fb4569c2960a
MD5 c6a902a16f99749681a43864c1c19574
SHA1 139f6795c775784bf86ab69ac84a3c0a3d39cf7e
SHA512 f340d4bbf1ba7b437859245498bcba9060d34744e08e1b25e07d85944e440bca9192278b8d67c5ffb3e224561eaa71fa1267fc3bcf31d3eb196f840c7f203615
SSDEEP 49152:bSuZQIY0Be2K6RVtOnks6NMHqj7Jckdwi3N7+WTW3:J5dKoi61JPdwi3Q
TLSH
T13EC5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7f54acc693398fadc631d92085a337771c19f43c094b8cff6d57cba419c0d548
MD5 0dc476f94e22001e3eb21d70aa8edb22
SHA1 d81db0cff7cf792df8d290aa8822e30d81717206
SHA512 bc39816382717920ce5b145b9e6fc663bfbf6e78b548ffc286dcc79162b0f815a1fed8495a2fb45e78dd02bf1d725abeb1aae8414274b4b8c55350ce0d1e4ef3
SSDEEP 49152:PPSSn8EApI0figTgiDn0AP5wN7Jckdwi3N7+WTW3:zX2iyph+Pdwi3Q
TLSH
T138A5BE13F2D900E8D05ED174C7568632EA62BC160B35BAEF0A90B7561E7BBE05B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 7706d838521176722f642359454fde6e431be9ece3322cccdf3c47cbb42006ca
MD5 74b77a733b14b4f0780f918eebbda15e
SHA1 a2df62bd4ceb56c7c6229a0b5197d56c8d4cf7ac
SHA512 5089fb34c2f99e3e27fdef481dd93525f58476c4d43e890920614657fa86a6a3d1950af0919c498ff1951f86db1b101e51e1ad1be2f1a5a10e62239d586e0827
SSDEEP 12288:7xT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:7xT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B4D4234CD55A46AFE353E232C73DE6D8FAE82F437956BA05479862A06519340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 9d88811b3f1244add0508f7e0da7c049b68022f7dcbc7e1dc61986e0acfdcd2e
MD5 3dc7921a2ac588a9c2ad3bb96b852fec
SHA1 c753db01d4a3fc4c957a1d0383980108cfe3a7cb
SHA512 62abe4a8d1a5e36e362899acf9ee57ae11c71160b271dee63dc15aaf82693ed33e00f053fea8725e37b7d61b13d7064670da78a64fad0c751b683d39bc328b2e
SSDEEP 12288:RRT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:RRT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T177D4234CD55A4AABE353E232C73DE6D8FAE82F437955BA05479862A06519340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 027310ebb4adfa90a59c6ad13ea9271af6bfff9d48c17e3f05654478354ae8e1
MD5 54382968a14e127bfe4c125155bc757a
SHA1 24f1ff0a17fd0f9ab29815fd50acd2f6b2488989
SHA512 ca6aca48471f5787a6fe8c39799615140d67d34f950d0caebf7d79469718b9a40fbf1948213635bb9ef8caabe2c0e1de90142aca3dc8aa9da880ba713b415fbd
SSDEEP 12288:TVT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:TVT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T19ED4234CD55A16ABE353E232C33DE6D8FAE82F437D55BA05879862A0651D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 f588a31548d32273357a37626d5014190dd4625f593498b2baa2de6c5a877e1d
MD5 1bd084784bfb6897848d43ed638d6cb9
SHA1 dbbe80b37781b744331adbb4e38beeee88080215
SHA512 b60a8fbf63da2ce5bdffcb258ea931a1ebf0e8b783f61b51173df85240c387db089cb642828cfd67516e591e5f1fceb2b439b78b021d5727e39252121929a5ef
SSDEEP 12288:KlyT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A7D42348975A02EBE663E231C63DE294F7F83E427A35BB4F479012A41D66340776AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 0ddf137ea097345138faadfc3c31c27d168b1a444f6072a1a7979077e0c28bf9
MD5 edb73b45e3ab4ef4fc574c93ec29effd
SHA1 fa488d01d680cef95fcc8e7aa9e372e5b1df0e2c
SHA512 f79bb2b0fda4785e1469efb2b5e06f8ff3715af17700ae41d558a749c36893d1d5cfdbde53cde5182f78705e6fcb6baed22fb96e9178c03c5d393686c233c416
SSDEEP 12288:C3T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:C3T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T170D4234CD65A466FE353E232C73DE6D8FAE82F437955BA05879862A0651D340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 aa805da108a1652f916758cdfc181f920f542427b09e445396576e6372f9385b
MD5 315eae8fdc1ced47a119e02b523aac53
SHA1 9a84da99c410acac087380df5684e12ac70ab761
SHA512 af64903f73dcfc12fdb71728a92109b25bca8d5c2fe2f222e451f00f98d4145b827a6f6d1abf6a439fead4b8c8e97f76255f88b693835ea1dfd84ff006130666
SSDEEP 12288:xHT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:xHT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1D6D4230CD65A06ABE353E232C73DE6D8FAA83F437D55BA05479862A06519340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 a318d90ca10a0a7b2d999c245ecba2e52c9417172b32656eab3aee95ccec34a9
MD5 feada45c9f9a3153d36270c4ac3b8c44
SHA1 3d17fb8ef1a555faa8b7242a7d462202730466cd
SHA512 cb599f2b08f99e105ff89582bc7021250dddd574f6009bd677809e044b199e030aca9daf0a0917631a770e6fb10754d2614f162ad33acfbbcee90698ddf51c5c
SSDEEP 12288:eYT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:eYT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T182D4234CD65A066BD353D232C33DE6D8FAE83F437959BA05479862A0655E340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 cb20c14b798fcbfb2d1d89233b6bfeeeb1161b033bcfd69fb7e3adfad41b286e
MD5 8931ea93e80ecd1a39bbc8ea108cb842
SHA1 d02e3cdafdf8efdef3b11de392f1b0fecd31dee3
SHA512 8d8a98427406a488736817c1288f0913f707d1c09a1af8cbaa94f77c58e442b4f7b83fb461c1c68e7feeb9f2d5956d52e33ac76421681774c34dd3a31d20df4f
SSDEEP 24576:BZMlzFVSjTT7Jckdwi6i9bNrqq4E41WFpW3oRos:BZMlzfQ7Jckdwi3N7+WTW3
TLSH
T1DB150298B39018F9ED63823EC9299945E6F27C561B70DA0F03E436665F333901D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 28e30087963233a57746cbc65e57e848c746dd66a58ba4829e28567e69db4c74
MD5 79150d849ecde10684f51d6bc9ac7eae
SHA1 d76b16b62f5baf41dc0273594943b5026869fbad
SHA512 ba9e9a8b2240a39c6f47fc85dc9ebe368281c084f83b9027a135cec5ab025882d8a31496ea274882e85b9d6057280914d6dfa0aeeaceb364070273936277eb8b
SSDEEP 12288:jZT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:jZT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T190D4234CD65A06ABE353D232C73DE6D8FAE82F437955BA45879862A0651D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 3cf846d451af2468d5d80d5964facfddb43bad1f6ac33416fae8681576bd0436
MD5 298bf13895077ba25dd98fe62078eca8
SHA1 a0e9bf9901d0ffd2576183656d7c63c32a1b0830
SHA512 21d88902e33155013cbeab13b3d734aa4839ca9f8cbb7738e3981ab6ac02e0a598dc9e5b8147a2c883e6b438f3986e4f55d275469ce5cbd089364fbcf32289f7
SSDEEP 12288:Z/T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:Z/T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T170D4234C955A0AABE353D232C73DE6D8FAAC2F437D55BA45479862A0651D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 521640eda33ebf8b69954d49d094f1d90c82a6f434aa3eeda6d999fbb20a4267
MD5 43f8150f8ced933fe598733afad0251b
SHA1 9be9dc2029f5e29566f9d7464842b69af595d4c8
SHA512 4ed866312acf4e346e5d860c57e72351266eec9160572325223207ff5e6923acd02b9c5f2fa061c26ec7d35ae2161badac87f3790d8660ec4a06604c8481728f
SSDEEP 12288:BuPz5LAH4T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:IzyH4T7Jckdwi6i9bNrqq4E41WFpW3ov
TLSH
T119F4020B63A521FAD267D235C9665A45F7B578321B20AF5F03A403B52E273906E6FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 f733d4719ff47827ae59acb17fbd873cea3a49cc203cf43c3ee9f0c5744a2e90
MD5 749e99ed47850a2bf37981d343b7d086
SHA1 ca0c5847872993e7f8dde0ab28e495c3555d1da3
SHA512 ed8207cacc4bd83f921d3d47484f4a0c68c87f79264e71f7d1bfb23d2bba662397cebacfa176151d0ff00f4f65fac2c322d7cd8eed68331e81aa7bf275eea6e5
SSDEEP 12288:bbT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:bbT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1DFD4234CD55A16ABE353D232C33DE6D8FAE83F437965BA05479862A0655E340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 5ed65896cba240eae5bbf7ea89f8868ab79b077e10f5e3a034f1187e63c5bb58
MD5 e177f1c35ef50e45c8748ecce72900c2
SHA1 215f41f8d5e4b80dd4cd638e128790fd769ac894
SHA512 be706664abf1072cb851b01041698bebd617535c5842c288dcb00fd1484f221cc64f12e501fc4ded77030cd748674e65d0a7dfc1b68f3355dbea91bcb76b2352
SSDEEP 12288:f5T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:f5T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1C8D4234CD55A16ABE353D232C33DE6D8FAE83F437965BA05479862A06559340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 cd0567dae4c17d2b4b9cc92d13ad121fe540b950681a282b567130031abb49ea
MD5 07cb51caa2c14942e14d546a66f577af
SHA1 65af20b6003b93928cf48b94fe8992232d97c1e2
SHA512 5e9012eae007682556d47a3790fd0935cebc9a7f498def4b9d250979b46e0ef569bedbfa5cba4ec913b09fde6d4bb61b0aaac960252b10667296745eea7e6645
SSDEEP 12288:guPz5LAyT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:VzyyT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T150F4020B63A521FAD167D235C9665A45F7B578321B24AF5F03A403B52E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 21359641816efee6a9e224031617d2ebb501118bd66788de957baae668f942c3
MD5 24e3e5691e3d6872f5977a78eba761b6
SHA1 bfabb1399236436bd8dc7875c98b5ab6dc3f523a
SHA512 a35f24a337d8322f347a78344414e0688fe3fb28954edbcf22e5886400ff912f258325a9eff580922efe79fa8faae4e00c4deafe40cc2ac2e78a4dcfb4c60b8d
SSDEEP 24576:nTeaLl3z0zDAT7Jckdwi6i9bNrqq4E41WFpW3oRos:nTtLljH7Jckdwi3N7+WTW3
TLSH
T15E150298B35018F9ED67823EC9298955E6F27C561B70CA1F03E832665F333901D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 cf217c6c66a03ec4014614d1550d0115d237d844f6e34eb18affc8fc617e66b0
MD5 afff6628e68d518ea4f499ea52bdbe44
SHA1 a1a530c51a59c2d733c0f84beeff6f22cfd4b1ca
SHA512 c7b5e2ccd9519998221cce27940d51173c97d3788db86753be59a03364e1aa432565096a2d259c9a9ff7fc755fef14020c346cc9a565d8e941e88dd781ca81e7
SSDEEP 24576:y3ud/CHay7YrTT7Jckdwi6i9bNrqq4E41WFpW3oRos:Uud/CHay077Jckdwi3N7+WTW3
TLSH
T18135CE90F3E410E8F1B3DA3589769511DAB67C5A1B21DE8F03A4265A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 08936f56e8dede38a2126941b4d4445a200464d1b43c4dfe73dbfa32617b498b
MD5 4dd15ef191bb753091a9d44b10b915a3
SHA1 ac1e706bd04f8f5738d5ad42f00ff2aae17f52b0
SHA512 fc83d5838fd07a93ee69967317fc1737410744b2e06dcd8d0cb5a2ebdabb64f73dfd0fa70347d2e1b82343e65b6f25170339aafeae14a97562d830c9e8169b5a
SSDEEP 12288:FdT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:FdT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1DFD4230CD55A06AFE353D232C73DE6D8FAF82F437955BA05479862A0655A340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 ce2bd42d9e20616873a6867647bd3412c45d885b4ea08ff0dd6f7e8ea13cd175
MD5 ca79c89d54749653825128da6cba0113
SHA1 d4b5b20199c7f2342303dd99b7f4c28678e94b79
SHA512 4bf5450aed9d8a488685c8a2131e6b281a31e2646339da1cd6cdfd1be4d65ef2acad3792fc7a640361357cd3db7937a2562b59b63652473b8b5dee62fbbf7c14
SSDEEP 12288:I9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:I9T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B0D4230CD65A06AFE357D232833DE6D8FAE83F437965BA06479462A0555D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 9d84076f7242b538ca28ebb107e60e320b6c800a1781757a2061c89f7980a536
MD5 b29847e59193cb43cf6edb6837b3e136
SHA1 701d8d2cf0640311113d9ee6fda5f820482c512e
SHA512 9b8a6c7a20cf308a9e5153fbc6b3a352d92be184601ac346eb1b606fa1e1247eced4d255f5b999067ac4bc7d91e08e342620ccdbae64424eca4fb124fb812ed9
SSDEEP 12288:GxT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:GxT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A4D4234CD65A06ABE353D232C73DE6D8FAE83F437955BA05879862A06519340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 45d9e9ffea7e26ed66f148ea3fc942dd6598bd60530f64fcb7bbd96325037a5b
MD5 da9ff0f3da8fcaf02b718a04f998f4be
SHA1 91298cc66e739a606d3eaddbf5c68a9772324c6b
SHA512 569e418efc1cb2fe5741c57efa3a25f0a983c6c8b349b270f528bd86aaaa84750002e8c9ec30a84d0f2436adaff86eff7c700d34f4606088bb38fe5b902175d7
SSDEEP 12288:5eT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:5eT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1ADD4234CD65A16ABE353D232C33DE6D8FAE83F437955BA05879862A06519340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 719KB
SHA256 7b9dd7336494a32b90e7c0882070b36d22a36832c9cb0f3780d92e7d7c102592
MD5 4f5db1add8693af4f0f84aad3ef12a60
SHA1 b8e05f2a304aa1a07f504787772d2300ce36cd11
SHA512 ffe13de48780807c5ee1d958f5a540cd0e892faa0d649e23749bbde6f17bbbc9e743c695de8a0be4e02d781e6feaf217e96b27141ca7d2ac26c6d1f29a7ecf65
SSDEEP 12288:Gpsf8FT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:T8FT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T145F4F009D25802E9C16EA135C7699680F7773C2257E1E7CB52D0F57D1F3A2806EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 17ff87ca7a5a1a02afa071fcc9fc4e86857874efa203d7546fee465400b31646
MD5 7c1f436bcca630fe07d5a213cf6bed6d
SHA1 997f55e45a96d60e96bddd19e89870157fbb5185
SHA512 c2d510cfb109686934600ad8a2effefb3c99a1f6d9c428dadc68b51a45cc9e935bdc619e226bafe422b5efbeca4647dc059d7cdcca38e5cb71c86eaddc33119d
SSDEEP 12288:cM7MT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hMT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T19AD42308C3594A5BE677E231823DD2A4F66C3F522F54FA87875463A054293807FABF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2ff5f6ad205a289b69226319439b92918bac88650ddac9531fd45dcdfbd9e108
MD5 3820486c4bc7a409517078bd36bb7daa
SHA1 7689e50bc164f56e80fa8d91ad82437dd526ddd9
SHA512 cafe94e3102fd8a87c91a4ab8f4d7c32c3b29c8474d302e7d4b59d28bf1488c81d6757c2dd5c2eabf8d0c97bde664693265e0257d6b2850ab43166ef448777e0
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bY+T7Jckdwi6i9bNrqq4E41WFpW3oRos:Dgb4mBIBhGFn7Jckdwi3N7+WTW3
TLSH
T15665AE1E22EC02F5E0FAE2B8CDAA4417D6B278161731D2DF1251426D2F3BEE49D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 d9a605386a6e5d60340781207150db91723a1b2b225e3f5d404ff26a5a9a8931
MD5 64ece165338adf1ddeff074a6a35f8f4
SHA1 ea0f49c8b2054afde6bb43be3d093bb5711d637d
SHA512 d4e226b9bc3f97ec1b34107ab9ebb87118394178e02da92e05416c0776e7dd1f1abfe083401b3bdb1a9196a9d3698c6a750c9584a94abcb0e3db43afe29bd996
SSDEEP 12288:f9Gm9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GYT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1BDE4230C61AA35E9C637D331853DE5A5F9F03A512B247AEF46D0A2709B193D0737EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 b20160bc27a18f0903b4f3cce1fde6a3de280d50b26550a911dc2e345fd9a52c
MD5 12e62ac2a84c186b4e70934aac4ae25d
SHA1 e54f177939121f776f87d61b606ca0cb59bfd578
SHA512 4ea72e86ffd4a789b3ab2f96a9504757ca042c814c19652993e1741b74646ee50666e23aac5f0a3b34176a83b20b08539df234f8b3a4e274147f424542ca4c43
SSDEEP 12288:ZaT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZaT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T174D4234C8259469BD363E231823DE694FAA83F123B55BBC3469462A0515E3C077BFF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 93d36ffd31900a3034f2680738a3f154111093a2aac9eae82e651b2ad065ada1
MD5 1e9401616534014b5eacfb6fc8705061
SHA1 0743df27d0f1ac2d765f0b98da913767fc1dd453
SHA512 b2e986a2058d12b137ce33c754ee66c785ea8f211a3b889540a48ff5e66d4658252b9d96107fda1150e705e7ebfc3c88249dceba93f2b488cf9a4a1a4ffb5c83
SSDEEP 24576:ogi8u8FpJqH1sCrDC7/maT7Jckdwi6i9bNrqq4E41WFpW3oRos:9RZFPqVbC7/z7Jckdwi3N7+WTW3
TLSH
T19535F165A6E102F1D47BD1388A9646A3F6B1B8211364FFDF07A88B511F236D04B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 796635c2cb91d7e5db2970fb71e4b283640af38341d616a6f5d6ef0b10fb8522
MD5 f1901adcab0f5f3bb239b56b28a46c59
SHA1 d0f1edd65c7c3bd423ea14fb67aec224e721274a
SHA512 637f66d1df428c569c8f28ba147fcbe9a45f021e662072a332c46c12230dc2ca5a0b294a4a4d842539d9d05e6f5783f80010297949db3a47d095f2d6f051efac
SSDEEP 24576:vPUr+NQGT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQc7Jckdwi3N7+WTW3
TLSH
T10B05F11E62AC18E5E677E13D86568719F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 316d208f4f618280892f66d87f604e3f871979be1865466bdc7022a7340421de
MD5 489759737974be4d9ad556f3c187a675
SHA1 ed205d7c39eb96efefd8f3e6e2b626f182350c6b
SHA512 c80727e476866f7a55886de536a884a6cc371272b7b3d4eade60c47689434b413e14ea24602a8f5260de5b9a257bc6e112591ffd78e069a07c72257424f8326c
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsx7Jckdwi3N7+WTW3:SG05lO43bXPdwi3Q
TLSH
T16FD5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1382089177fdd9e3d894a685d6fe771e919ff1dab9698ae29bee77a2c77a6cb8
MD5 3ef5e513668b0f584ba2abe2ad4e158c
SHA1 e86491fe28a9d64b4b3df1dbcd242df28c3015b1
SHA512 94797b90fa170e8e783d1d7183389623e1c6b55b5896d7860b041fac36039c7c43909d36aeccb60999ab28f7e27e3976bcf592cbb3ce841e8e209eef8bcc9abc
SSDEEP 24576:Fca5POZ3dpbWVM50JicR2hG0lasx2+47eidneT7Jckdwi6i9bNrqq4E41WFpW3ov:Ga5POZ3wJt2pasx2+mi7Jckdwi3N7+Wa
TLSH
T1EB65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bb152984d9bc28e36366304636e7caa561bcc4a1fb69865cd3998b90f4bc150a
MD5 b1840ab8831d78e34155d81fecfc54e1
SHA1 0b24dfb6d7d7843863bac225be702df0fe1808d3
SHA512 8db513aa0301116acf46c5854804c212157b2de51a10ba3d5d5e6ff93ddb59d5322be3a75a2399c32b23bc5a8e1973a592332ebab5fb812708f87f160813ca56
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkiT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFj7Jckdwi3N7+WTW3
TLSH
T144858C1623E901E4F1BBE1BE89779546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 927166dd413f4cbfd86ccd8c6d5e6c01af2d207fdded211c2ed5bcf8a4f20786
MD5 91f3a2964ac102c0e4bc3c585ce410a2
SHA1 018689b372a81d06f6e6d73644e4bd117b08c677
SHA512 a6726fa55db6ad24fcac74a83bd72e6235002dc9daacfcb03eebe04c5b3ff1f8484f616ba1a9bf408a83df5d76ec40a827d1209d63c4e90945b856144fafa848
SSDEEP 24576:hJnJPbzB4SsT7Jckdwi6i9bNrqq4E41WFpW3oRos:hJnJv6Se7Jckdwi3N7+WTW3
TLSH
T1C915E02CD2A810E9E4B7C2B4811A1799FF71386D2F2669C719B4D5343F12FD0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a0862c8fa35a28d5eb5d2c8fdb4199a8477aaaae22b687cdea9eef3b8d30da9b
MD5 403c987fd8ffaaae640124e92b4a3b23
SHA1 1a239ebe481911f24c031f93a8b421745aae6019
SHA512 65bf8522dee2f8571b27b084086ceb7a3d412afbe801c17033b6dbb6a882a29531db6ef0fd98493c56b2d866e9f7ffc143195ede484a8bb8fbfd9726473e52a7
SSDEEP 49152:nCLHGeeV5ijCmlDWDkE7Jckdwi3N7+WTW3:CgPdwi3Q
TLSH
T119A56B05E7EB5184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 db1261f94e0cdd39dc14cd3e48dbd661ddd67364e3fabddd5b368042cce803e3
MD5 388dc25fa26cbf8beb3af6649ede7c11
SHA1 d15767aa7ca12337235c3287aa7afd1bf5285dca
SHA512 a6c35e3734dceb0d97412ca546eb2a0ce3290768780bea838d88fae99ca9fcd0fb0b72842f1ba55d44da9c8b714f750aa16a047a0024da6bb689f5b72f413440
SSDEEP 24576:gLDI1T7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDIV7Jckdwi3N7+WTW3
TLSH
T1D9F4010C637A11FAD167D03EC6934541E2B2B57197226ACF07D4C1B98EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 54459f203ceb62aeba5ab77aa2b4fded63d17e19531bc5a80559ec689b41a0a3
MD5 ddefef38596138c024b61cead2450122
SHA1 7edbd2facd7727662ba66c978dc16c5c86e3c11e
SHA512 5047d90e63846f820c427da3e67f4d1a996cc6d714c31267e3a7228644bcb4e21f3f9779bf28cd1abced30a66cd08e23e345e662eb88b9336b999cfc61bcc999
SSDEEP 12288:CG6kyUT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyUT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T13AF41208539821D9E6B69234C67682A4EF747C116F21A7CF46D0E33D2E3A7C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 25a07ea098244a8d666675a523aeda743300513da8a2b41072a113f81ed79418
MD5 3bff4eb39539346d51b1889d9b15bb92
SHA1 c2b238828d126a17d565b90f630688df4af6caa1
SHA512 1841575fce8eee74f856eea4ee3a661475dbcfcba453c256efda482f90fce8283425e0a2b8f6b44852a380f795a7ca197a0d534aa57b8f80db881b7fc50f9e82
SSDEEP 12288:mm8T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:H8T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T19FD4234C825926ABD653E231823DD7D4F6B43A623F167ACB46D4A2B0851E3C0777BF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 cf1c978d3722614b783a676ca15b0b7a330c8fe692d6328856684203a030894e
MD5 f57dd6708731a305ee54d14aa1a8274a
SHA1 84fbb39306060f059d02833454a6e75d4940d701
SHA512 05a6e18b2822adcc2e8c8479cac586f86aecbf8a4c5b19547f710dd0f67590b21d5dcfd4e1e1c8347cfc756ba119119c46b0b61ea1e50ef7b10a984ad2a4dbb8
SSDEEP 24576:pCgN5oTfaidZVT7Jckdwi6i9bNrqq4E41WFpW3oRos:wgETrZ17Jckdwi3N7+WTW3
TLSH
T154559D1DA3EA05CAE2B2D235D9725493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 23d3ab22412d3f542c4f6228514e2616a291d70362dded4ad05317014226672d
MD5 03d1c95de29aecec760c9ab6c20c4f84
SHA1 52951f1450c735617dfa5508e6e72b71a5fcef0c
SHA512 efcbab0d5b2156a5ebdd613d90b1a1f3095e25fef3212b8d2b46119b8b285cb8d885a9201c6b3cec461dcf70b692f81035d2bc1227d8bb45b2d2023516720a2f
SSDEEP 24576:hrcmRwT7Jckdwi6i9bNrqq4E41WFpW3oRos:1cmRi7Jckdwi3N7+WTW3
TLSH
T10005F14EB26E00E6E2B7D13CC9558655F6B37431271267CF02A1C37D4A2B6E97E39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 36ca4b156141be01e92d132ef7bf5bf171427b3c389d20760298014940d73d22
MD5 2e1b118f01b6a46f3c64d5c720345d90
SHA1 f028021daeb7bd8a2036c584aca2c9e4a2a7aa4b
SHA512 a7b1a7b00ea373d8fce12307a973a5ea7aebf22be8829b20d72755d4aa0da6ba17613891a46a87fbcbadd438810a3144356383cb5cb50aa113c3fac6f29ab0c9
SSDEEP 49152:CDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3A7Jckdwi3N7+WTW3:j3Upow8sBrPdwi3Q
TLSH
T18EA58C3DA2E810A8D9AAC379C54213A5EA71782E3F3055DB0174C178BF1BEF19A39F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-381-0x00007FF6960C0000-0x00007FF696173000-memory.dmp

Download

memory/200-311-0x00007FF6960C0000-0x00007FF696173000-memory.dmp

Download

memory/200-312-0x000002B6FFF40000-0x000002B6FFFA6000-memory.dmp

Download

memory/200-313-0x000002B6FFF40000-0x000002B6FFFA6000-memory.dmp

Download

memory/924-17-0x000001F013850000-0x000001F0138B6000-memory.dmp

Download

memory/924-16-0x000001F013850000-0x000001F0138B6000-memory.dmp

Download

memory/924-64-0x00007FF6FEE30000-0x00007FF6FEF52000-memory.dmp

Download

memory/924-18-0x000001F013850000-0x000001F0138B6000-memory.dmp

Download

memory/924-15-0x00007FF6FEE30000-0x00007FF6FEF52000-memory.dmp

Download

memory/1084-353-0x0000021866F30000-0x0000021866F96000-memory.dmp

Download

memory/1084-354-0x0000021866F30000-0x0000021866F96000-memory.dmp

Download

memory/1084-447-0x00007FF6BEE00000-0x00007FF6BF08A000-memory.dmp

Download

memory/1084-352-0x00007FF6BEE00000-0x00007FF6BF08A000-memory.dmp

Download

memory/1164-53-0x0000022918B90000-0x0000022918BF6000-memory.dmp

Download

memory/1164-46-0x00007FF65EA00000-0x00007FF65EB67000-memory.dmp

Download

memory/1164-47-0x0000022918B90000-0x0000022918BF6000-memory.dmp

Download

memory/1164-48-0x0000022918B90000-0x0000022918BF6000-memory.dmp

Download

memory/1164-55-0x00007FF65EA00000-0x00007FF65EB67000-memory.dmp

Download

memory/1328-7-0x0000000000E60000-0x0000000000EC9000-memory.dmp

Download

memory/1328-6-0x0000000000E60000-0x0000000000EC9000-memory.dmp

Download

memory/1328-0-0x00000000026E0000-0x00000000027F5000-memory.dmp

Download

memory/1328-1-0x0000000000E60000-0x0000000000EC9000-memory.dmp

Download

memory/1568-38-0x000001D35AD00000-0x000001D35AD66000-memory.dmp

Download

memory/1568-37-0x000001D35AAE0000-0x000001D35ABDB000-memory.dmp

Download

memory/1568-39-0x000001D35AD00000-0x000001D35AD66000-memory.dmp

Download

memory/1568-41-0x000001D35AD00000-0x000001D35AD66000-memory.dmp

Download

memory/1756-286-0x000001BC8B370000-0x000001BC8B3D6000-memory.dmp

Download

memory/1756-369-0x00007FF730C80000-0x00007FF7313C3000-memory.dmp

Download

memory/1756-285-0x00007FF730C80000-0x00007FF7313C3000-memory.dmp

Download

memory/1756-287-0x000001BC8B370000-0x000001BC8B3D6000-memory.dmp

Download

memory/2464-303-0x0000028CD1740000-0x0000028CD17A6000-memory.dmp

Download

memory/2464-444-0x0000028CD1740000-0x0000028CD17A6000-memory.dmp

Download

memory/2464-377-0x00007FF7666B0000-0x00007FF766AC6000-memory.dmp

Download

memory/2464-302-0x00007FF7666B0000-0x00007FF766AC6000-memory.dmp

Download

memory/2464-304-0x0000028CD1740000-0x0000028CD17A6000-memory.dmp

Download

memory/2464-446-0x00007FF7666B0000-0x00007FF766AC6000-memory.dmp

Download

memory/3080-324-0x000001ACBA1F0000-0x000001ACBA256000-memory.dmp

Download

memory/3080-323-0x000001ACBA1F0000-0x000001ACBA256000-memory.dmp

Download

memory/3080-322-0x00007FF67C940000-0x00007FF67CBE2000-memory.dmp

Download

memory/3080-392-0x00007FF67C940000-0x00007FF67CBE2000-memory.dmp

Download

memory/3384-359-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3384-274-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/3384-279-0x0000000000970000-0x00000000009D9000-memory.dmp

Download

memory/3384-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3432-252-0x00007FF60A170000-0x00007FF60A289000-memory.dmp

Download

memory/3432-339-0x00007FF60A170000-0x00007FF60A289000-memory.dmp

Download

memory/3432-253-0x000001D621BE0000-0x000001D621C46000-memory.dmp

Download

memory/3432-254-0x000001D621BE0000-0x000001D621C46000-memory.dmp

Download

memory/3664-59-0x00000220C3C50000-0x00000220C3CB6000-memory.dmp

Download

memory/3664-58-0x00000220C3A80000-0x00000220C3B7B000-memory.dmp

Download

memory/3664-60-0x00000220C3C50000-0x00000220C3CB6000-memory.dmp

Download

memory/3928-393-0x0000028DABAC0000-0x0000028DABB26000-memory.dmp

Download

memory/3928-394-0x00007FF629190000-0x00007FF6294CE000-memory.dmp

Download

memory/3928-391-0x0000028DABAC0000-0x0000028DABB26000-memory.dmp

Download

memory/4604-31-0x0000020D50670000-0x0000020D506D6000-memory.dmp

Download

memory/4604-30-0x0000020D50670000-0x0000020D506D6000-memory.dmp

Download

memory/4604-29-0x0000020D50670000-0x0000020D506D6000-memory.dmp

Download

memory/4604-28-0x0000020D50520000-0x0000020D5061B000-memory.dmp

Download

memory/4648-443-0x00007FF68D650000-0x00007FF68D7E4000-memory.dmp

Download

memory/4648-332-0x0000011B61E30000-0x0000011B61E96000-memory.dmp

Download

memory/4648-331-0x00007FF68D650000-0x00007FF68D7E4000-memory.dmp

Download

memory/4648-333-0x0000011B61E30000-0x0000011B61E96000-memory.dmp

Download

memory/4684-385-0x000001F4994C0000-0x000001F499526000-memory.dmp

Download

memory/4684-450-0x00007FF794200000-0x00007FF79432E000-memory.dmp

Download

memory/4684-382-0x00007FF794200000-0x00007FF79432E000-memory.dmp

Download

memory/4684-383-0x000001F4994C0000-0x000001F499526000-memory.dmp

Download

memory/4912-342-0x000001B609AD0000-0x000001B609B36000-memory.dmp

Download

memory/4912-340-0x00007FF6A0F70000-0x00007FF6A1290000-memory.dmp

Download

memory/4912-341-0x000001B609AD0000-0x000001B609B36000-memory.dmp

Download

memory/4912-346-0x000001B609AD0000-0x000001B609B36000-memory.dmp

Download

memory/4912-348-0x00007FF6A0F70000-0x00007FF6A1290000-memory.dmp

Download

memory/5116-267-0x0000019EABD90000-0x0000019EABDF6000-memory.dmp

Download

memory/5116-266-0x0000019EABD90000-0x0000019EABDF6000-memory.dmp

Download

memory/5116-261-0x00007FF681550000-0x00007FF681699000-memory.dmp

Download

memory/5116-351-0x00007FF681550000-0x00007FF681699000-memory.dmp

Download

memory/5212-320-0x00007FF7C3990000-0x00007FF7C3A58000-memory.dmp

Download

memory/5212-235-0x00007FF7C3990000-0x00007FF7C3A58000-memory.dmp

Download

memory/5212-237-0x0000024629D90000-0x0000024629DF6000-memory.dmp

Download

memory/5212-236-0x0000024629D90000-0x0000024629DF6000-memory.dmp

Download

memory/5272-363-0x000001DF71560000-0x000001DF715C6000-memory.dmp

Download

memory/5272-361-0x00007FF773480000-0x00007FF773950000-memory.dmp

Download

memory/5272-448-0x00007FF773480000-0x00007FF773950000-memory.dmp

Download

memory/5272-362-0x000001DF71560000-0x000001DF715C6000-memory.dmp

Download

memory/5484-376-0x00007FF7C73D0000-0x00007FF7C747D000-memory.dmp

Download

memory/5484-293-0x00007FF7C73D0000-0x00007FF7C747D000-memory.dmp

Download

memory/5484-295-0x000001B6ED1A0000-0x000001B6ED206000-memory.dmp

Download

memory/5484-294-0x000001B6ED1A0000-0x000001B6ED206000-memory.dmp

Download

memory/5548-371-0x000002704F700000-0x000002704F766000-memory.dmp

Download

memory/5548-370-0x000002704F700000-0x000002704F766000-memory.dmp

Download

memory/5548-375-0x00007FF6BC560000-0x00007FF6BCA66000-memory.dmp

Download

memory/5548-449-0x00007FF6BC560000-0x00007FF6BCA66000-memory.dmp

Download

memory/5672-330-0x00007FF7C3990000-0x00007FF7C3A58000-memory.dmp

Download

memory/5672-244-0x00007FF7C3990000-0x00007FF7C3A58000-memory.dmp

Download

memory/5672-245-0x00000143235F0000-0x0000014323656000-memory.dmp

Download

memory/5672-246-0x00000143235F0000-0x0000014323656000-memory.dmp

Download