d4452932829c2667f30121f4c334c5bb7de4b07fe7ba398593de3f00e7ff9f35

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260808-ek5ldsbf48
SHA256 d4452932829c2667f30121f4c334c5bb7de4b07fe7ba398593de3f00e7ff9f35
MD5 1c1bf00913a7a78e0150d89a6a9409fe
SHA1 f94b1d7ac233d3d9ece4905bd9cc1a74f1882168
SHA512 eba4c06edbcfc5b640e36a3a825970bc4eb332b532f278cda6cfaade8affaee157b47b13ed95e263f773dd0180c8f849c3a13ce12b4f0485ce578e0d6e5b0114
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJm8ikAROpP7yrOTtoPRd:zul13qcQFTIOZeeqWJ
TLSH
T15445E01ABEF1C032C12352318D6AD358A2F5E4B188254847BBEDA75D1F705D3973ABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4872	alg.exe
1204	elevation_service.exe
3112	elevation_service.exe
3960	maintenanceservice.exe
2036	OSE.EXE
4540	GameInputSvc.exe
3740	GameInputSvc.exe
4916	msdtc.exe
2520	PerceptionSimulationService.exe
944	perfhost.exe
2408	ReFsDedupSvc.exe
5384	locator.exe
2320	SensorDataService.exe
6004	snmptrap.exe
4348	ssh-agent.exe
4700	TieringEngineService.exe
2484	AgentService.exe
2736	vds.exe
4864	vssvc.exe
1736	wbengine.exe
2108	WmiApSrv.exe
3780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\582b2e9083806d8d.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3740	GameInputSvc.exe
3740	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4900	2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4872	alg.exe
Token: SeDebugPrivilege	4872	alg.exe
Token: SeTakeOwnershipPrivilege	1204	elevation_service.exe
Token: SeTcbPrivilege	4540	GameInputSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2408	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4700	TieringEngineService.exe
Token: SeManageVolumePrivilege	4700	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2484	AgentService.exe
Token: SeBackupPrivilege	4864	vssvc.exe
Token: SeRestorePrivilege	4864	vssvc.exe
Token: SeAuditPrivilege	4864	vssvc.exe
Token: SeBackupPrivilege	1736	wbengine.exe
Token: SeRestorePrivilege	1736	wbengine.exe
Token: SeSecurityPrivilege	1736	wbengine.exe
Token: 33	3780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3780	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 3740	4540	GameInputSvc.exe	97
PID 3780 wrote to memory of 2908	3780	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1c1bf00913a7a78e0150d89a6a9409fe_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2036

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2520

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2320

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:6004

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4700

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4864

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe89d7061ed85fa9fdb70bba92ff76ed6484bbe2a893d2bdd0ed087fc1363aaf
MD5 f28c6693ceb33ad534a2f643258f20d6
SHA1 7a8dede095c339edba26ce50a61ef064a99086df
SHA512 52db96e5b46efd286458ee4071662c08fc16b06ad0f10c686ab4fd5e7b13dd410f8aa5fc987073e87d8ca72bb9a01672d96db6a45a70621cb79cee1b68c04f6c
SSDEEP 49152:cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnjqWJ:G3q6gjBeqA
TLSH
T16ED59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 d12ea4e132ca59895976ed10636cbf53c5bf10493643f65b7a1622379c28e3c8
MD5 9b53bff2e7bf02ef550264b32ab55fb5
SHA1 f71604d5066d8f465ed40ec22618ce490e5aeecd
SHA512 436cdeca6db1d2d7887470239f530d1780fa631a0b06f1b31e59f66feccb963814d00ab2ab7a4f7aefdea662c0fa65475daf0b64f25feafac60998ee2f626ff1
SSDEEP 12288:x1XLstIeOxy2lRq2czA5RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:/XYmJtczA58ikAROpP7yrOTtoPRd
TLSH
T17305011967D508F9EE6B827CC8A1C415EB73BC514794EB8B03B4CA660F232945E3FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 115facc236d344760e9004574c41d5dfbe371ba03192a7883cd2a21653a8c2b9
MD5 3008b2fe2e58f6d354cf1c941a1b37dc
SHA1 ae2698833acf2ad0d6b7822d7b50e2ddbc3d990e
SHA512 7ca010ca101cf4d0f0c00285603da27a600c6cc34bbc7ba887a2a664dea84b7df9a6362df8511f5719d964758058c9699871446e54a7b2555839dd4fa0565d3a
SSDEEP 24576:P0QewAO0zmxOrMF8ikAROpP7yrOTtoPRd:PjAO0KogqWJ
TLSH
T18335AE16F6748735D073C0B9C5D2A69EEE71308257308ACB4296D77C2F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1dc38042150a41b688514ddee68c7d4259505103dc730d8bc5a5617000a8471d
MD5 c7e7460dba4164c55023d1e7ddb87218
SHA1 289394292a470061111edb89dfe351b17fa40e83
SHA512 37e65d285fa34ccd927c4cfbbd5f6766bce843109ece00f5a73e86ebe9ab7fb8f9c253aa82906fdf8c90da30e2d68436d979b1acb4d8295d1e5fc37b7b098ff8
SSDEEP 24576:6ML/ezSC6vUyD/aqgrvW/6q8wyuh8ikAROpP7yrOTtoPRd:7/ezSC6vUzPvuHjySqWJ
TLSH
T193756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9330278278e8e7068fde6ed6e296e3301847b0ba143d0dcbc33971e0f1ed5bc7
MD5 8ed496ad0c8d2add4dd3a51965683aef
SHA1 97cc67a622b7e09a5b454b8b2b5f267982944dc7
SHA512 6809a36d139405a4d3c4932822767fa66d0baead65b9c45483848e6a48c546ee18341e6369546b052e0919e32ca3b69d110cebf66b4f151cd7780eed52a7a63b
SSDEEP 24576:eabRPWJn9v/l+d08ikAROpP7yrOTtoPRd:eakJn9Xl+6qWJ
TLSH
T147559E66F5748331D073C0BAC5D2AA9EEE7234425B318ACB0246D76C2E277D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 ff672011871b5d61f7e631cb13d66349e6f3f89f74da6df9f88ed519efc33e94
MD5 0be7a4f2903596ac646db7f5601929ee
SHA1 d26a161e04c99859b305ba95aa3e1887caaf328d
SHA512 5dc6d7c0c521c0f27af628d9e466054a4e16bf2eb27f5c258cc8eb7472f8cbe26e0d610af8198d6f5c8ff2016c4d7e68f489220980fd753f3b073d4940ed74d4
SSDEEP 12288:Q+nRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Q+n8ikAROpP7yrOTtoPRd
TLSH
T12ED423438A4A3879EBAD12B145D998EDDBF1AC90E6CCAE24423CEF9E0534413D71B375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 63d963b4f59b7c4ff96b57db357d53fb9b012312fb3294a2138ed2b6e6faa17f
MD5 022809bb3b3a29c12fe213eece71c75e
SHA1 ec2fe1307221657b3a1d02de049aa551c7da7b55
SHA512 2581d88293c53b88c618981d60c2aa22478891536291b6b18e21679a9c68ffa8a73713b6f20557722880fdf8fdbe3b9f06dc9f45a71f837d7f1889d66ac29020
SSDEEP 12288:aeBNUbTVO86UgRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:aJIUg8ikAROpP7yrOTtoPRd
TLSH
T12515CF2BEE28FCE2C27E4DB856918640D7B278704B51A7CBD175C30E8E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 0b9d7852d785626c2a35236081c1c61472ef9ae4124097eeed6bd46e456a2f91
MD5 b4da6efd242432b7de6d258cb41fb922
SHA1 f1f9880b4e8173248c85b4fdf8e9d6c6851c392a
SHA512 05c3cac8113f8681afb4e3f30e57fd9144f50058b99a4f82dca64f601a81c06a5b5d90cb55e9d30b55bd8d772b3975fd0f394391251af64a4369b19fc3c64c3d
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJa9DN5JoNRV3THF:XQvGAdlCEL8c/aRNs5CoqA
TLSH
T1D0367C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 fc282692c8e2c9de59f1637972fc4f7f53c86a8286f7cb8b3be06d457a51eb9a
MD5 80dea6d8fed6c124ce2873116aada491
SHA1 625cf8f81b7bf9817b66be08a6f952e93080ee1c
SHA512 2e07657ec4949410d4acc52413f75b28e5e32cd26fca9f6917a61cf471aceddcc9211abc6fd8ad24de69df77f5d708e5fd012df6c2a65458b13f1ad863cedf05
SSDEEP 12288:jHwSfxL/2Dc3bDLLmt0LDQewsAjQRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7J:7mewsAjQ8ikAROpP7yrOTtoPRd
TLSH
T1BA15E031FE75E436C77F0DB21B25C71A587DB9604B951AC3E3A88E9E49301D22336A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bd6cbaf6682642e35ff65310d21b5512d7e9154888cfaac796a800f746a7b48f
MD5 8ade569105efb8b70305149a9795c575
SHA1 7228f2320df2d44492fc5357c1fb8d36d6550512
SHA512 8df95357a0f88ef32ebab93a46d8fb56583d0d419e3d48d319ec0ac966f816752fbd5cca5c02b76c6dad7de5e6c59da87e123e2ff35097caf8e2acd3597dd6dd
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrQdPlbuJHzq:xUEtQevvqc2W1cpV2Xr02z
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ae2576fbeba0a9f1ac65bc0a3f406cf16b6bc25d66125b53d379e669e2141eea
MD5 5ab7fac0e7713f6d8175379248d53ed3
SHA1 c8bf64a2e628cff884c332f5bda17d7234710336
SHA512 680dbf826eeec826b9ce340f9a28ac780d46d96b657660e6e1d49e21790b058ebdded458bc7933d8633384e27f5d9cd20b5e0ce0a623f21cd01f8b40157c1c40
SSDEEP 49152:JObRquA/m2yL5zMfFiV+XenmE3/z6qWJ:Koq1VjnmLqA
TLSH
T191D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6e4a398fb335f4f5fd74f6d7bbcd18832d5163aca7f89cfa33bfcb881d345a13
MD5 3d9ad095962e3a786048ba415a7418ea
SHA1 ad4d1469a826d29014539e153b6cc1d6e4b69e14
SHA512 2d514ecedabf103c4a35d3210f8da693dc98d74a9d2c8fc4a7e899c6b9301ee8bec57d0d6e58bd760b2c032851a82cda9b6f8c66b253d7b6f58a7c62b155429a
SSDEEP 24576:BAhGLvcFoiwtA5l7S53aJ8ikAROpP7yrOTtoPRd:BAMgFoiq5QqWJ
TLSH
T1C045AE81E7F955D4F5B3AAB899B68171EAB2BCA55E30D20F1164C21F0E33E409D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 86925608a02c59c8525ca16afa598a0f2863290384b3fb943ba40547896a9240
MD5 0f9906f7bfffd60479cffe56e28f1d24
SHA1 e6cd69e4347d2d23ce0d666796c40aef6c9460bd
SHA512 6d1b2a894fe110a3bdd3340049b01c76da146e4af3c826c6c4bc37a50d0d3ec0240cffdebeb4cbe6f884de8c61b8137192878df15656766984c18e22fa420003
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C+RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4d:Owu+OWd8ikAROpP7yrOTtoPRd
TLSH
T1B505F14666951CF9EA6742398597C03AF7F2BC112A64DB1F0374C75B5F33221AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 fc6a3e1687bf7dfa77064f4354f979d2acbe69e5cc799bab78a6c38db81c3c83
MD5 67d45d44ee43c0f46a4b9b0403386fd2
SHA1 51f785e3d32412e61e5892315e8d480f312b1d2c
SHA512 09b51aa882982dee8377c203a1c40bbb2e167ead8fa4e66030b41d0d0e6e24b63c1fe49d30373b7abe8458d9a1be2cda6a6a530f57ccfdac77f8478dd89ad536
SSDEEP 12288:FXP1IlwRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:pPuy8ikAROpP7yrOTtoPRd
TLSH
T17BE4124627D834B9E7AB4279C9D5848DD7F27892636857CF0238879A0F229C25F3B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 41c869386feace98afbc5b890d1408b574f598aeda51a70100dec125852f2354
MD5 384712613c523404658a30081d6730ab
SHA1 354938146adc1e1fd7ff43e888d6a002a3055a44
SHA512 c5f2692c86f25314d02bc0619be1a5a3509a4079fa7892e4fb2a512ee3010b5ca18ff5ab40ae2d7cd08331bb578b2c2096af26af9af9f55ca3c2ee3e152d4c91
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U+:XQRQyi36YOcP8Lvw2gAf+PN3CqA
TLSH
T1AA667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8791e31119d453526c5ad8ab8f13470b2a2f881e6431cf7d4264253fe8affb2e
MD5 b093b5c776c9b008a7b64579dbb423fc
SHA1 06a21a9d05165fbfa3731b7e03cd1c40b64b4aee
SHA512 15919dce185bed48721e813ec2d406232c3cbb1328ed5bc18df89dbd64f3e85323cd38a065a0b9b39e62e0402ddd570a5098cef77b69166d053e248f411c645d
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Us:XQRQyi36YOcP8Lvw2gAf+PN3gqA
TLSH
T130667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e675360f5977b77dac322377ea2c0df3800a97ca90504714d69a987461e28613
MD5 e2f1fb4653b43c1c32a505a839269bad
SHA1 acce0d554f0f0f06533b7294e715e88c28029bce
SHA512 c53e561d98c8bf2cebd35feea06b4e0aa4538b73a69297b8d990899dabdde4f8cc9eadb1d5bb2430c3decb99bbb666fff1a2a4f7add728f10f8ad79dd0966841
SSDEEP 24576:gwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0C8ikAROpP7yrOTE:G68Qg55nhMeWu7PNU3/RqWJ
TLSH
T10EB54A33B2F600A9C44DE1769F4A872196E17C718FE0E7DB851573061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dc3c03d9e22ade53842df2c6031e1d8525408db4966844645b82d32d11716a5f
MD5 a38f22acb76d3376d4c72df350898504
SHA1 4a34ec3368fc02df8b4acfad50d4c9637a9dda32
SHA512 c174381b28bce3749afad3c64c46e494fe60048028f566a4c962f5861f73b739dece54c42fc8aaa5d0e0cd448f13692d3d77b33650cce941fa2cd752da13cb37
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99e:py5112gYy5azzVv569nLKnhZ5qA
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6d5dfa3f37c5c2d6e7147054df48df250774e6a439e834946360ffa3831dd0c3
MD5 40b415dc15e854a5622ece624cad0422
SHA1 ca9c285a2b6c51b7e06f465cd1d04210cbfd4381
SHA512 1b9ec00c729f8d49bf17643a1e7a519b6b7c62f5c3a9d7a5746b32e0e212abc02da39cda573be34bb680f324900794a3c30dbd7b0f020f7eefa7ee0ef5b60219
SSDEEP 49152:EB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glHqWJ:eu6JmTxd2dHqA
TLSH
T136D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e3316b61c505bd13918431fcfcfebc2b904924340a282c9f6a6061ed8ba3d77f
MD5 6ee8179f7d6ecf52968d40018dea4aff
SHA1 a73be88722f8f79d82babe4ff48dc1ee6d56d4be
SHA512 f1d35bace477dea4b29ac00ec59e3584ef0191400c4c27285a7a77778183374e90852feafb233db68bb4d8266825649fd7df7d273ee61e8c448b5fe732805804
SSDEEP 24576:khv8E1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3W8ikAROpP7yrOTE:I1hpsNoJpF1A6UU44CwH7R4xuqWJ
TLSH
T1A2B5BE13F2D900E8D06DD17887569632EA72BC450B24B6DF0A90B7961F7BEE45B3E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 5084ba758fb2354239a8831006a1a7bafc153d93769687b74ad349239027fecc
MD5 13cfd87e764c49a75c5673ce69628fbe
SHA1 d3197232d4c34e9184fbd8bc90cd9ba6c5ea9992
SHA512 40ebe8e3b1e4a1e416187c9f64295503cd4a073ab8ea05942549c7abfcd85e3a9ab598869dd62b17fd15076a14fc0546e4402d1e6700d284e246e5d525e8df31
SSDEEP 24576:x4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6lR04FxGgVG2Onks6xt4bSMHnq68ikAROW:HSuZQIY0Be2K6RVtOnks6NMHqyqWJ
TLSH
T1CAC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1cf1600817f51d54d393ec0bc536ddc5f344cbf3552078e0c20e06c50de58e13
MD5 dfb41acc41b89222c58bf9ee3b330aef
SHA1 78ea7720958842f2b1296f461702570274a91dad
SHA512 ecb426670f83a9807b3b42c7656a2716096a2c960e950509efd038354fcdfce03ef718050eb3c0129c7b385d057a9c728a0998f13f5be5508877273b51b68a1b
SSDEEP 24576:FhiavrPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QLpj8ikAROpP7yrOTtoPH:FhtSn8EApI0figTgiDn0AP5wnqWJ
TLSH
T1F9A5BE13F2D900E8D05ED179C7468632EA72BC150B28BAEF0A50B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 ce93dddcfdc054030c0fd3968281fd65dbebabfe099b3d1890b74b9b624429dd
MD5 32bc2ae509edbf0fa24d82470d99544e
SHA1 6fea6f503bef21d78d232c0ec91fe4d2a22a6c6e
SHA512 f363b55ed2058c02e7bc12967a2eff69f3dbdbdffe6499641f7b085e0dc6ec572221aecd66fca84a144e13319d44acb4fcba378f2df67c50921c7dbd4f9ad319
SSDEEP 12288:oORmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:oO8ikAROpP7yrOTtoPRd
TLSH
T1B1D42346898F2C7AEB6C42F285C584EDDBF1ACD1E6CC6E24523CCB5E0A21813571B6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 f08e66ed622c1101d796a7030c5a2e42733847551b36fffb961493f856914321
MD5 94b3dbc1a695a0f00f5f3396c83d6e49
SHA1 4e5c4a87a3195974319c3ed15e6315f79699fe40
SHA512 cde72636ae590a0aa6fc1a7b1fa5170cfb05383aaf5d70846829d2f7294c3a01107c80c65360ff274805408dedcc6544556b6bd6ba50dd5a06f975b2901a8168
SSDEEP 12288:OiRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Oi8ikAROpP7yrOTtoPRd
TLSH
T173D42342898B297ADB6C52F586C584EDDBF1AC92F7CC6E24523CCB5A0620813571F7B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 ecea050005bb27737e39e76d2ebe3182c1f7456ddfb19d3e33fde11d6b75716f
MD5 c5ce2c0c0e9278120ab5214857961d6b
SHA1 ef46ac2bcd972ec8d68069bf1280b704bf3812d6
SHA512 06cc357f57de7a1c5f486e74d3eac48d30513c7472950302ee2eb1de5dd13a602287e3b3b52a693c20e74e4119dcb71d5abfdf157c2670bef55125c9cce53330
SSDEEP 12288:Q7RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Q78ikAROpP7yrOTtoPRd
TLSH
T191D42342898F2C7ADBAD52F586C584EDDBF1ACD2F7CC6E14423CCB5A0A21813571B6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 7f555cbd37d7bdb75b8257dcf2447e305e1dffe5e86170f56b7a6cf21ea8d15d
MD5 d6080135f6e42ee5d7e12cee058f4273
SHA1 db0de8758b78db0eac3f6eecdfb8d26f36159a4e
SHA512 6c9e321dc19ac73cffe6cb0b61cfdc4bc7240a390ec50bc07991a2a9c489e9bcbe1b683ec93f9b5c0b8f3a875885953c09093e9426d65e61ec922820659a70d6
SSDEEP 12288:+lsRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:L8ikAROpP7yrOTtoPRd
TLSH
T1C2D423024A8E28E5DB7D92B5C5D584EDDBF1BCD1E7886F1E43288B4E0E305125B2BB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 deb2ca172614b98a4f29157e95f2e6725a5ccace214569d229db89cfaa9f2efb
MD5 a5b15245974f3070b8f08e4553020288
SHA1 c7d02ac2507c218668585bf5068d65e628246d92
SHA512 45cc4f9162ac5453401980491f7df396b13c81c487132c26192a9351d9e52e8eea32679af0cc3d4713ce322e2d7600aa05e5d6b240a0e4a4714478dd07b4d6c6
SSDEEP 12288:/RRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:/R8ikAROpP7yrOTtoPRd
TLSH
T1F8D42346898B2C7ADB6C52B586C584EDDFF1ACE2F6CC6E24523CCB4A0A21413571F7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 b2cd90807761fff94f95519d692e9e42c896f738af4e53c9f84506278b5646ed
MD5 67d36746c24f557ed71c983f63a93177
SHA1 276f8cd19551218704dbef1010c10dff35990f9c
SHA512 12de2c367d7dcd3bb5f1e9d84613ab955af315a2a8bd3aac3c10ee556073e09b4f507feab406859e366ab3fee04d9287101889b01718c683e09f1a383aa81f12
SSDEEP 12288:8ORmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:8O8ikAROpP7yrOTtoPRd
TLSH
T186D42346898B2C7AEB6D52B586C584EDDFF1ACA1F6CC6E24523CCB4B0620813571F7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 056dc743522ac282e9b7a38b0146631186c48a4a4520cc9ef3040a5a750f86d4
MD5 d8a4cb02861f9e1e3460cee8df379ffb
SHA1 fbbea2e84366838083423fbb7be17abddae51cfe
SHA512 ccab251c1a7343cf57e60b63587eebf9dfd52f330288f5d739709c85b7cdca9fceb133e49d77753f1bf892c30b59eb282440d1b976dc4108ed818ee319a8595f
SSDEEP 12288:7SRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:7S8ikAROpP7yrOTtoPRd
TLSH
T101D42347898F2D7ADB6D42B586C484EDDBF1ACD2E7CCAE24523CCB4A0624413571FAB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 ab7e0b42777428cb2b9fa23e22142888066a19e614729bab00a17911ca36b300
MD5 6ab166f114d803ca2bc178a775b5b44a
SHA1 211d607cc3777df1f6c51a70a22dc0218d755851
SHA512 0a3ff180150da152fb9133e6bf10e63b3a4fb31737df864065fe902e1ff9f2e45ae253184f6ae3d76856f0e77349e1ec70f6b77d0f046794e5c91a4e2187589e
SSDEEP 12288:eiZwb6vzH5LSqcPvyeRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:BZMGzHNSqe8ikAROpP7yrOTtoPRd
TLSH
T10F150185B3901CF8EE67823EC955885AD6F27C5546A4CA1F03B8376B0F333611D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 c1afc64c97e067c513655dd3d2eb22dbbb2f383e345a3d1af1a6121ffe7b53f3
MD5 1b97653353b7fd9793ed0de481fdf526
SHA1 7abed7f84711d8e1503ba323f2ed025fa83ca57f
SHA512 2f0352b8f595677e68ff54d5227f58c7394aa0a3a92297cf5ded1488b981dc9a3a7e4d7e5f79d1c749ad1bc833b56e81f400ef97cca1ed013754438c84ef856c
SSDEEP 12288:ErRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Er8ikAROpP7yrOTtoPRd
TLSH
T108D42346898B2C79DB6D02B586C584EDDBF1ACD2F6CCBE14423CCB5A0A24813571F6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 6e376bc5d4ccc3521c1085afa4be93e344bd0403324fd3a0316ea7254bfaa75e
MD5 5f0f18d2ecac91b7f68fdb7ef902bc4e
SHA1 6ff45a48181bffd06a3b29f8c1b275603728e295
SHA512 954fc64751ca4429913514ed86185a55488157bcb2a281858c10242d67571bd9727838ee0877b076a02cfdf01adbf904f1ca2c8ba6b98ba98140786075679590
SSDEEP 12288:aFRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:aF8ikAROpP7yrOTtoPRd
TLSH
T173D42347898B2D79EB6D52B586C484EDDFF1ACA2E6CC6E14423CCB4A0620813571F7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 4e36eddeb839cb302ce12fe7a115ae759227a0384cafc948a7a89d21e8197886
MD5 4228804462ced896d03b792712a6e2d0
SHA1 17b77fc6e038018bb9856808709516539770e750
SHA512 e5c615f8797dbcdbe703c9d1addf90968421ff0a7bc9510542ac71a9722d9721f8e19f22280688c5b2672460d45a14812e474e4137fea60a6dfd482c6d274d75
SSDEEP 12288:d4PeALKCRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:SebC8ikAROpP7yrOTtoPRd
TLSH
T15CF4120767A630F9D27A8278C891095AF7B2BC7247549F6F0368477A0F236519E2FB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 d11f7a3a790aacd5204daa7d68a7cde5dcaee4a770dfe484f5c66042df32a2bf
MD5 20a844dc3fb779366477af826610cad2
SHA1 f379c1edc14c177c73f2faea23df074f42bc81c5
SHA512 8aeb41945074242475cb34759e46d4186cb7d2af5368bcbdfa8038ade0ed7adb60e4fe3f289d33bb793a13038166bcad4f6f26cb35766b80b63dc0eed438189f
SSDEEP 12288:8ERmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:8E8ikAROpP7yrOTtoPRd
TLSH
T17CD42346898B2C79DB6D42B586C484EDDFF1ACD2F6CCBE14523CCB9A0A20813571F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 e609f403a080b5160aa2cecda9753e487286fce6215ba67e9652fa76b9f30398
MD5 2483526015f89478b194d470eb0d2aac
SHA1 c2642e1c21eac04f7b4833d89cf28cfd6b758de1
SHA512 b10e0c87b995e91728681764c4872c4cc56b84fc0310b61a2d0a544ab38aaf3e387337e130557de08fcf8379f09d6085b331aa5a9e20b132796380e577937cd0
SSDEEP 12288:wkRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:wk8ikAROpP7yrOTtoPRd
TLSH
T1D3D42346898B2C79DB6D42B586C484EDDFF1ACE2F6CCBE14523CCB5A0A21813571F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 1ac30f638d2d77430f977d2e79fbf0241de234384b69006ad12996316ba5b0c5
MD5 be20b8eaed1a056429de84d4ea2e1ac3
SHA1 ea84b7827d296006f5e08345b4baf31ac4bfd20a
SHA512 af4abfb100c519eb73d661d1a1b20d19c656c92a6d0e62d29187fdca3f56fe954f632731d96e5e05ae063d1996c1107dbc166c6319bf46d56d32968bc4906edd
SSDEEP 12288:c4PeALK2RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:/eb28ikAROpP7yrOTtoPRd
TLSH
T119F41207679630F9D37A8238C892095AF7B2B87247549F6F0368477A1F236519E2FB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 05cb3d59c7400340c4dc9bdae1366bb6d21e3e189e6c9d657478230dac2c21e1
MD5 c78c11f2b426f3ad15d41da89ab623e7
SHA1 48d5869b0cd7dc2c9431e57b23f854ecdc80a38b
SHA512 3a314c60c99b9935afd6ada4a191bbb85c2ffcbc601ede3ab15a16534e8ed36bfc4e21298a20bf50ea7c7e38218668f504236c6f5b8986fb22ecb3374daeb6f9
SSDEEP 12288:hCd98V1oaLHF3z0z24PDvhkRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4d:cTPaLl3z0zBk8ikAROpP7yrOTtoPRd
TLSH
T16B150195B39018F8ED67823EC955885AD6F27C5607A4CA1F03B8376B0F333611D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 e09db1d78510b77df3f2ef4a17ab0936dc1c4896670cdb143a287fa4467a16ca
MD5 beafabba380e1672169305382ef1dab3
SHA1 25bbeaf8591aff3219db3655593858364d034dc2
SHA512 f12ab921abf5ecc0eadf232121ca0142617043167ec2cebcb0a043c2700ed7c4320980f8f998f14da84af7e23e725ba7121a9701a813f42f54e4ebda4a3dbe56
SSDEEP 12288:yi4e70udEfgwCHay7cLbbdIvnRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPH:y3adSCHay7cZ+8ikAROpP7yrOTtoPRd
TLSH
T1DD35D090F3E414E8F1B78A35C9764511DAB67C991B60DE8F03A8661A1F336D18E39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 2ee8b8226f0207791c1422591b43b83d01dda2b7771e4ce752bfcd84cfa5e049
MD5 9c78d3605d399e5552dd1c7e98d4eb84
SHA1 2db485c007189ccfd37fa960f74f87301f474ec8
SHA512 b1e86ce51a98edabebf06be4b27f7a849c7552938946d1ee68f53cd0d5c664b9444a054f3b85a288408bdbc64dd3eb6087df0b516c53299ad0fe12a88ca71311
SSDEEP 12288:6SRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:6S8ikAROpP7yrOTtoPRd
TLSH
T18CD42346898F2C39DB6C52B586C584EDDFF1ACD2E7CC6E24523DCB5A0A20813571B7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 23ebe625a6f80877d4ec739425ed55dcf26d380fa35dd8d2c935f1dc6ddcd292
MD5 36c1126815cfed48112bb07d0d47a655
SHA1 1b248c49afcb792326ee1f19679e44559c7c3778
SHA512 266db84f6ff91ac235eb1080a8592da30d371f6c528e8648fab5d1883001e251bd5cefa7c0bd9c0737fa65b845e1fb7d823d1f21c045414469aa07ea3a5f8298
SSDEEP 12288:oGRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:oG8ikAROpP7yrOTtoPRd
TLSH
T17ED42346898F2C79EB6C42B646C584EDDFF1AC91E7CC6E14523DCB5B0A20813971B7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 e4465a4f4aa79e707af80fdb2a8f4d4b5795c9ee8551260ffa7e1aecd93d9c27
MD5 a048adcee7f003216dece1df9439dcbb
SHA1 6d4f56dfe08ce9dd81bc51330accb6feedd94a1e
SHA512 72ae02f6cd5ed9105abfd8970bd0d5a7a612a76a88e6b1972605787b6fa34ef2871b3fe3e7cea7243a961b4a903785ace755187d7f0463df8c40a17182641584
SSDEEP 12288:hKRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:hK8ikAROpP7yrOTtoPRd
TLSH
T159D42347898F2C79DB6C42B686C584EDDFF1AC92F7CC6E14523DCB5A0A20813571B6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 d98e08f465342986aa4a4690955e742f4e3c61c4e067818e99ed15c3599502af
MD5 d8a2f7e2d66ed94a9e40f3ed0921a0d6
SHA1 199f1d11f0361d26f24ead259c373cd339e590da
SHA512 3ca5a1eb8902bcf0fa959cae710a68b85ea5f50cbe2f8119eb350c302f90c8412a3b46737cffc2bfd7ed32dc6b5d67074e789ce53cf3e2323b750a849510e5a1
SSDEEP 12288:muRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:mu8ikAROpP7yrOTtoPRd
TLSH
T12AD42346898B2C79DB6C02B686C984EDDBF1ACD2F7CC6E14523DCB5E0A21813571F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 b9ee20b93751e66dc1bb0f3382f54a8a4226e3ea3b05d009bb8ab70739f4f3d9
MD5 905ab68054de5686d8adf60deef5d54e
SHA1 abab8d2f6ba093d3ff018a73cc66e30228fe4cf8
SHA512 7ce6298fb77dfb11b8140511172b62d2fd1912a2fb2e6366c1aafb3913b0e2794a0da46703989455263417719fbf4c6b018f7c509c1852d26cd343a803e6ddc0
SSDEEP 12288:tTsfKRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:8K8ikAROpP7yrOTtoPRd
TLSH
T1AEF4010AC28811E8C26E5275C7858985F7B37C6193E4E7CA13D4FA3E0F365519EEA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 f122fc7730cabf0058751c86b51d1ba471f95dfce0f27a231c4bb11d5ae7d52e
MD5 b2b2a1d13a0e53239e827c34bbd49cd1
SHA1 977713d7b49efed5cfdc47d2dbd0794fa9b1d1b3
SHA512 f38a271357276efd88ece7b38ab91ecae38375d25054c0d3f60331074ad4f780c9fd4f005cb60e2c4c5398440501de8bfc7f8aec9651357cc7f3b8ded0b1c426
SSDEEP 12288:ct7ZRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:kZ8ikAROpP7yrOTtoPRd
TLSH
T1E0D423038B4E6C25EB7D12B145C9C4BCDBF1BCA19B8CAE56912CCB9E05309528F2B775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 79f340556de86c29e984ee39d6bf80d7419cc77edd1d4c2765c0d28114e6bdc6
MD5 ab127c4f5790c46a2dafac1d21145d00
SHA1 fe379a685f60a3b2a621fcbc9fbd323d90ef84fa
SHA512 6e8f8145453b03e1558ec394d2645e345d45907ba38d376c03485ebe4ceaf92fe4b06592e824cdff46d35932432722b94d3b9fe9f9d5ba293ad9b2c922a76061
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bY2i8ikAROpP7yrOTtoPRd:fgb4mBIBhGFuqWJ
TLSH
T14C65AE1E22EC02F5E1F9D2B8CDAA4417D6B278160731D6DF1151422D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 ce7bf86c5dd364c0f21e96a7eeeed4ea051107d96b86110c0caffdc5e685edce
MD5 54426eb0a1f449f3abbe3e4fedc3e416
SHA1 3afb5436deaea761d362e1e62392840af4feb927
SHA512 7f3a66a09be6d84df74506723280105583cdde4f7c5501f62bf31573a87023f3f8a15fa3e92202ff9cc91d99028c9f1a88dee84e2481d9629c99cc7fb741d6a6
SSDEEP 12288:x5GHyjRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:PGHyj8ikAROpP7yrOTtoPRd
TLSH
T1C7E4230A559A34A8CB3D8375449580AEFAF178A0974C6EFF0178D77A4B208E1673FE74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 2de0a59c0f82ce03b4566eb568102c08f09feaadebb91b713917f0dc569c63b9
MD5 f7b23d243db7762539935c7719bfaa39
SHA1 3418fb41bb659a68f7d7cf619282426582feaa01
SHA512 d9cdda148132ba7f173aa14a13f9d9e10c2ed30a5dd788e519c5a0d9f8c7433c35ca704050ef92597c133f4d62e7fff513865c4ecca52d79a5451a62dbbffe9a
SSDEEP 12288:ZrRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Zr8ikAROpP7yrOTtoPRd
TLSH
T1D3D423428A4A2C29DB6D02B545C584EDDBF1ACA0E78C6ED3413CDB9B06258D3973B7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 729d1c522a60cd4d81a5f144e9ebd73738e8afb82fe83c811d2443ff17ec12bb
MD5 d665af9d7eca4732ecf52529951fabf2
SHA1 680c288ba92cd336a944c3c97e077b57ac151332
SHA512 53c07dfa10a73a828d49f117656acd15387761e4f169d7130a643106938632de4710511fc4e67c597873767e7edf15ae9d61f5787ad8974101310c314b6751ae
SSDEEP 24576:ogb8u8FpJqH19zria7/m48ikAROpP7yrOTtoPRd:9AZFPqVka7/dqWJ
TLSH
T16F35F15566E101F0D57BD138898646A7F6B2B8211364EFDF07AC8B560F23AE14B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 98f73cbabb2095aab76c2a905710326536754c95773b5b31c1a258f46374b0d1
MD5 97d7b1d6fce1e0c28099a07e2ec8e85c
SHA1 36ca79bb09c4aaf3151ae127cac37e183786bb66
SHA512 92c5958b20e3baf83b66c3d7a3bc1dd28039e67cb90ecdc6cfd42ab05b5926a62c35965685f0e9f2884d76cdf88b39ec27f2ac6a1f6eccda951949cb2fc66c60
SSDEEP 12288:8QHvUrBFrEjwaQ/ARmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:5PUr+NQ/A8ikAROpP7yrOTtoPRd
TLSH
T10905E11F669D1CE5E77AA17D8582861DE771B8621741D6CF02A0827E0F23DD8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b68444e1b0e22be05d19e017f4c8abe6ce12e8d91540c89edfcfcef22030141a
MD5 3ae4c38fac19a2a2640dbb997be693bb
SHA1 e0335dd1671eee892b50851104ad3394b9d18221
SHA512 504e63e8e2553a0c2ee28af5c9911aacd21e4d8ac4c962241c8c795830dc40d2725a4b6532e250732e4717e175bce21d1b16e4f67c9bba8578fbba2ba99a3233
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVqWJ:RG05lO43bqqA
TLSH
T144D5C06E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4967E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 118a79914c79cbb1e1af146f4e48eac406da78fe45fe685b311fbcdfc1824f20
MD5 8d98b60562dce30876a17c8d048fafbd
SHA1 8eeb9cfbf500b413f84f7a87763e0949a4c7b8ba
SHA512 29a3505ad8e70d65602c25d0f0ce226b6a237de9dc4137367cfa3005db0a11ce43b9442966114a42a98e5130cbd7a96a14a74f2d7b2015d0e70746606382d5ab
SSDEEP 24576:Fla5POZ3dpbWVM50JicR2hG0lasx2+47eidnh8ikAROpP7yrOTtoPRd:Xa5POZ3wJt2pasx2+mFqWJ
TLSH
T12065BF5EA6FC01D5D6B9D17DC583861AF5B1342153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a02e8662d8d7c9a81e3ac2e9cd87affedc74fa53a0ab27f8ac034e6b1896c70f
MD5 813d4ca4cc924b51f28c54f68c2f033b
SHA1 1df3714e936d7cc625312227cd7dcc512d8f0ecc
SHA512 29f0c0c269440b2ac17c5bc73c9199372352ccda3dfc9c11c234071520cf3228a08032f58cbed5574fc5471952764e5cf57b7d5e1184093d116e0ef269622375
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkP8ikAROpP7yrOTtoPRd:KNc/zEOVHFIqWJ
TLSH
T14A858C1623E901E4F2BBE1BE89679546FAB1786513348ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 7d43b7655f8cd7789928efaa8995e306f041b3ac96f986dcbafdfe1e7b971478
MD5 031eeaff541ac0cbcadaa916b920d659
SHA1 ff21784f19ef619008ff4c39608a443cf39ff94a
SHA512 6c0f245993f42765b670299679e4e11f45c56c28e7038316d5f215e61ce22bd13d67c8c8186d03960662f55e0d30a03ea2836affce91bb9326d6d7d3d58f938f
SSDEEP 12288:O7HPJnJP6szeCs6Rl28dmRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:UJnJPbzB4Sm8ikAROpP7yrOTtoPRd
TLSH
T15415E12DC29810E8D4B7C2B4815A169AFF71387D2F156DC719B8D5353F12EE0AA3AF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8670792c0e792a5cdba4d2ad1351e1427e608fd9f6b9f1ef9fe6b94d68a58af2
MD5 54a417d84904043a51836f2b73aea6e6
SHA1 1f140c96761ecffee7a6d420e73469f897757a9f
SHA512 f91a2fb9613cf6f71edcfd34a85cbf4cfee79f11dc51a92ccce15c7c8ca1a67f4cebd9d9f8a1764fdf1bcd583414db1ab0f001b55257aad642f1ceb6af334826
SSDEEP 24576:0CLHGL0MoeVtFumTijCmlKQWDkG8ikAROpP7yrOTtoPRd:0CLHGeeV5ijCmlDWDkOqWJ
TLSH
T11FA56C05E7EB5184E9F3CAF5CA2294169A327C509B34F7DF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 9f92ead430992f1fafd0f57a8ecef7e33d83a3f9920b1cddeface8a2f32b2215
MD5 0d4dd419171d7ff2ba85d9191d1c1d96
SHA1 c2c96d76630dbb745be2ae316ae919c66972aafc
SHA512 d744ad2f32dcf1115dc099063fbe4521150fe121fcf0792d1571bff8dd9d8ab43b13c15f4d216a04f937ceafb0d7fd7ccf1dc7c631abb77f9f544ea45a5d16a3
SSDEEP 12288:A1Hck6j5ZI7xRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:Q6DIt8ikAROpP7yrOTtoPRd
TLSH
T111F4010D236A10F9D27BD03D86834455D2F2B4B087456ADF06A8C6BE4F63ED8BA3DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 5311e1582553dd659ee38b6989837b20c010fabb1ece63dbbac68f4ae3759b04
MD5 7570d39b7a90d4423872657807c4c35e
SHA1 3951f242f80a70dc33a806fed94ce9d7b7579a5f
SHA512 59a886ad9882a37342b0d827257e3205fe24aa84a92924fb8b54d82f1d488fa43ef26624c7639b39082f8f788119c30e68113c648dc691d1eb7003c9e1753f68
SSDEEP 12288:YG6kyd6RmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:5tyd68ikAROpP7yrOTtoPRd
TLSH
T1F9F41305538874A5EBBD02748AA280E8DFB1BC609B445BDF5164DB3F0F31BD1AA36B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 0039c48ec6a5e762b41be60ef8adc5343e27adf783ed0036776cf6758c95aa2b
MD5 a77978c7c4e5437715deb126482f0bb6
SHA1 5e1e9e404e6b53f173778f383074d388956cc145
SHA512 c5c92ebe28f3a6b189b6e4b5a2c873e0b47f36215374f50892ef76c623c98d624bc71951f144c18c09483b1c797f42e5e241b89b3f0bf73b6b94abe67cd18031
SSDEEP 12288:xrGRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:5G8ikAROpP7yrOTtoPRd
TLSH
T17DD4230A864A3829DB6C52B545C584EDD7F17CB0AB8C7EEB513CCB7A4A244D2573BE30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 68eb57810d5b8156f4d830c6e418f71566e94b9927e3abb4943320a9b65b2e88
MD5 a3c3ad2095479067686f5599e3375353
SHA1 7ea8737fef8a722a0c2f7fcfb59811ae961cfe6d
SHA512 43f7b7c84dc29aa044a62d2934ad5542755efa94e35a9aa6a1adf77fc19346ac320266a055198b0505821f351018fce5c7ab204a772ad6714a1e639621dff25d
SSDEEP 12288:gXgIuZyFDK3tT5Tr7aVLIH9lH3cvRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7J:gXgILoTfaidZC8ikAROpP7yrOTtoPRd
TLSH
T171559D1DA3EA09CAE2B2D275D8721493D633B4315771D6CF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 d90fee087f5d4cd3a4c399f90d840eeee84afb6921a0743f4bb5a2c211e9e0cb
MD5 8a360dd62f0004572bf36ea6ce397f12
SHA1 f2e61f976c461e62ecbfde7ec95f85ba16b3e7c6
SHA512 2a5f3c41684b8586971cd8b3dcbb5b7026348aa2da385b91a9fb36c710b9c42e4f6a39d1f77af30bc4acf360c4097babe1fb4c7b8768dafbc56f2a91d34a6f5d
SSDEEP 12288:ApJcm8CNJRmBZikAROs6r5s92XlIUBiKQpriOY3Ttat7fZPK4bR:ArcmRJ8ikAROpP7yrOTtoPRd
TLSH
T15105010EB2AE00B5D2BB817C88814559F7B3747063416BDF02A5C77E4E279E97E39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9280f75ea70917b0cb29ca162b3524d3fa5e6891f555b68077cf5209f948b3fd
MD5 fc40eb3b3c35651a9601b52cc23edb1c
SHA1 0d66b5df307e40d0e9d573cdbfd6b77d14d4ecf1
SHA512 2905949f80d80192c72c27c02e463e0911a33d7e6962e72c1a162a1a3a503784f5f866a3d788b71a70e0ec760f85fc6fb6c2cdfe751a5d1d418013d957cacd1d
SSDEEP 49152:0DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3hqWJ:x3Upow8sBSqA
TLSH
T1C7A58C3DA2E810A8C9AAC379C54213A6EA71782D3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-279-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/944-274-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/944-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/944-352-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1204-28-0x0000020A0C5E0000-0x0000020A0C6DB000-memory.dmp

Download

memory/1204-30-0x0000020A0C840000-0x0000020A0C8A6000-memory.dmp

Download

memory/1204-29-0x0000020A0C840000-0x0000020A0C8A6000-memory.dmp

Download

memory/1204-31-0x0000020A0C840000-0x0000020A0C8A6000-memory.dmp

Download

memory/1736-449-0x00007FF643ED0000-0x00007FF6443D6000-memory.dmp

Download

memory/1736-373-0x000001E3499B0000-0x000001E349A16000-memory.dmp

Download

memory/1736-371-0x00007FF643ED0000-0x00007FF6443D6000-memory.dmp

Download

memory/1736-372-0x000001E3499B0000-0x000001E349A16000-memory.dmp

Download

memory/2036-59-0x000002047D310000-0x000002047D376000-memory.dmp

Download

memory/2036-60-0x000002047D310000-0x000002047D376000-memory.dmp

Download

memory/2036-58-0x000002047D0F0000-0x000002047D1EB000-memory.dmp

Download

memory/2108-383-0x00007FF650EE0000-0x00007FF65100E000-memory.dmp

Download

memory/2108-450-0x00007FF650EE0000-0x00007FF65100E000-memory.dmp

Download

memory/2108-382-0x00000224A5A10000-0x00000224A5A76000-memory.dmp

Download

memory/2108-381-0x00000224A5A10000-0x00000224A5A76000-memory.dmp

Download

memory/2320-307-0x00007FF7D9FB0000-0x00007FF7DA3C6000-memory.dmp

Download

memory/2320-380-0x00007FF7D9FB0000-0x00007FF7DA3C6000-memory.dmp

Download

memory/2320-447-0x00007FF7D9FB0000-0x00007FF7DA3C6000-memory.dmp

Download

memory/2320-445-0x000001EF6F300000-0x000001EF6F366000-memory.dmp

Download

memory/2320-303-0x000001EF6F300000-0x000001EF6F366000-memory.dmp

Download

memory/2320-302-0x000001EF6F300000-0x000001EF6F366000-memory.dmp

Download

memory/2408-361-0x00007FF651020000-0x00007FF651763000-memory.dmp

Download

memory/2408-287-0x0000023FFF250000-0x0000023FFF2B6000-memory.dmp

Download

memory/2408-285-0x00007FF651020000-0x00007FF651763000-memory.dmp

Download

memory/2408-286-0x0000023FFF250000-0x0000023FFF2B6000-memory.dmp

Download

memory/2484-343-0x000002868EAD0000-0x000002868EB36000-memory.dmp

Download

memory/2484-342-0x000002868EAD0000-0x000002868EB36000-memory.dmp

Download

memory/2484-341-0x00007FF711F20000-0x00007FF712240000-memory.dmp

Download

memory/2484-347-0x000002868EAD0000-0x000002868EB36000-memory.dmp

Download

memory/2484-349-0x00007FF711F20000-0x00007FF712240000-memory.dmp

Download

memory/2520-265-0x00007FF756500000-0x00007FF756649000-memory.dmp

Download

memory/2520-266-0x0000017706470000-0x00000177064D6000-memory.dmp

Download

memory/2520-267-0x0000017706470000-0x00000177064D6000-memory.dmp

Download

memory/2520-340-0x00007FF756500000-0x00007FF756649000-memory.dmp

Download

memory/2736-353-0x00007FF62F7F0000-0x00007FF62FA7A000-memory.dmp

Download

memory/2736-354-0x000001D2533D0000-0x000001D253436000-memory.dmp

Download

memory/2736-355-0x000001D2533D0000-0x000001D253436000-memory.dmp

Download

memory/2736-444-0x00007FF62F7F0000-0x00007FF62FA7A000-memory.dmp

Download

memory/3112-40-0x00000247A9870000-0x00000247A98D6000-memory.dmp

Download

memory/3112-38-0x00000247A9870000-0x00000247A98D6000-memory.dmp

Download

memory/3112-39-0x00000247A9870000-0x00000247A98D6000-memory.dmp

Download

memory/3112-37-0x00000247A9650000-0x00000247A974B000-memory.dmp

Download

memory/3740-246-0x0000016DC1A50000-0x0000016DC1AB6000-memory.dmp

Download

memory/3740-245-0x0000016DC1A50000-0x0000016DC1AB6000-memory.dmp

Download

memory/3740-244-0x00007FF655460000-0x00007FF655528000-memory.dmp

Download

memory/3740-321-0x00007FF655460000-0x00007FF655528000-memory.dmp

Download

memory/3780-394-0x0000023FC1240000-0x0000023FC12A6000-memory.dmp

Download

memory/3780-395-0x00007FF750270000-0x00007FF7505AE000-memory.dmp

Download

memory/3780-393-0x0000023FC1240000-0x0000023FC12A6000-memory.dmp

Download

memory/3780-451-0x00007FF750270000-0x00007FF7505AE000-memory.dmp

Download

memory/3960-55-0x00007FF7E9EE0000-0x00007FF7EA047000-memory.dmp

Download

memory/3960-46-0x00007FF7E9EE0000-0x00007FF7EA047000-memory.dmp

Download

memory/3960-47-0x00000201389A0000-0x0000020138A06000-memory.dmp

Download

memory/3960-48-0x00000201389A0000-0x0000020138A06000-memory.dmp

Download

memory/3960-53-0x00000201389A0000-0x0000020138A06000-memory.dmp

Download

memory/4348-325-0x000001F593780000-0x000001F5937E6000-memory.dmp

Download

memory/4348-389-0x00007FF70ED10000-0x00007FF70EFB2000-memory.dmp

Download

memory/4348-322-0x00007FF70ED10000-0x00007FF70EFB2000-memory.dmp

Download

memory/4348-324-0x000001F593780000-0x000001F5937E6000-memory.dmp

Download

memory/4540-237-0x0000028518090000-0x00000285180F6000-memory.dmp

Download

memory/4540-311-0x00007FF655460000-0x00007FF655528000-memory.dmp

Download

memory/4540-235-0x00007FF655460000-0x00007FF655528000-memory.dmp

Download

memory/4540-236-0x0000028518090000-0x00000285180F6000-memory.dmp

Download

memory/4700-332-0x00007FF6E27E0000-0x00007FF6E2974000-memory.dmp

Download

memory/4700-333-0x000002148E6D0000-0x000002148E736000-memory.dmp

Download

memory/4700-392-0x00007FF6E27E0000-0x00007FF6E2974000-memory.dmp

Download

memory/4700-334-0x000002148E6D0000-0x000002148E736000-memory.dmp

Download

memory/4864-448-0x00007FF6C25B0000-0x00007FF6C2A80000-memory.dmp

Download

memory/4864-367-0x00007FF6C25B0000-0x00007FF6C2A80000-memory.dmp

Download

memory/4864-362-0x00000279D2400000-0x00000279D2466000-memory.dmp

Download

memory/4864-363-0x00000279D2400000-0x00000279D2466000-memory.dmp

Download

memory/4872-17-0x000001B55F570000-0x000001B55F5D6000-memory.dmp

Download

memory/4872-21-0x000001B55F570000-0x000001B55F5D6000-memory.dmp

Download

memory/4872-15-0x00007FF633FB0000-0x00007FF6340D2000-memory.dmp

Download

memory/4872-64-0x00007FF633FB0000-0x00007FF6340D2000-memory.dmp

Download

memory/4872-16-0x000001B55F570000-0x000001B55F5D6000-memory.dmp

Download

memory/4900-1-0x0000000002F90000-0x0000000002FF9000-memory.dmp

Download

memory/4900-7-0x0000000002F90000-0x0000000002FF9000-memory.dmp

Download

memory/4900-6-0x0000000002F90000-0x0000000002FF9000-memory.dmp

Download

memory/4900-0-0x0000000002E70000-0x0000000002F85000-memory.dmp

Download

memory/4916-254-0x000001FA7ACE0000-0x000001FA7AD46000-memory.dmp

Download

memory/4916-331-0x00007FF6870D0000-0x00007FF6871E9000-memory.dmp

Download

memory/4916-253-0x000001FA7ACE0000-0x000001FA7AD46000-memory.dmp

Download

memory/4916-252-0x00007FF6870D0000-0x00007FF6871E9000-memory.dmp

Download

memory/5384-293-0x00007FF65D8B0000-0x00007FF65D95D000-memory.dmp

Download

memory/5384-370-0x00007FF65D8B0000-0x00007FF65D95D000-memory.dmp

Download

memory/5384-294-0x0000018A98660000-0x0000018A986C6000-memory.dmp

Download

memory/5384-295-0x0000018A98660000-0x0000018A986C6000-memory.dmp

Download

memory/6004-387-0x00007FF7D59A0000-0x00007FF7D5A53000-memory.dmp

Download

memory/6004-315-0x000001F4FBB80000-0x000001F4FBBE6000-memory.dmp

Download

memory/6004-314-0x000001F4FBB80000-0x000001F4FBBE6000-memory.dmp

Download

memory/6004-312-0x00007FF7D59A0000-0x00007FF7D5A53000-memory.dmp

Download