80207145a85a237862c98b9252fabea09257f079243dce7c0526c132cbd38074

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260808-epfg3ahm4v
SHA256 80207145a85a237862c98b9252fabea09257f079243dce7c0526c132cbd38074
MD5 12b5694ee4457ead14cb483c639f05a4
SHA1 928ecb1fb5e9e0023f9d5ca72dbb639ce67793d4
SHA512 d4f2fb9496166076cd2ec0765b0bb339f17295fbbd73e86dff366ef2408ff081e176c8eb12925dc7aa00d140609d15441c9478be7a34cc2cf54e3eb7da7958c7
SSDEEP 24576:uhfDc6X3lQM5xr4cQFTj0OZeVJ0tuphSVDcQo0jJXyyF4DC6Rbz:tul15qcQFTIOZevph2ho0jJtUC6t
TLSH
T12545E01EBEF1D032C02352318D6AD35862B8A4B288364497BBDD672D2F715D39735BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4376	alg.exe
2652	elevation_service.exe
1588	elevation_service.exe
5612	maintenanceservice.exe
6032	OSE.EXE
4784	GameInputSvc.exe
1532	GameInputSvc.exe
1392	msdtc.exe
5540	PerceptionSimulationService.exe
4320	perfhost.exe
2820	ReFsDedupSvc.exe
4848	locator.exe
5100	SensorDataService.exe
1852	snmptrap.exe
4412	ssh-agent.exe
3564	TieringEngineService.exe
1960	AgentService.exe
6036	vds.exe
2176	vssvc.exe
2788	wbengine.exe
4332	WmiApSrv.exe
4104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1a699d27b05c2f27.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	GameInputSvc.exe
1532	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5056	2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	4376	alg.exe
Token: SeDebugPrivilege	4376	alg.exe
Token: SeTakeOwnershipPrivilege	2652	elevation_service.exe
Token: SeTcbPrivilege	4784	GameInputSvc.exe
Token: SeBackupPrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3564	TieringEngineService.exe
Token: SeManageVolumePrivilege	3564	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1960	AgentService.exe
Token: SeBackupPrivilege	2176	vssvc.exe
Token: SeRestorePrivilege	2176	vssvc.exe
Token: SeAuditPrivilege	2176	vssvc.exe
Token: SeBackupPrivilege	2788	wbengine.exe
Token: SeRestorePrivilege	2788	wbengine.exe
Token: SeSecurityPrivilege	2788	wbengine.exe
Token: 33	4104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4104	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1532	4784	GameInputSvc.exe	97

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_12b5694ee4457ead14cb483c639f05a4_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6032

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1392

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5100

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4380
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ecbe9ef4fbe15f6846df35d5f9f4743be86e20500a0277a71012de24f697a1cd
MD5 f39bfc06a069ee32938c307f46895913
SHA1 30acfcb0b8eb88d83a0dd5cd89d52af804eb6415
SHA512 b40d92db178d80cea623e2e4f574d261e344454c34c32a9e7068f81e0d12ea6c197eba1ed689dba7826d041d159de7f37eb78d5337b6baab9c53b70d81e7f23b
SSDEEP 49152:Zb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnpph2ho0jJtUC6tz:v3q6gjB8jAtUC6tz
TLSH
T1C7D59D03F69900E8E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 ff3bfc744450d94de620168aa0fd27e7313d74fdcf16e41789b473e8686c2228
MD5 3c8db536ef7521f3cc065c6ad5e09277
SHA1 7f973842f19d984b75a15a61e546f185783f5f24
SHA512 e564f9656adc1f34730a59236374333635f224f0254350ae23c773cc0061bd92d82399b596681be5c9e75c8fed1c0f5582726a3cacc5db096197e9205e92cac1
SSDEEP 24576:vXYjDtczAUtuphSVDcQo0jJXyyF4DC6Rbzf:atcYph2ho0jJtUC6tz
TLSH
T10D05F1286BE41CF8ED67923DC8A28512E67278554770E79B03E48A750F337C85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 c06304fd385ec35c762754e81e55db5292bdcf6a6b114c99586a18830549d621
MD5 22387f6724d0800c8f2ce335600b0268
SHA1 410f3694fea425abdfc5efb41fb4d0ebcc0ef5b9
SHA512 f5ef7205b0bfa988b9569d6c8bb450a5c04a10eaf1bd60f9fe0a4d9feed2174496aae0ae1050569d8168206b9fee0cb9f0bfe28052cf3f5ef524cf216cad54d3
SSDEEP 24576:L0Jez/20hmxOrMHtuphSVDcQo0jJXyyF4DC6Rbzf:Lf/20AoTph2ho0jJtUC6tz
TLSH
T1F445AE26F6748771D073C0B9C5D2A69AE97130865B308ACB4286C77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a351a754a033593a081943c6dbcb7cf07e4b95626e8d351bf1c87329a28956f
MD5 d58b7c348b8417a9e9327d8b586d5a16
SHA1 a2c27f404d687cb47cce2b16a8a99e0c0e42ca38
SHA512 6b8f8c88615cf3a36f3d86298ab4558a3b0b2aeab80f281d365cd91d55c5b1046815e4858e7d7b7d5e30577c6037e7e1f637b89c02415b61eb1033df7743d77f
SSDEEP 24576:9LK/ezSC6vUyD/aqgrvW/6q8wyu7tuphSVDcQo0jJXyyF4DC6Rbzf:4/ezSC6vUzPvuHjydph2ho0jJtUC6tz
TLSH
T12E756D25F5788323D0B2D0BAC5D67A9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 6ee48b01cd31ef5d260255d19b938340e7714020815c760de9c12872dbcf406e
MD5 e1b19616264270832957ee32e35acd24
SHA1 7a49411594d3d38d4096e6db48de1c2958787c43
SHA512 bdbf781e4705b8238555cc3b2398da73f477261e66c8302c2cec1d7ec812468d37f498a0acb3071475a82e400bf91fe238404c1688f95bb7a53d56c5080364ae
SSDEEP 24576:6Ab4POHcCv/l+dntuphSVDcQo0jJXyyF4DC6Rbzf:6AtHcCXl+Sph2ho0jJtUC6tz
TLSH
T199559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 d60b01985d616d780e1b37e21b5ca9df76daa913dab6d4855fa28f7985a3b11c
MD5 654bc9bcba2271becd47b8bc48ae480e
SHA1 371f3b43513f95cafd624d964fddf568110a1492
SHA512 edf3eaf85b37c7b1a6e0d424927e4f9693c554403f7d3c753bfbe8bf9fafaceb12c2159c3cf82bdf7cc411bcc59eebf1bf7440eac4201db4d426e1d27663a706
SSDEEP 12288:+0Hf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:+0etuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T138D423594F287DD0E2B4723910A71172169C1F25B875F4F90ACA2FB50E3ABCDA232BD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 4d2776d3778afd1c9b1b1c58f4a1ed694281848c074f5980e737893254a4006a
MD5 3543fa22ea4f29a88eb4d59f78113131
SHA1 435198dfaf90c8d11a65037cf8f9d9d5f62b3c00
SHA512 30e275140d9b351f75cdf27c371492b32dba0ef96fb33540b0ab995a9541827ee28e3984144caa4c769688eec6abf1a77e9808e1369de33217530fa233b3cfc0
SSDEEP 12288:EeBNUbTVO86Uls0f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:EJIU2tuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T10D15D03BEE28FCD2C27E9D7856918200977678304F62A3CBD165831ECE236D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 9d2f59e09de6f0e278e9619e9d6e63fc92f83343bb0b4cb1f108bf7500ffcc3c
MD5 6a4349c13a88aecb3856711084c6f338
SHA1 66289bf460751ce66a7e8d8212eacf8abb34df60
SHA512 18a04279b46d96d7dd17d8a5fcf41dae7a0d1dc3d8f6efab3c2d65aa69514b44564dafec6f4c2a01829e923321742dd1b40651681c36c305a67536fb07bd4dec
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J/NRV3THX:5QvGAdlCEL8c/9RNr5CCjAtUC6tz
TLSH
T10C367D656BF880F5E0B7E138897A85B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 b1d464824fe01a3e4007245861846278dd50f3f61e297728680f589741f83f55
MD5 6ad81ddcfce5a4edd8230f77badc07b3
SHA1 785f7dbe76828ed33733583d6e81453f1933c682
SHA512 2bfa063952fc2a93fad8d7fa791663051e238faf16e4db56806c7d4ccddb9118c67cb27262f88b6679393d0c0fe88b75352d710db7e7fcbd71359036e20e68ad
SSDEEP 24576:PmewsAjFxtuphSVDcQo0jJXyyF4DC6Rbzf:+ljIph2ho0jJtUC6tz
TLSH
T12C15E031FF75E836C2BB0DB61B36D716146C6A204B6129C3E3E84EAD59342C22376E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fed68bad201f8cfd92ab75500d4e83b9560f4fa471a9fae612b15c1620fb9255
MD5 189036c97b6cb7167f8928539572f091
SHA1 20004f2bb8aa0bbaf439b3eeac391569bc01ae52
SHA512 21b0c42b388d7d641dae613900e6cfb810773afc24e390555407ceee1b244d8f28723d823751cbacd073140931cfcf120a06ce6d4e5b469ef7f979beb8c457cb
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrWdPlbuJHaMUCu:DUEtQevvqc2W1cpV2Xrm2rUx
TLSH
T10B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9de4adfb385c71581e92afb8a149e9fac8b179914886b8bcfe1ac7c2de46859b
MD5 00def2a315e233f29811d7198b99aef2
SHA1 f6f3001cb13a32668e580bb5bdd223cc3290ee15
SHA512 beae4518d3eb93b05863296ed497f63402b69f455c869bab2b8c2809079f022baa216a0fd202fba791837a7f56b08455c7c3480bef12be18d83771de4523e182
SSDEEP 49152:u5bRquA/m2yL5zMfFiV+XenmE3/z5ph2ho0jJtUC6tz:yoq1VjnmgjAtUC6tz
TLSH
T15DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5285614ab7927f1e97e7bb2ddc101671965827a242c025bd111e12262709e268
MD5 3e37af67c6e000274b5649137d477f2c
SHA1 031eda181e4be1e516814ab75800ec6eb096f4a7
SHA512 68f28a417cfa0436d54b9790731b500c9dab3adb2e6dbbdaf9c49f7c2de47e769db5b501f54b9cdea86b77313de8fe9ffb417a90f3df8a723fb740a78c61ef57
SSDEEP 24576:bAhGLvqFoiwtA5l7S53ijtuphSVDcQo0jJXyyF4DC6Rbzf:bAMGFoiq5lph2ho0jJtUC6tz
TLSH
T13745AD80EBF955D4F5B3AA7859B69171EA76BCAA5E31D20F2150C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 d8068dca96e8b0cbdb4f8ca3687ccb21bf9cf6bc248af5ace059976eed53e96b
MD5 91261b446dc531e2ffdf5bb0932e4feb
SHA1 668779d359e078384941291b24c87ba89ee0c946
SHA512 0270ff4f12348e7e8b3b663c0ee2752827af18d9c774f0967820f944a5d1bddf84ba5a1a23f99e5b4747a8ee1d52c51d3d6f6f90d0dc92db4161a459fd691432
SSDEEP 12288:Smw5HEjsChNYBFgl0WIm+C4f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbz:LwuROWxtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T18A05F1493BA42CF8E9A6923885578132F7F6BC112A31D71F07A0C76B5F373516D2AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 ec3ea26d644b7c4bd881b7a48751f167f236184bd3b94148af97442d63271b2b
MD5 2627e9afa549fafa4e5d5e69d6c0098e
SHA1 948be1a980900f88f5d202eeb621df53ba76e149
SHA512 f5e40ae22d122564ea048f5f9defb76391e0af8c4d0aae8b93203843f626b23198073f367b6922558d0661f84a6f71453c8ed745ef77e89b843ddcc415cfc791
SSDEEP 12288:HII1Ic5f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:oIu9tuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T14FE4125D2BA43CF4E1A2A23C84F2115697B83826773293DF069507B51F33BC91E36B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 56e49a5f7d9b817a230bdfcae35ab4a61312299f8208d77d261d4f303e2b392d
MD5 4da5d0e72368e625a57f00b2fa4bf456
SHA1 e715e3e51ba08124a5e23e5a75e3ef5eeeb82581
SHA512 0e836d463f98a395d24822d5a0892a8dd732f3a087935bfcb3cd4f504739661a7974b6e63a4a7e3d15763e0e58d81940c5c2b4e222707c69a6f09951a7bb3c4e
SSDEEP 98304:EQRQyi36YOcP8Lvw2gAf+PN3tjAtUC6tz:LQyiKa+X+PNhMUCu
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 64b027b4eabbf25ac783524193b9afef9416af19fda454b3137bffba98358df1
MD5 143c86278a57eeb832c3c0efea47bfe8
SHA1 61552150bd81636691566bb09cdba2d10e174aab
SHA512 1fcc50c9f66febac019fc13d21e07818e4a0b0448a1b7ba482a320e2f1abe987232c2b4b9ff038ceaaca05b4f36ad17663b67131b106d7670071734525da60fa
SSDEEP 98304:EQRQyi36YOcP8Lvw2gAf+PN32jAtUC6tz:LQyiKa+X+PNkMUCu
TLSH
T1B1667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e60a77203a7cb5b2b454c318da8ca77d6a330d31d537216140b9f1f4133dbeb2
MD5 7e70b35ea8690558079612a506961bd9
SHA1 9bf72c41b734ad060dad081bc4a5f8a0649e9a42
SHA512 5c79c5f9e5ea8bf3732cfae9a43a4cfd09392e383eae8a8968dcd34ac45c0772da6fd72414a84e1dca6131cf88e61b273703e9ed8a21ddcaf061d3cb6aedb96e
SSDEEP 49152:d68Qg55nhMeWu7PNU3/tph2ho0jJtUC6tz:bthbRc/tjAtUC6tz
TLSH
T15FB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8541721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e13d09191dae86742e36521e263d4b5b91e28a88d620c7489db6a93d3fa894c2
MD5 0c14eb46aae9d323be65e4f4bef1577a
SHA1 bfbc38dc8eab4edd1981c12a9ae279a0b309ebd1
SHA512 bb406e9f1b4d89b5d852d25b44a60cc8a721f95000ca7ac24c4d1c91667d741316fbdcbf94cd2fb4f8543ed37fbe5320bfb643659d3d6c1469e06b84d4e1fde0
SSDEEP 98304:qy5112gYy5azzVv569nLKnhZMjAtUC6tz:TLIHAWhAMUCu
TLSH
T152168B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f6bfa16316fc3e5890818391cfc74c180d2aabdb828f8d53046fa28aa5906f64
MD5 66f8cddee7f9c6f3916ab38657b1f835
SHA1 5606fec648dc49151a254531b95cc79615a38c0b
SHA512 b9cf57865911990b1b182c5c4f8678a38cfe3435eb9741d6f0f6ab8a63df29ee7535392562be9c2e3d939761d2126f46a748c09880dfd050985b4ba1b85157e6
SSDEEP 49152:DB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl5ph2ho0jJtUC6tz:1u6JmTxd2d5jAtUC6tz
TLSH
T19CD59E13F6D901E8D06ED078974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f63f324628d09663ba40232bf06f75a994667498f2d0d96470a8a50147a42f2
MD5 18b68b95ababe0ccac217a93fb061e52
SHA1 d812da652bcf22c307a965fe72d47457865b43c4
SHA512 5a0f7915c0d089761dbfc82f6de0d3c7b9b1a3f0b66be97fd646fae3ed17dbdebb89f063d456580cc5c5341cd0563fccf5a0ea7ebd1b61c4da753ccaeaded6f5
SSDEEP 49152:31hpsNoJpF1A6UU44CwH7R4x6ph2ho0jJtUC6tz:3mifPbRNjAtUC6tz
TLSH
T131B5BE13F2D901E8D06DD17887569232EA61BC460B34B6DF0A90B7961F7BBE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40ab81bf91921c79c5ea95686a4b0220e9c9f63dfd2d665a035842c61ca6e9f7
MD5 f21154e3956e00c0c822caaee15e6f77
SHA1 30ed0bfd4e57ced9fcaa9c4dfa58187fd64ce14e
SHA512 aa0ebc98b0f92be0d505d2dbea1efe6a6bf8cdac50b3d44238fd8d9642ce8ffab2be09565e18150aa17301fd6d2abb9b79aeb205404048585e24742a6878878d
SSDEEP 49152:NSuZQIY0Be2K6RVtOnks6NMHqpph2ho0jJtUC6tz:D5dKoi61pjAtUC6tz
TLSH
T12EC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90f179832e43ea413fbd1e5665cc59d88ef43d5b62dcf5c147b9aad97a7f09b2
MD5 5dac28a2e728636be54fd69f13e9125c
SHA1 7ae5ff0b18e7e578a32a479ff64eee75e1760244
SHA512 bfdd32dac708ca170672d446e534a71d265279846ecc29f02ea765807679b67d5ed650ccdfc064306c3513a11da5df3c70d33ea035f8462c805a2560bd805296
SSDEEP 49152:dhtSn8EApI0figTgiDn0AP5wIph2ho0jJtUC6tz:MX2iyph7jAtUC6tz
TLSH
T163A5BE13F2D900E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 4a9d2658050d7c2bca80a44c10756fd11d07858d55910611aa66514226acf050
MD5 ef058e263b479dbbae334005ddd7f70a
SHA1 67e578636aa26bab41415b3a101ae818e4740e88
SHA512 b96fe3f5042e4e4c99410855fb3324fe76beeb43b2fce02cb59d3948cc5203aba7c1f814b231c0402275a860592ef3c96be3ca3adc1e36421d5417566e12f87c
SSDEEP 12288:S8f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:SVtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T17AD4235D4F6A7DE4E160B23910A71176169C1F2AB476F0F91BCA0A710E77B8D2232FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 13626abc2162401bf2da08042c4a164f4f111f449aa05ca53e9c9a2510c50c91
MD5 046efa596787b2e32d81a5c69de4292a
SHA1 8bcd962f0ff7cf57c0e5158355189d618a2112ab
SHA512 b3c30e9010d0bc34c2c1b98fc6e71b6409420f0836b43ecc082e8046d17e7dd9e14c894ab3b5a3776ab91a7943b56b0baba80e9a26deebd17c86faa7c20e54df
SSDEEP 12288:cyf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:crtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1B5D423595F6A7DD0E160B23910A711B6068C1F2AF476F1F91BCA0A711F76B8D2232FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 938853337dcaf3abde8d982bedebe942e53117937efdb1cacc71792331dcde73
MD5 296c57e3786c68472cbb02344f463270
SHA1 87b0ea6d8f4ff8c4c3e8043168d7c4b2e82c2b3c
SHA512 64c4a75e020df38cde3378ab17cb031d308b2d6a833e243046238bc3e8d2a7cbd574ccb4b5162e39196725216f20103e7a6dd3325e1e990c789efc4c702f403b
SSDEEP 12288:2yf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:2rtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T141D4235D4F6A7DD0D164B23A116711B6069C1B2AF872F1F91BCE0A750E3AB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 9703f76f22667c9fe2e78703a0f7a529885ace4b310ea1d634d6881abb66cb5d
MD5 183b25e4b636448a76297c2b17f0bdb0
SHA1 580ba9dc5e74941d0da51bd7d1e0cb8695bc28d4
SHA512 fbfb477ed506c86e08a798b79970b578f5edd602cbe2c8fe83a9418341efce2260f3e4b87453cc62d3245c9aa10d4f7385d23cee0aa8a6dc999edc07edc15950
SSDEEP 12288:ClUf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:gtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1CCD423595F6A7DD0D4A1F23940B3117216AC7E65F432F2AF1B860AB50E7278C2632FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 2744da48dade98ad74870c34d306c66fccc730464863d0ed7990dd3aa7af2a71
MD5 a727223dda6e3b0159eedaaf0b386399
SHA1 e68cc60a3014863c32609304e155588164aebbfe
SHA512 2a204abc0b116b32d719eed9936c24d8aae2431322db7ce6aa5f346546711e3e6c8e3d980237565e56543e86aa2b2034f3666b794d5dcc2479623147000e0738
SSDEEP 12288:ltf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:lctuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T148D4235C4F6A7DD4D164B23A016711B6169C1B2AF876F1F91BCA0A710E3BB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 b6684b4a64ec3c19f5c181bb71ece8878a3c16c369097c9ddd218f557f459cf0
MD5 bef70e2098f9e134173453573788b7f8
SHA1 00184a6d9fc3069d5df6ef7d7c12ece8a4277115
SHA512 bf4548d06f29c9311459e661da1095ca4b4bd689e87c9e047a888ac05d74a92a725c41f1a243af08152aaf27487387bc08f9da7caf839a298ae2013d003d62a8
SSDEEP 12288:umf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:uPtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1DCD4235D5F6A7DD0E164B23A10671176168C1F2AF872F1FA1BCA0A710E76B8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 a74a82abfb3f174a04312c4db244050c6d6fda3d32243a122041d96fbb3c864e
MD5 e7940104cfb50291c4ee2de84c121af6
SHA1 c8cdfcc3bf2f3c5e088327f9bc36bab37aa7f052
SHA512 fe03abf7ad440e6e96548bb1a9ef6bd6097669b005c301629dde9c170b6d20c7ff0a4ca9f8d817cc27515aeb586d90549db7de025a97d4b402068719359cf474
SSDEEP 12288:noTf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:n7tuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T115D4235C4F667DD0D164B23A11671176169C1F2AF876F1F92BCA0AB10E36B8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 06729f1942979f8e9fec664d1f4dafaf8b54333d3e0e4bc68a898eeb9fbb79b3
MD5 7e01570a0d94e561b097958c260b6ea8
SHA1 9571b50bfa65750c4901dcb348c91277c7b17d3b
SHA512 adfea5b243949b5a46e5d84e5ef961faab513123e47763049dfc25e850c5089cc40e390b832bd7f44fe570d66f498f7a8e8ad47f50be264700005b3eb3a6e1ad
SSDEEP 24576:HZMHzeqSIctuphSVDcQo0jJXyyF4DC6Rbzf:HZMHzjZph2ho0jJtUC6tz
TLSH
T17A150199B7902CF4EC67823E88664916D6B17C2A5A70C61F03E836761F333911D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 ff380e21864449dd31a48d321792cc3516ad94847c6a05cbfc3a4f064c7f7b7f
MD5 4e7e8c3957423743317201d7847b0683
SHA1 4964bac16bb815b6976f53013b333ea2b3139a60
SHA512 e9ff7e9d9321e7056f2bef4b7849344d97588ca90932da02d99bd7119c7852139d282248e498586c6950ac2eb39d3a6d179dce6dcdd101658a99d63a86718c67
SSDEEP 12288:6jf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:6KtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T163D4235D4F6A7DD0E164B23A10671176069C1F2AB872F1F91BCE0A750E3AB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 ec1e01ac1c798bece60287c77c62e95cf8b917b59e8da79145cb81bbc923344d
MD5 1ded09bbef6ad34ee30a606332575faa
SHA1 86c306f568ee0f3d7810270f62e0e66d7e80d1a2
SHA512 d06fa50ef7a7520dea7363ed8c6cb891cee256ea9ec3982784e7155903640d2ee722baa10d63dd069189035e88a3e90c548dbff135ee3f1f995a7370f732e83a
SSDEEP 12288:kOf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:kHtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T189D4235D5F6A7DD0E164B23911671176068C1F2AF472F1F92BCA0A711E3AB8D2232FE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 376a51b4fadb9d944af2e429d687abfe8d7585aea7dc9113cecfdb1519e1cf1b
MD5 35d7330f52346a911465d3961b945441
SHA1 34335cd1bd25a456db40c960151a32687c2e2ea8
SHA512 906d1c6e053edc907d3c3963f4cb87b9b4d9e750ec5b5f28b77aab51bbfe7f3f15a928e2c6db9dff70f666a9803a3556300cd3105ef819f383de8832fa05a1ee
SSDEEP 12288:OLPz5L8rf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:yzyituphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1ADF4120B7BA138F8D176A23988621A12B77878365730DAAF179407761F377845E3BF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 d3533206fba78a1ea22fb6db63a644ede184539ae16146ef66f60f1703bd1b1c
MD5 0299f19126711a6bb8de6a20df21fb6f
SHA1 38409a48d432174d36390d0147a336c8a1e113ac
SHA512 ca658b3177ca50b79c1d31bf8d6afbea52d7cda37fb92bb0c6464f7b331e6d46ba733d09c2a4131e6ea713bfd9f4bca2ea2acd6a24df9094013b4420ae6f9fcc
SSDEEP 12288:Gnf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:G+tuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T184D4235D5F6A7DD0E164B23A116711B6069C1F2AF472F1F91BCA0A704E3AB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 42cbea2c5e09e5bf711efdb4273141eb6fd27e89e77fc248da27f893b2198ffd
MD5 2e86d1af1c4974e710231d7ae8d4a5be
SHA1 8c315972839643218bcef418d186fdc0b2ad5911
SHA512 645976b7175340f62c4adf185b6c25a0c9054f4faa83c0786c31c3dd5cbcc801f839ca8b9812b8a98a6313a0480c1988e4facd899c5c38795585506966cda594
SSDEEP 12288:itf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:ictuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1BAD4235D4F6A7DD0E164B23A10671176069C1F6AB872F1E91BCA0A714E3BB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 d98a4d7e8ee91a6c169bedb236a393b488c43037cd274488925f6c4eb354d111
MD5 14fcfe89d673cd81853974b40cfbc9db
SHA1 5c6d65447061a9e95f94b182de29c7a79b6b1e4f
SHA512 52b889437f9efe0094d1f949857a86197d74b729d2b17e8dce6883853f44be0b831d7f237a8b8160dddbdaec4872325e8a1a328d70301d56d17f6876e3af2eef
SSDEEP 12288:/LPz5L8Jf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:rzyYtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T11AF4120B7BA538F8D176923988621522B37878365730DAAF179407761F377C45E3AFA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 f282d32a0fd8a1929d28e1bcc7b93a7e771088306b97d67c2ff52b83ab6a17af
MD5 885909442f6e9098e686009ea1a16956
SHA1 b55585a51890fff6bbc0b6393170e49ad54983df
SHA512 7d00baf3caf735f5203da607cb0742817872037c943223608240c865410288253ce98cc23cf2257b4246fc4558fd5aabeafc30d03ea242f18bf4649d54200083
SSDEEP 24576:KT/aLd3z0zVptuphSVDcQo0jJXyyF4DC6Rbzf:KTiLdjLph2ho0jJtUC6tz
TLSH
T1D01502A8B7502CF8EC67923E88664916D2B17C2A5A70C61F07E836761F333911D3EF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 eca9e9acbcd4a3ec4b95200622a03f3172989cd2dd803f8450c2047c87dddc9a
MD5 cdeecaeee8960975a2b502c3f70349cf
SHA1 b8b6f3237fc86ad1513157d0ae77b2e18b535360
SHA512 ae2cea9fcbe51c1a6f377ce7deef74fae01c16aab3458740973d393f4718e5d3578702ebd02769d52cb62a1280cc1e64ba8a266d8f0ef94d865f9fc38b17fb5b
SSDEEP 24576:Q32d0CcCy74ZWtuphSVDcQo0jJXyyF4DC6Rbzf:a2d0CcCy0Lph2ho0jJtUC6tz
TLSH
T1F935D090F7E424E4F0B7DA3589764511DABA7C5A1B31DA8F03A4262A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 93ce1d72a70966c81b3300e9ae1309ebc2db2f4ada212bcd192bb1a0d3c6643f
MD5 c6a934be5c5b3d6faf135ecc5ccce800
SHA1 51c57821ffe9c68d48342b117e9dac07bcad88dd
SHA512 37b8632b74e9eb51b17e3097edf3300c90e73350e20a5ce0562c34b732d85b9e64ae21b5b4a22800538aac4c727c3c607a3ccfba910918c44eceaee868eac050
SSDEEP 12288:U5f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:UotuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1ADD4235D4F6A7DD0E164B23A10671176169C1B6AF872F1F91BCA0A710E3BB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 74f8fab0bc05aa96e8909a30b4d872d15041afcec42b8a04ac102cb6e89a6952
MD5 7c7370e588725799b0a19ea26138443f
SHA1 0bb68c01066e33df06214efc8acafc00b27e32e9
SHA512 9613daaf8096491f536b072442a21dcb7a48f3171be75a13177d35c971c84f78372f1fb704efe4e349e0ba2f074de3b1e9994c50ed947ad0b8f46acce14817c8
SSDEEP 12288:Mtf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:MctuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T133D4235D4F6A7DE0E164B23910A71172169C1F2AF476F1F91BCA0A710E7AB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 c5332d2d05b7fe2ac4f07683759759858c422a1eae530eea71826d5c2bc402fb
MD5 da998eb9f6931f464c59d3fd1247116e
SHA1 2389ffda4fae5364ae2de93ee52f9f216b23c18a
SHA512 3e03b1b51af37c48142dfc3b605ad4265be0332f4bbc69a9bcd6ab8712ef004cb1320ae3534e493254c1831b1faf5464fb7f8f40bc977caf4714d8d49a00cdf0
SSDEEP 12288:/3f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:/utuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T112D4235D5F6A7DD0E164B23A10671176068C1F6AF876F1F91BCA0A710E3AB8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 a7101208c4762417720109ca8cd1ee2ffcca3ba2c0a91ff2185ec2a63e60cbdd
MD5 9317246317b3addc8fd4f09a15e96dc8
SHA1 8dc417a7606c90dba6e6b06dff772b2b02a024c1
SHA512 db93d1c9984ca898fe1bead9bda8a5e650064cca320397c4a0632583cfabe2c8e69b8822ef13ce48c6bbf35957e7ffb7595431f5fac8dfb4cdb50aa87e603be5
SSDEEP 12288:gQf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:gZtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T11ED4235D4F6A7DD4E164B23910671176068C1F6AB872F1F92BCE0A700E36B8D2232FD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 3a56208475ccdf0fa2037d56de6214ff316754895fe9a168d32a0a45ac489513
MD5 771b126085987775a53395204da8dc00
SHA1 3834df5a6cbf5f7f1e960cb377e152b3ba9c47d8
SHA512 61b1fe800265a14bbad0a27ccba6ab0ba13e72c3cb7fd20e350ef708e8302c371cefd4d8667f8cd6bad9d453db9e7855792f97a178e0ba5cabb739c7aa161923
SSDEEP 12288:hTsf+f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:oXtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T12AF40119C7982AE8C06E6239C7560651B36B3D2596F1E3CB17C0F93E0F366845DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 fb88c07bfc1633abdd44b51cba5a155b69baa94da820c86097d5ca93b9b9df23
MD5 afd21c9b1ca6e45c59be2a811cf53727
SHA1 805419f180dcbf5f4436b92ba2738ba0d87e593f
SHA512 16d87bdb40a4e6c04a5b3e0368f4e5e384f6266b4f633447f586699a8a4c6d1de93bf6bf58e49b4e8f77435643309b7147f80e7eb2323d88db2053176c021574
SSDEEP 12288:Kx7Yjf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:2YKtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T13AD423294F697DD0E1B4B334106B1131164C6F35BD31E0EB6A8A0BB51E36BCD6A32F95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9bbd6110ba1eb9700e1ea429a99f91e945599fe1998e18a2d98942be1ad00be3
MD5 f29f3a095781301b62d8685424508621
SHA1 ef313b06a648a96ba29e93915057cd76bf04d01d
SHA512 35e6259aa728198444b013357fd0346fd2b3d24135353ad34d7a09422d91e75680978c2368b993de5a7d1ecf9f3de9749cc775d9de64a32591f30a74a2e61fd6
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYH0MV4YKYkG5tL53izQ0kNc:kgb4mBIBhGFi0fYN4k
TLSH
T1AE65AE1E32EC02F5E0F9E2B89DAA4417D6B278160732D2DF1151426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 16f24d68f5a360f3e403d371afb54a0ee75d2a9e98ce98afa49847061321bd08
MD5 f0da69391fa611e7ede03333bf2a4b1a
SHA1 b374e7b181b56a8ad0a52d6d884609e6f3fa39f5
SHA512 ad7d6308ff998595ea81a3f3792cbc14dd2b0fe615edbeda78a3a88da488eca0157bded0255bfe07895d515675ea6b464e9603e7957968bbc299a3c96552845e
SSDEEP 12288:9yGCf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:0GbtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1B3E4122D2FAA3CD4C575E3390476117239AC3A60A734B1FF0AD59A754F36BC82236E94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 775aef9a514f3362568f85718f52438058011456935c807908a837f892575426
MD5 a9cc57f709704c538dff8ed528847a54
SHA1 d1ddc78376e0b1c79207289afff05c648d7422ea
SHA512 a60dc46e84c99a16ddf6e12c56d5a7679947219b548a505f352aba92c06b1f539b69dfa6a3a10afa2743de0930a9c7610d9180cc4e72111ba7bd6ca905ec3bfd
SSDEEP 12288:BKf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:BTtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T173D423594F697DD0E1A0B23910631172164C1B25BB72F1FB2ACA1AB10E7BBCD2632FD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 16d21231c0edded5fef9b252071630728f0cf81503d81e49cabd510139551b34
MD5 e3268b16ca56d8c47de692a80bf385f4
SHA1 26cfd5a5bfe85149568e1e9f05e202813c49dff1
SHA512 9a3d8ee9e0919419fcc83bf83a22602f94622cad90806d3532940c00fc519b96584e120ba07b6641842598ba8d978ac38c111f352370a7905694a7d5a29465ce
SSDEEP 24576:bWC8f8FpJqH1Mzria7/mntuphSVDcQo0jJXyyF4DC6Rbzf:Sx0FPqVra7/9ph2ho0jJtUC6tz
TLSH
T11235F1656BE115F0D47BE13889824663F6B1B8251374EBDF07A88B611F33AD50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 ae54c2126edf5a060acde43bcb5f2a52fb333c43358b05b72c50bade326d7764
MD5 bf0b08bc0bb3cfed51e3008e363df912
SHA1 26a33e978fd3d0e1c28620353a44d92f40c82b5b
SHA512 403dbe7971676357e2f2da96336d2d7a6bbf6f989a0dd3bf522006cb9fa32b49d9a7ce66c6a59678f7a1835b5a8756b4761f5a6cf5b9a5826bb7a2e629dcc079
SSDEEP 24576:PPUr+NQZtuphSVDcQo0jJXyyF4DC6Rbzf:PJQ6ph2ho0jJtUC6tz
TLSH
T1F405E12E27AD2CE4E676E13D85824619E77174621722E2DF02D1817E4F37ED8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 22581960312068d45eb6948b9779ed7e348cf570b2d9500d50a8480662c72afa
MD5 5dfac741863a0bb508d620fb18809858
SHA1 3525ca23a8e17610533f769e5edd32c4b7a3e93d
SHA512 81bf9fd3d05c8c78ee3ae3ad3e40097c08567643634971a40063df97319aa9adab2b11344157dd13f9a0ef625196075b31f381a1b9446f564e4e250b02945cbe
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/ph2ho0jJtUC6tz:8G05lO43b8jAtUC6tz
TLSH
T16BD5CF6E62EC11F8D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1b221f48062951044361404c6947720e49dbe9553881888d85849b024f5fee37
MD5 8d9a8ba1481d77aef6507c99f0031b05
SHA1 732245f5a31d9f3b8c63886c182d5c24aa068806
SHA512 79367f69ecdf2291a60c1a8fa7eda6771fa02acba096eccc4ac192120574ac442f705560a0157dc33223fad07484d7630396064466bd91a6c2791c1417984ef2
SSDEEP 24576:isa5POZ3dpbWVM50JicR2hG0lasx2+47eidnX0MV4YKYkG5tL53izQ0kNc:Ba5POZ3wJt2pasx2+mh0fYN4k
TLSH
T13465BF5EA6FC01D5D5B9D17DC583861AE5B1342213329BCF122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ad0784134101ed6aa980884faa117e843e79160a6bbc91b756ed95ef12a0464a
MD5 13ab665437b10aa06d66f9bfb698b862
SHA1 97dd2d59e1dbd52ed6e2e24f71e857347d001d15
SHA512 a2f3ad0c849522e83fa207ca031c21e3d8c808038eb12c902c4849fc89acb53e89860485af472b5f3254a762af929730cd6c61ec77d00cefd85e8a290f099abe
SSDEEP 24576:ONcwHdjbyQ4nLC18lb/EOjowL7FkftuphSVDcQo0jJXyyF4DC6Rbzf:ONc/zEOVHFpph2ho0jJtUC6tz
TLSH
T1CA858C1623E901E4F1BBE1BE89779546FAB17865533086CF0291851B1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 d8fe77e190cdf9d657704bc8980b3733dff35a72fd3194d8138d7d000acb4f60
MD5 ce43c50254d3389339cd4895bb06059d
SHA1 50274b31b004b1522a068ea04a6cb7b431de467c
SHA512 c846d47edbe727d8b8c4595fe51e082a3e6efd47f4205fdb1649acfc93a5cb54b2ed85693822591823fc4dc5966cf7b69e98782e46c59ba728c628bb9ba5b39f
SSDEEP 24576:cJnJPbzB4SgtuphSVDcQo0jJXyyF4DC6Rbzf:cJnJv6STph2ho0jJtUC6tz
TLSH
T1D215D03DD2A824E8D4B7D274415A166ABF31387D2F2269C719B4D5343F22FD0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6b1feba501e20aae2d62c1b464d4de421a00d88d0cd62f106e141aca1eb944b7
MD5 4949dd021877adc956983de6dc9d9e16
SHA1 638e49da11f41dfae8a958aa9144c93e4c301838
SHA512 5b4442743232007eab460d84a22d79804070da0bdc4e762848e94e036320c9975eed6394c9f14bb13bcbed5e16858850268d6cb463806d9d032bd796696d959d
SSDEEP 24576:yCLHGL0MoeVtFumTijCmlKQWDkgf0MV4YKYkG5tL53izQ0kNc:yCLHGeeV5ijCmlDWDk40fYN4k
TLSH
T1FBA56B05B7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 4e02e8ef8fc98aaa09839b4f0377703cf3bfc4bbe1b6fc4e06ec4ef8d8f0349a
MD5 ec58921334505709a04d48579342fa55
SHA1 3791900d3014ebf0c2564960fda089a1fdb14d14
SHA512 7b963fc2c1c8fe6d6adc5fede36b88a6ebb0982596957a208131a2f86fbcdeea099ef4869c7707f5ba1ac711b9d45d22677e16f37d1d038db8e397d73e0bdcdd
SSDEEP 12288:h1Hck6j5ZI7Hvf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:56DIjWtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T135F4F15C277A24F5D067E03E81930122D2B5B571973266EF0BD885B94EB3ECCB939E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 139c842bd0f65bc619a321b2f6c0c1caba9ba299f07428b99c915d6562202e5c
MD5 48d0276aa78bbac408a9c758c7b0b0dd
SHA1 67ee76e84d143ac477d4af1ec2275eac885b73fc
SHA512 bc4f56d2e2ba644445eae103bc2aa58c24c7a46baa1e9f5e2c798cfdad8c465043bda649ed81252da0f99475084981080fe8003905c94e382f382c4ec016365e
SSDEEP 12288:RG6ky4f2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:YtyxtuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T114F412085BA87CD4E6B96238457301B11A7C7D20AB31A2EF16D1AB3E1F37BC86931F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 70ac2484ed97bb95672f86ac44e53e7d7cfcc35b8162593b272dd528be7ddb41
MD5 99afe57be1f02e952d506e224fd0341f
SHA1 28eb8fd11ccd332257610faddc759fbb13b19c2e
SHA512 824beec73c0ebe7e1df1633dffc9b0cd02c7d28f9ff2661f43c49fd8ce73b59a2df29de782ba053c69b7843d746406b6f8c94dfa4fe1358611250a39544ee5de
SSDEEP 12288:Tqzf2tuzFF/7vqP9DcQP631Ah5x3ZXy5wF4R5N4YtRbzf:u6tuphSVDcQo0jJXyyF4DC6Rbzf
TLSH
T1BED4225C5F697DD0D560B23900671272125C3A35BB72A0FF2ACA4AB54F3ABCD2632F90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 3049738e0a9572cafa61dea9d060be69d7139303d89f7265156ae5fe8deaf4aa
MD5 869259dc8209863a467cd42f4f8b3760
SHA1 a2367ab3b352f1de0dd2b1cd7bf87de320473a0e
SHA512 a03aa856ba18fefe13fb5f495e2c55f8dcba6798dee9c8c220559204b7f184982a8b24d6652ef4014cfd19a1d4185ca485062ccb1bad442dcc72e93fb259f58e
SSDEEP 24576:zXg5DoTfaidZi0MV4YKYkG5tL53izQ0kNc:rgSTrZi0fYN4k
TLSH
T16C558C1D77EA05DAE2B2D679D8225493D633B4311772C6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 b9b1105a6ed7a82a9089db55613cb9cf0b1c5993e31ea4afdd76008bdc62ef75
MD5 13e463ca38ff2ddbcdbab37a8816a17b
SHA1 e134acc668dca0f55eeca8bc33b38075eaa5e889
SHA512 b479918bbe3c4480e1ec31cff4a71602d25fda1d81f0f34817b38bc081128ab8d0dec4a30e73c8d169ea4e186d90ab7719cd22bb4c9af86b6d334475882222e6
SSDEEP 12288:6pJcm8CN2y501RkV4YKK6H8raNjGHZLHXJL6xJn5KZvoGL1i1lFBabDlukN+1:6rcmRP0MV4YKYkG5tL53izQ0kNc
TLSH
T1C905014EB66E00F6E2BBD17C8842424AE6B37031275257DF02A1C77E4E676E97D34B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 3673c186dce3579e839d001f47a3e094067cf62e3006f694651ef6ba14de54d0
MD5 3a456a08594a0c5b5dae37241cdc4b4d
SHA1 e3783039adbf5cb0b790ee1e79d017de92bb1434
SHA512 f9b1461f34e35ed44cd2216ebd4b6a00747bd846c2e98956d9b75c2d4e188ed11da9f3f85cdbc0b43f9163114c3c00c4ed51b4ca35aa8a6b8526790948d55848
SSDEEP 49152:xDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3g0fYN4k:C3Upow8sBD0QN4k
TLSH
T1BFA58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1392-248-0x000001DFDB610000-0x000001DFDB676000-memory.dmp

Download

memory/1392-247-0x00007FF7AEB20000-0x00007FF7AEC39000-memory.dmp

Download

memory/1392-331-0x00007FF7AEB20000-0x00007FF7AEC39000-memory.dmp

Download

memory/1392-249-0x000001DFDB610000-0x000001DFDB676000-memory.dmp

Download

memory/1532-322-0x00007FF768F10000-0x00007FF768FD8000-memory.dmp

Download

memory/1532-244-0x00007FF768F10000-0x00007FF768FD8000-memory.dmp

Download

memory/1532-254-0x000001A1E8540000-0x000001A1E85A6000-memory.dmp

Download

memory/1532-253-0x000001A1E8540000-0x000001A1E85A6000-memory.dmp

Download

memory/1588-40-0x000001A7F02D0000-0x000001A7F0336000-memory.dmp

Download

memory/1588-39-0x000001A7F02D0000-0x000001A7F0336000-memory.dmp

Download

memory/1588-38-0x000001A7F02D0000-0x000001A7F0336000-memory.dmp

Download

memory/1588-37-0x000001A7F00E0000-0x000001A7F0200000-memory.dmp

Download

memory/1852-388-0x00007FF766030000-0x00007FF7660E3000-memory.dmp

Download

memory/1852-313-0x00007FF766030000-0x00007FF7660E3000-memory.dmp

Download

memory/1852-315-0x000001A256560000-0x000001A2565C6000-memory.dmp

Download

memory/1852-314-0x000001A256560000-0x000001A2565C6000-memory.dmp

Download

memory/1960-341-0x00007FF636F80000-0x00007FF6372A1000-memory.dmp

Download

memory/1960-342-0x00000172B2A70000-0x00000172B2AD6000-memory.dmp

Download

memory/1960-343-0x00000172B2A70000-0x00000172B2AD6000-memory.dmp

Download

memory/1960-347-0x00000172B2A70000-0x00000172B2AD6000-memory.dmp

Download

memory/1960-349-0x00007FF636F80000-0x00007FF6372A1000-memory.dmp

Download

memory/2176-361-0x000002115F7B0000-0x000002115F816000-memory.dmp

Download

memory/2176-448-0x00007FF63E280000-0x00007FF63E751000-memory.dmp

Download

memory/2176-367-0x00007FF63E280000-0x00007FF63E751000-memory.dmp

Download

memory/2176-363-0x000002115F7B0000-0x000002115F816000-memory.dmp

Download

memory/2652-30-0x0000023B01240000-0x0000023B012A6000-memory.dmp

Download

memory/2652-29-0x0000023B01240000-0x0000023B012A6000-memory.dmp

Download

memory/2652-28-0x0000023B01310000-0x0000023B01430000-memory.dmp

Download

memory/2652-31-0x0000023B01240000-0x0000023B012A6000-memory.dmp

Download

memory/2788-371-0x000001EB287E0000-0x000001EB28846000-memory.dmp

Download

memory/2788-449-0x00007FF74DBD0000-0x00007FF74E0D7000-memory.dmp

Download

memory/2788-376-0x00007FF74DBD0000-0x00007FF74E0D7000-memory.dmp

Download

memory/2788-372-0x000001EB287E0000-0x000001EB28846000-memory.dmp

Download

memory/2820-285-0x0000020A45D70000-0x0000020A45DD6000-memory.dmp

Download

memory/2820-286-0x0000020A45D70000-0x0000020A45DD6000-memory.dmp

Download

memory/2820-291-0x00007FF7E6610000-0x00007FF7E6D53000-memory.dmp

Download

memory/2820-362-0x00007FF7E6610000-0x00007FF7E6D53000-memory.dmp

Download

memory/3564-332-0x00007FF733220000-0x00007FF7333B4000-memory.dmp

Download

memory/3564-334-0x0000024B14DB0000-0x0000024B14E16000-memory.dmp

Download

memory/3564-442-0x00007FF733220000-0x00007FF7333B4000-memory.dmp

Download

memory/3564-333-0x0000024B14DB0000-0x0000024B14E16000-memory.dmp

Download

memory/4104-394-0x000001626C420000-0x000001626C486000-memory.dmp

Download

memory/4104-392-0x00007FF651960000-0x00007FF651C9F000-memory.dmp

Download

memory/4104-393-0x000001626C420000-0x000001626C486000-memory.dmp

Download

memory/4320-352-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4320-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4320-279-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4320-274-0x0000000000810000-0x0000000000879000-memory.dmp

Download

memory/4332-382-0x0000023B7C770000-0x0000023B7C7D6000-memory.dmp

Download

memory/4332-450-0x00007FF7CA840000-0x00007FF7CA96F000-memory.dmp

Download

memory/4332-383-0x0000023B7C770000-0x0000023B7C7D6000-memory.dmp

Download

memory/4332-381-0x00007FF7CA840000-0x00007FF7CA96F000-memory.dmp

Download

memory/4376-18-0x000001F3DC5A0000-0x000001F3DC606000-memory.dmp

Download

memory/4376-16-0x000001F3DC5A0000-0x000001F3DC606000-memory.dmp

Download

memory/4376-15-0x00007FF7F0FE0000-0x00007FF7F1102000-memory.dmp

Download

memory/4376-17-0x000001F3DC5A0000-0x000001F3DC606000-memory.dmp

Download

memory/4376-65-0x00007FF7F0FE0000-0x00007FF7F1102000-memory.dmp

Download

memory/4412-324-0x0000020D2D9A0000-0x0000020D2DA06000-memory.dmp

Download

memory/4412-323-0x00007FF69CD90000-0x00007FF69D033000-memory.dmp

Download

memory/4412-391-0x00007FF69CD90000-0x00007FF69D033000-memory.dmp

Download

memory/4412-325-0x0000020D2D9A0000-0x0000020D2DA06000-memory.dmp

Download

memory/4784-312-0x00007FF768F10000-0x00007FF768FD8000-memory.dmp

Download

memory/4784-235-0x00007FF768F10000-0x00007FF768FD8000-memory.dmp

Download

memory/4784-236-0x0000019EF7860000-0x0000019EF78C6000-memory.dmp

Download

memory/4784-237-0x0000019EF7860000-0x0000019EF78C6000-memory.dmp

Download

memory/4848-294-0x0000021733EC0000-0x0000021733F26000-memory.dmp

Download

memory/4848-370-0x00007FF7E70A0000-0x00007FF7E714D000-memory.dmp

Download

memory/4848-295-0x0000021733EC0000-0x0000021733F26000-memory.dmp

Download

memory/4848-293-0x00007FF7E70A0000-0x00007FF7E714D000-memory.dmp

Download

memory/5056-1-0x00000000032B0000-0x0000000003319000-memory.dmp

Download

memory/5056-0-0x0000000003380000-0x000000000348E000-memory.dmp

Download

memory/5056-7-0x00000000032B0000-0x0000000003319000-memory.dmp

Download

memory/5056-6-0x00000000032B0000-0x0000000003319000-memory.dmp

Download

memory/5100-303-0x00007FF6E6110000-0x00007FF6E6526000-memory.dmp

Download

memory/5100-304-0x0000027544C40000-0x0000027544CA6000-memory.dmp

Download

memory/5100-302-0x0000027544C40000-0x0000027544CA6000-memory.dmp

Download

memory/5100-446-0x00007FF6E6110000-0x00007FF6E6526000-memory.dmp

Download

memory/5100-444-0x0000027544C40000-0x0000027544CA6000-memory.dmp

Download

memory/5100-380-0x00007FF6E6110000-0x00007FF6E6526000-memory.dmp

Download

memory/5540-340-0x00007FF787320000-0x00007FF787469000-memory.dmp

Download

memory/5540-264-0x00007FF787320000-0x00007FF787469000-memory.dmp

Download

memory/5540-266-0x000002A605ED0000-0x000002A605F36000-memory.dmp

Download

memory/5540-267-0x000002A605ED0000-0x000002A605F36000-memory.dmp

Download

memory/5612-53-0x000001D3B5D60000-0x000001D3B5DC6000-memory.dmp

Download

memory/5612-47-0x000001D3B5D60000-0x000001D3B5DC6000-memory.dmp

Download

memory/5612-55-0x00007FF626DB0000-0x00007FF626F18000-memory.dmp

Download

memory/5612-46-0x00007FF626DB0000-0x00007FF626F18000-memory.dmp

Download

memory/5612-48-0x000001D3B5D60000-0x000001D3B5DC6000-memory.dmp

Download

memory/6032-59-0x00000134A18E0000-0x00000134A1946000-memory.dmp

Download

memory/6032-60-0x00000134A18E0000-0x00000134A1946000-memory.dmp

Download

memory/6032-58-0x00000134A16F0000-0x00000134A1810000-memory.dmp

Download

memory/6036-353-0x00007FF6B8D90000-0x00007FF6B901B000-memory.dmp

Download

memory/6036-354-0x000001D0F7C00000-0x000001D0F7C66000-memory.dmp

Download

memory/6036-355-0x000001D0F7C00000-0x000001D0F7C66000-memory.dmp

Download

memory/6036-447-0x00007FF6B8D90000-0x00007FF6B901B000-memory.dmp

Download