f758ac3605bfc011919077f7ffbb885aa9d71badda026aafcc5fba58c1f70cca

Analysis

max time kernel
140s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260809-mba97ayzet
SHA256 f758ac3605bfc011919077f7ffbb885aa9d71badda026aafcc5fba58c1f70cca
MD5 395268ab9b4038bb8f1c81ccddf3161e
SHA1 dad85523496a4a4afca058b68b621795acab0057
SHA512 1defac29fb8e0df9a95d864cc2ea7fadf600faff1f844c33b1ed4c95f98d0853fb5d9f5cbdf6776445229e436209b977cb0938733783b8ffa13ca49c9792547b
SSDEEP 24576:8iT0AYy/E9Wx/tEX6PoC0jIMu0H2fpY18e5Px1aYZ3/j:8i0AYZWxyXGohjIMZ2RM8e5ba+
TLSH
T17075BE0AB26118EEC2A9C074CE16D531A761BC5D0BF259FB3581F2D92D36AD07F3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5708	alg.exe
1260	elevation_service.exe
2136	elevation_service.exe
1372	maintenanceservice.exe
5404	OSE.EXE
5888	GameInputSvc.exe
1124	GameInputSvc.exe
2956	msdtc.exe
4268	PerceptionSimulationService.exe
2388	perfhost.exe
4664	ReFsDedupSvc.exe
3924	locator.exe
4796	SensorDataService.exe
1596	snmptrap.exe
4656	ssh-agent.exe
2672	TieringEngineService.exe
952	AgentService.exe
2360	vds.exe
904	vssvc.exe
2708	wbengine.exe
1812	WmiApSrv.exe
252	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8da47b48763f1d8f.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1124	GameInputSvc.exe
1124	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4664	2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	5708	alg.exe
Token: SeDebugPrivilege	5708	alg.exe
Token: SeTakeOwnershipPrivilege	1260	elevation_service.exe
Token: SeTcbPrivilege	5888	GameInputSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4664	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2672	TieringEngineService.exe
Token: SeManageVolumePrivilege	2672	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	952	AgentService.exe
Token: SeBackupPrivilege	904	vssvc.exe
Token: SeRestorePrivilege	904	vssvc.exe
Token: SeAuditPrivilege	904	vssvc.exe
Token: SeBackupPrivilege	2708	wbengine.exe
Token: SeRestorePrivilege	2708	wbengine.exe
Token: SeSecurityPrivilege	2708	wbengine.exe
Token: 33	252	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	252	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	252	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 1124	5888	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_395268ab9b4038bb8f1c81ccddf3161e_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2136

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4268

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4796

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1812

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bb20262af281f445d1cd0f9d18b65af3851c3571da0fe36d85f3f71f4bfc4f1d
MD5 3fd1e8d20f6bb7c77e90f957f57a1f29
SHA1 6dfa8aa236276c45ebf68b5efcb93bfdeead5eaf
SHA512 0ffa50819ea099ff8319113db2866d865d6c7fa045b8e14da75918ff7b242a57614a6e50aa8fef80b578d8910ee4cd0c87abe3d201440485e78bbaaeda824389
SSDEEP 49152:Yb+672BuPkFKRrdE6oh7stBhuXjfS4LWxnr2RM8e5ba+:y7q6gjBxUp
TLSH
T1F2D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 f989e95d5cbd7952bcbffa19302a71124dbeae869043b8531f8f5f0ff3dc1477
MD5 7d4337072fe312d54efac1b04015c838
SHA1 a7e953eaff2c34113faae5de41c2c65adcec3c94
SHA512 5c3bd8005c10037441f2ffbd02acb7560a65fe3716c6e6bdf8081da31a60ba63624521aa7fbe8fce348b881af6546e8c7971c35b34008bf3b43806d03e17f56a
SSDEEP 12288:H1XLs/Ughx2LrRMqczAOkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:VXYcU+czAOH2fpY18e5Px1aYZ3/j
TLSH
T1E905012C73A009FDEC67813CC8B2D511E67378958760E78B03E4996A1F636989E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 71b9a3091cef28038fd64166d5a9f4b4777a793b6f00abc81e65a2c9508fdd89
MD5 219dd712e750e0bb87ff421297289208
SHA1 95be8d56018a13ac968e0c97b4d411a1f31eeb8f
SHA512 8ad60f45e529d5e6e3440ea47f41074e45c901366f3d79a7020e9e930814830cabb359002ca0219bd7adab9671af4eec82b3aab1fc866a4a4cae3897879bf5dd
SSDEEP 24576:t0Deb1y0K/xOrMIH2fpY18e5Px1aYZ3/j:t51y0AoZ2RM8e5ba+
TLSH
T10045AE16F6748335D073C0B9C5D2A69AE972308657308ACB4286D77C3E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f9d3a73f0ab2368d0256838d8c19e16873f74bf62c93c8dc9eb0ef619271112a
MD5 ec46638f8333ed489ee76a18ce088476
SHA1 d605aff6d8c19b6b97d0399fe1fe84ee0710e4e2
SHA512 284cf39c0ce4ea353ad8be6fa4c756f06f9db66cff71dd7961d85edf4715aad6798a58374a6f2c5706c9f45467521cd1ef12ad29954a2f6fae84e7d0bd95d985
SSDEEP 24576:Ryo/ezSC6vUyD/aqgrvW/6q8wyuRH2fpY18e5Px1aYZ3/j:L/ezSC6vUzPvuHjyS2RM8e5ba+
TLSH
T1FE755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 2705994adcbf8fd163faa81895ec5da017c0e1da6d6e9c15b96134682dc1e18d
MD5 3310c624b516888eb4c8a0d68207b561
SHA1 d32f5f59ff29996d88677d99c0b431a340a83e1d
SHA512 4c33f70e31352e4a807be88f822a8b352cea61dd0d37ea405c68e6d636019f6def6a4c75847a5002d035d33ab898b2d557d05bf1d72f0cc227283a0e4d66af2d
SSDEEP 24576:pAbBP4+Wsv/l+d9H2fpY18e5Px1aYZ3/j:pAm+WsXl+D2RM8e5ba+
TLSH
T1C555AE66F5748331D073C0BAC4D3AA9AEE7230425B318ACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 674ec98e28149bef56bdb722b7b61bb8a529fdf995e184a249c2ef3f2176d45a
MD5 9fdf095f24798294db2c825268b4bbd2
SHA1 c85b9c9f7404fe1c731c0119e3fcf1c17ab78db5
SHA512 67d23c19a132191e23bf13dff7f4e534b86247cdfcff41b3fdf16443a1430847f23e0a0fd7d6f61fdb0f6fcbc57b7fd839cab85a0f9c20be96bd6f8cb020328d
SSDEEP 12288:+C2kpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:+C2H2fpY18e5Px1aYZ3/j
TLSH
T16FD4238D3324671DE63B2D3851F7BC61A1C93BF9E6050E8973C62A9A0DF5C18D97B424
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 66f18bb63621f05fb764133de7d40da5e150308390f181b45a62fe093df44c31
MD5 d492b05309ccbbc7e0e878a16022bbe6
SHA1 b34e1ea6b40f42103c40c8b664320752ebe8aead
SHA512 3f5893bd29311da4d156bd291fc5b1a7866bf11be1e9104c87ca11a458510863e20ed00c2f28a8a0f27b698ba45b71656964de82698a829b527a39691c4569a3
SSDEEP 12288:+CBNUbTVO86UqkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:+tIUqH2fpY18e5Px1aYZ3/j
TLSH
T1A715DF7BAE28FCD2C27E5D785691C600E7B274708B1293CBE165830EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 7f00ac7a5da880c6c63694fdeba97928a86d0970e1aed7f0827ec1c3cfae018c
MD5 ee9586572a94444d8cc30c1eabc4a08e
SHA1 efbb47050396655ea30a13fe430d68b3bd840a7f
SHA512 91a0cc4b6d409358c178411e8570c672ce7cf517155a09ca95ebd6e8d778ee08719d56e523360ba2f47e5636bafad4c08424199110556256f68c92a9ff4d2122
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJT9DN5J8NRV3TH1:jQvGAdlCEL8c/TRNw5CwU
TLSH
T155366C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 0422e8ade52e592b6d3b59ee53f6b56a80ff575592f51b5aee392333556db1d9
MD5 0457a2090e079feb3b5f8966178967e2
SHA1 2a151365506005e00ca654e2b1561b0d0c235ab4
SHA512 3748ff375fed91a51562bbb5906474c6433dc129b62f0fa1974bf1191146e376532ae181646cc791ecd489e9c44238f3a72ccd019266910f8ab8399609f44564
SSDEEP 12288:mhwSfxL/2Dc3bDLLmt0LDQewsAjZkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/D:amewsAjZH2fpY18e5Px1aYZ3/j
TLSH
T1E515F031FA34E036C27F0DB61B36D716246C7A604B521AC3F3E84E9E49706D26776E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5c1a176445b8906ea151f4edd2b65723a94d3ef6846ad388482d745f57b2554c
MD5 f21b9c1468d14c204d1401c5c8f526eb
SHA1 d36912b3bbcc77dd913dc97fbb87ecfe308dc7c8
SHA512 12ab4f343593464cd50a46ef79d4ada92b3752d69636998609e9de4a65929ef29cd9059c7c9c1d74a475a23689634f9af808ed5d25f28b6e43b4a72c7b20a7f0
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXLldPlbuJHwd:lUEtQevvqc2W1cpV2XL32a
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0579dfd52708564ae5279d84e77db7b12e13837ca63f99aaacd7fce81810e0d
MD5 ce84e9e637902604f389554d5130ade5
SHA1 27ba9b238503f4b0d6d3f26ba24b936f05cf09e7
SHA512 f691581c66af9c2d75fafc13fec8429257c5dc15595f53c89e8248249e08b00349482132a8c3c273fee820166163872d44978d3bb4190c924419f8fb0b9346bd
SSDEEP 49152:KkbRquA/m2yL5zMUFiV+XenmE3/zM2RM8e5ba+:poq2VjnmGUp
TLSH
T1D1D58E0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d242b12d12986e6fbf72230cf6d21991fdc9d87c83694fac120832d04edb95e
MD5 910a64bbcbc4f1821961e923820eb412
SHA1 fc215f4f370b8d6b16b9e4094a421929b3806df6
SHA512 5f57ab16f9d0eef3e4942774a9dbf20b05ef9b17d095bc491fb647f733747fe0aae3935a766c048c8c6470c54b243bceb2d7222f3b79449f7890988b0d1d3a8c
SSDEEP 24576:bAhGLvrFoiwtA5l7S53OH2fpY18e5Px1aYZ3/j:bAM/Foiq5K2RM8e5ba+
TLSH
T1EA45AD80E7F955D4F5B3AA7899B69570EAB6BCAA5E31C20F2150C11F0E33E50DD24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ed3740dc61492c80d7558f4108792f112aa3d97e9e1479278753dd30495feb66
MD5 39a6fc0ad4c79c65c9452bd21e0c3c40
SHA1 e7d2bb28fc5a8993a32d491584165f5ce9071a79
SHA512 dc60bfc397e1b1627b10a9c5e3360e0eb07f4697c579be28aedf1a0676c9c2a32664635b265f3381442bd9803aed0edc3e8781f8181f54f4365edbb19c9d214c
SSDEEP 12288:Pmw5HEjsChNRBFgl0WDm+CikpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LD:uwusOWpH2fpY18e5Px1aYZ3/
TLSH
T10205F14A33A41CFDE96755388597D532F3F2B8522A21CB1F13A0C65B5F73621AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 6383ecfb884deafad8c847f9e35b0368e6d62f13756c6bb1231356895104ad05
MD5 f26ed4b2d43e80a0082dabe7b2add9aa
SHA1 adf1b44e35e24008b2fec223ad4791a93028d18d
SHA512 ca649e011262ccf39a392fa146d6adfb29a7f05b4f56659b15705012645d41de860dd2dbdbc051a303396bd030ddbc51663e24f6bdfb40284bad64ea5bc84a60
SSDEEP 12288:QhG1IIUkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:eGurH2fpY18e5Px1aYZ3/j
TLSH
T1ACE4128D33A431B9E167593C89F6A901E3A634A6A33103CF2395069A1F73ED59D3B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a5fe7f89ab5ae916f77b624b6e9edbfe384fdebab4b39a4c75e05eb17d33ebb9
MD5 5524c6dfcd3886b5e69b0e30ff2913b0
SHA1 dc1665f0258beb1a25147402522a207d77d99617
SHA512 5e7cda31956c4a4044271c91ec8591f2ba05078d2ba6eda33ecf2f77bb56eb26c25e1b01a95d7eaf1c783dd30daf8081455e455f78369f9176ed15eb58cc5563
SSDEEP 49152:oji200WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UP:dQRQyi36YOcP8Lvw2gAf+PN3KUp
TLSH
T1EB667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9f9436aa06423a5656809e5b91d023b8cf8ef9b273d61c50cee48dc440534861
MD5 c87544c5883cf05000ac9dab5edb1e78
SHA1 70b7e13c7fda18ae26b5d60d331b2a9348dda073
SHA512 d80c06f6e6a4255b4311e78ac6d56ceb394449f16d233b0846e9d3f887f43741df849d6c7d39900b3c91bcafd79c389f5882148545d45c41c39048caa4cb64ce
SSDEEP 49152:oji200WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U5:dQRQyi36YOcP8Lvw2gAf+PN3wUp
TLSH
T118667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49fbe2dc523a8f01c551bfc05d1a566ba0fbb3e1f35450df81915b62d62aec87
MD5 1fe340eda3d545b8f44788dcaacb8d51
SHA1 3728d783a0b933d8f7cafb1cda0c79373b537927
SHA512 192a7acbc854815e22d31a35858653d85bc095c7d3d8ac8e337e958e6ee0030be03d5526d47b58db4742471c100b00ed6c0cd42c2705f1b0c643797db6455505
SSDEEP 24576:Mwvuef6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0iH2fpY18e5Px1a+:368Qg55nhMeWu7PNU3/f2RM8e5ba+
TLSH
T18AB55933B2F200A9C44DE1769F4A972196D27C758FE0E3DB855172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac1214b22d2159daef03dfcd77fee7007a9e88cd9c17a914060637a6aa9796e0
MD5 1df1185190d49084018fdf34db733759
SHA1 07fa87c0e89829cb793ec704bf99bfd6f1c34983
SHA512 1c2b04cbde504a8ae4841d9fd35fbd5101b6f285796243d33baf70d1d1c67ac5a296b816408c1d2183f7964989f659d0182d4a42bbeac52a0445197b2d218da0
SSDEEP 49152:m3a7C0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99m:zy5112gYy5azzVv569nLKnhZ6Up
TLSH
T158168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7766b4de0ab296dfd6597aee574cee3d6ca416ab8129b367d1db96fd710cd25c
MD5 4933ac8895c65ce22b53c6a2ad8bee36
SHA1 e85a05209d217332b479bb76a176a4fbaf474504
SHA512 8856c35f90dd21758773eb56f55e13c85d98e67c78a53c3ca5a23ba66f38314393f8f494e79ef3593793863fb5e90f3050ca16c3655d9035408a4702e15b9083
SSDEEP 49152:kD+taZ3usBWOBr4tEGp0bqx0z+n217aau1gld2RM8e5ba+:ku6JmTxd2dgUp
TLSH
T134D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bbad1771354108b77ddce83c71a03ad8387a9b497a08b22a8b5defe2a77f163c
MD5 44f9481d6e3daf9abb01bd984621bd5f
SHA1 52a33b0e7abda7154664194a777790f9530bcc74
SHA512 f3f6a6bc49abb8b764fa087340a8f2730ef4bb7837b3dccd934d551e4830ae79d330069e80424c4a85fef5f0a5032c07f90dc4d9514dd464635de07de70c2e31
SSDEEP 49152:X1hpsNoJpF1A6UU44CwH7R4xk2RM8e5ba+:XmifPbRIUp
TLSH
T1E6B5BE13F29901E8D06ED17887569232EA62BC460B34B6DF0A9077961F7BFE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 940cca9d1491f12ca2da431b1fa586cdf34289d7e5cc974eb336285ffc1b61ee
MD5 654d5bb488e5369c64ffc630b6ce3b8d
SHA1 e13877e37bf3bce301e86cc5fc8af6c55be18b10
SHA512 17c5557534a6dbe2ac58d8ac00c830e9ea091105e87244aaf31026b96218d21bcfcfe9fd785e7a03d2391a8c1578bbbfaba560a34d842a29da955090756e5a74
SSDEEP 49152:+SuZQIY0Be2K6RVtOnks6NMHqY2RM8e5ba+:Q5dKoi61VUp
TLSH
T18DC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 118123bc5c8e7caeaf5e2f6f35d40d6b9384c6f40307115c152718473852664b
MD5 389657e317ed7aaabca4067a3005a0c9
SHA1 ca1d4b9c3e933508c565e81c38c4f8b640022c5d
SHA512 d073e4086e9d48c31b11dd96ce16701cadf64e4e71c44ba023bd378e7cd1df3e03cf4cb1a88aeaf846701e51cf7ec578eb229e9045d229d60f4af7345b60035f
SSDEEP 49152:DucSn8EApI0figTgiDn0AP5w82RM8e5ba+:aX2iyphUUp
TLSH
T1D1A5BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 975aa1b96efd9229c82607b744c5f198ddcc99284d1a107987942cc96fec4bf1
MD5 b6d97eda9f824d5c90be0e9a82ff8317
SHA1 f66a1cf4cde244644ed3cef5f0cf6d63ef9dc5f5
SHA512 4520338cfe86707cb920791d27c6350cd7d69466b35cd61b9cc1fd928cf96f65ff114b3eb2648c821415bc8564b3224ef79526799e117a35722ff7e16de36811
SSDEEP 12288:RQkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:RQH2fpY18e5Px1aYZ3/j
TLSH
T147D4238C32256B1DE5363D3841FBB951A1CD37FEF6020A8E73CA15464EF2D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 948105f7cd4491d360a307175f67bca6360936a9685a79eb1eecc5a2d12c66ea
MD5 06db3ba831d00af4fcd5159b9a58c027
SHA1 30115f0e630da9213ca40990b208750a6d0e3953
SHA512 f9f705f91db73e106ff30f40863f1f917c73582e2237f6711128ce5b0d197db4384a8e136c9de4327bfe006876edec178d6ab1f7ecdd691be6b7f6ab75e1716d
SSDEEP 12288:vstkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:v6H2fpY18e5Px1aYZ3/j
TLSH
T1B9D4239C32356B1DE53A2D3841B7BD51A1CD33FAF6020A8E73CA15464EF2D28DD6B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 fccd21c43cd8f8de40321109ca2a1626f3a3f0d69afa73c695524f2425a60406
MD5 d7256627cf9d5bfc245aa6da5f13acea
SHA1 7f4cc8f306d6fdd6393862cc209b87837aa008c6
SHA512 26b01fc7e8b23ac128e7366b392108ab0e2261ee16f6093579153051b02e76a38ca618d94b9695745a3c328f3293897bc17125c533c922ee29391ed580a4c5ee
SSDEEP 12288:VctkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:VqH2fpY18e5Px1aYZ3/j
TLSH
T1EAD4238C36356B1DE53A2D3841B7BD51A1CD33FEF6020A8E73CA15464EF2D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 59524d3a05ac59547aa236812cdaf8ace03b38d7e89d69b6ce9a2bd7f66ee77b
MD5 647159c50fd8a06b62c650743859d72c
SHA1 42441a7c739ff2c7f01b5a8b92c92803aafcf96b
SHA512 c31eb0902a9a4796691b1301d32f337bfa5e2dd44f6a980aeee1c6886d98e16a0fb0ece17e97101c554477f4faf3b471ed9979700c3e739d99616d86ffbf8a6d
SSDEEP 12288:vlGkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:gH2fpY18e5Px1aYZ3/j
TLSH
T10AD4238C3725569DE4366D3885B7B811E2E976E9F3120B8F73C1058A0EF2E18DD3B964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 611cf3410625d22b6f77ecb51dfaaecb8075a3c575f0ef261c79e0e7c22ff140
MD5 98abf11b94d3fd8b131ddab8f1a24cd0
SHA1 d99ed71a0f3af3b38f949c232da3c490b77214d9
SHA512 e5985d130c5206a64373770ee428404a88d31f659fa9267ebb59ab3e10eebae2c1ae00b60c0325214d77c7c86fc46e36abc700bc7dbee7c1447eef6e01cafb6d
SSDEEP 12288:kbekpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:kbeH2fpY18e5Px1aYZ3/j
TLSH
T1D9D4238C3225671DE53A3D3841B7B951A1CD33FFF6020A8E73CA154A0EF6D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 f2870bec3f8e414dcdb5cdac1ac7adb8fa6b8706cda8ea9f17eb13697bc30f28
MD5 22a818f07b2f44d080be399cd7238a33
SHA1 77f136757bbb0625357c39631ba529f80b7382e5
SHA512 3b8afd29f9455d04a5b1fb427239fdd4a656d503de8b809fde0a973c0d9c36ca04d332a196476fa4cd311f240a000ca0cac2edab43ea31d02d131dfa49f63057
SSDEEP 12288:HZekpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:HZeH2fpY18e5Px1aYZ3/j
TLSH
T193D4238C36256B1DE53A3D3841B7F851A1CD37FBF6020A8E73CA15464EF2D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 a16d21ef648c9c81ccfa7b9044b7c61879df6e5d06897514acfc0c61705697b1
MD5 621861aa9c80bb957adec47e447380f8
SHA1 a6ae882039b7f619b2e81ddfe48cdb40a8ec5203
SHA512 16824c2362a07b924e998a750de060a569e1aa403be3b690c49c748740cb7307a7857290b7b053fa4ff9a0a8b8cab3f2e56f4f7f19bd5cc4e008aeda7f427f1b
SSDEEP 12288:QxkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:QxH2fpY18e5Px1aYZ3/j
TLSH
T1A0D4239C32256B1DE53A2D3841B7BD51A1CD33FAF6020A8E73CA15564EF2D28D92B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 faeca0224d360a9d1433150590090b909698739d2f2c6dbfadf237b3f6f4b1a7
MD5 f3b5507d3b3492c4547cbec91a965547
SHA1 14fe919fe2f33d0df9458b258522eafff3c711dd
SHA512 56f7188ed7f79308aabe5c1e0551ac0fc7cc486b94c2b3bd8c873ca2534715d841e360f0a595b90b2db9fb036608663c0a8ed088c57250b775b4433b163818ab
SSDEEP 12288:kiZwbaCzFEoSucPvyskpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:HZMHzFVSWsH2fpY18e5Px1aYZ3/j
TLSH
T1C1150198736018F8EC67453EC9669902D2F27C6A4760CA0F13E4366B1F737615C3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 b7615a4d27d545090182656baa147d45388ef6bac3f10e9eec82dbab3e400424
MD5 5d4ebcbb55969cef948865aa4f2977da
SHA1 294ef8c9e9c0debf45e49c43a4c7885fb5f613f5
SHA512 e7e753572a907ec9bab4e6feb3fa3126b0d551312eb9e0c9ca170beb7f2a30b871742a95e004b765f28ce93ebbc706832a7c0f475e5a1bfb55969327c83fa80f
SSDEEP 12288:x4kpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:x4H2fpY18e5Px1aYZ3/j
TLSH
T105D4238C3635671DE53A2D3841B7B951A1CD33FFF2020A8E73CA154A4EF6D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 dfc81bcd1614992406d6c57323499c316fd10a76765c112bdc24c307f58642a6
MD5 74f1b03726166802c238483a2a40aa89
SHA1 b48d47446074fa23160b992ca763630a0f7a0d18
SHA512 cc7eec8c04431fa9a0c27fdd9859782b9a34d5ec2bcb9fc9e4eb83b9c2fd3c04fea9e8a823926397bd5df89fc90317a8dbf35d0fad1a992ab7bd6264ee914012
SSDEEP 12288:7ykpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:7yH2fpY18e5Px1aYZ3/j
TLSH
T14BD4238C32256B1DE5362D3841F7F951A1CD33FAF6020A8E73CA154A0EF6D29D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 2b423223b500f7303861caa9bd0adcd2a054b69137e077193fdcba0555168193
MD5 f4f9848442680773fcdf2072eb75f23d
SHA1 8db6d7be6e3ea6a11a7f7232ad1f7c6e65691e4e
SHA512 e8a757af00f2170159fa2f759d93e22d558336341a387e13d232e20e7ec8989db4d15b87e232dc4edf46fcda4c872f1eef3c7093caf3c3151190ba2b49474a5f
SSDEEP 12288:eoPz5LgGkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:lzqGH2fpY18e5Px1aYZ3/j
TLSH
T1E6F4024B336131FDD137563889A36A12F3B6747657204B9F23A4067A1F63A609E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 b0f1f3c5d7c7876d1d79d1a23b7c2cd191e3ad286c99ae0b650e039683335d79
MD5 186d6a032d5584f5cd678deb8f46dc03
SHA1 0ac6ca5cbef3fd573330e8f25d1e4d8b716186d0
SHA512 799078ef00e6ece352bc55d617595ec70496bc3a49aaed7dca0f5454fefc44a78433136d6adc573788c3b91cfa174a940d253399711321c6ab6ccf37aabc278b
SSDEEP 12288:laFkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:luH2fpY18e5Px1aYZ3/j
TLSH
T1DDD4238C32356B1DE5362D3841B7B951A1CD33FEF6020A8E73CA154A4EF6D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 3303f0efb7d04ab9919e7d4a2bc18968be32fa661ef2df8b761585a816be4009
MD5 bb16ff5756f2923479f70a510133728a
SHA1 d020804417bfddf4cbf9a240c4cf92917a665dbf
SHA512 5cf9e37a4fb0ebf6ca3b1b7338150d4ec6023ade2f9b9bc18b090c9c5400cbfc495cb75f9a3c2ee3bc9c3bc48fbeffabcffa9168c3815be8694833d5ff4dfd48
SSDEEP 12288:NnFkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:NFH2fpY18e5Px1aYZ3/j
TLSH
T189D4238C32356B1DE5362D3841B7BD51A1CD33FEF6020A8E73CA154A4EF2D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 aa964d1feded9be3d3230b4dbb886c6bd76097fa6143d0e6bc9225368aa205b0
MD5 a0dec027d70712d6f0654c9cfa35036f
SHA1 1a6dea27bcddcd7528f61efc248a17fe76add358
SHA512 88e0a74209c7faa33872e1c2e02fb0f3e00c27dbcbe6c8343dbc5b053eab3171a824d26a417dc167846f06896274ac285f14c4913746664803ddd62ca5f1393e
SSDEEP 12288:boPz5LgAkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:szqAH2fpY18e5Px1aYZ3/j
TLSH
T1C3F4024B736131FDD137563889A36A01F3B6787657204B9F23A4067A1F63AA09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 0a028059ed1ef0ef59b2ab7b86d38c793af812fa229808b031760b5dbbb7cebe
MD5 e47e375ae031977e0c04ac7ea5d07944
SHA1 a4bdfd6bca7334b8a0ef31ade8debcd37a272e0d
SHA512 2cc1f8bd9df7c69bd89cf2562ed1afa14f11c0df931a4343069663115f22b72176fcb50c2d9300d8d65f6feb7ffe18fcc6e6413c13d7b563bcb53e69c89bef93
SSDEEP 12288:MCd9VWYoaLHF3z0z04PDvhlkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LD:VTcaLl3z0zDlH2fpY18e5Px1aYZ3/
TLSH
T13F150198736018F8EC67453EC9669902D2F27C6A4760CA4F13E8366B4F737605C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 fc0f261654e53952fccf20fa172d4a7bba11d2174b4ccbca60c43b03e182061b
MD5 10f8210c8794bd02842239b003eba57f
SHA1 013da786b650c7bb41cec90483fa2b5162c0270f
SHA512 00b8698d5d374dae5703a05486e7552a69fe46318f05fecd09406b9797264831c0295e02794096b17c9148821be711d2b606b0142c437d8d69c9dae3eda9429a
SSDEEP 12288:ni4e77KdefgwCH/y7vUbbdIvOCkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mYT:n3rd4CH/y7vo4H2fpY18e5Px1aYZ3/j
TLSH
T10F35DF94F3E410E8F0B79A3589765511DAB67C9A5B31CE8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 cbc229fc9faac3f6078e39b845517d0fabbe86d233c682b835b35cf6950f76f6
MD5 9f5faceeb3acc11faf54f45ae51eb5b0
SHA1 d040948cc60cf22603d67b48254c8d0529a33bb3
SHA512 9d2886d257af790c13b2a05341d8bc7039933b92af32a439c85adeadf690961a9c205b2ba547f12a85e3e1925ffad50b79788c46532ec53cf2bc248adef772e4
SSDEEP 12288:T4pkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:T4H2fpY18e5Px1aYZ3/j
TLSH
T1ACD4238C36356B1DF53A2D3841B7B951A1CD33FEF6020A8E73CA15464EF2D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 a0b8f3e42a43f23976462c000b02704679849507e0af8b76a56e731a33ec75cf
MD5 02a8f0bc06942a485535ebf2248393ea
SHA1 3862b39959ad66655e39530be40265ff5b51cdd3
SHA512 a4867946e797c621044c209451aa761b06eb4f294918e4ca4e76b11faef8e835ba91ab07b0e9610dc3a1c8628bbd43dc41a1f009d8070fbc30147e29dc347911
SSDEEP 12288:YENkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LD:YQH2fpY18e5Px1aYZ3/
TLSH
T163D4239C36356B1DE53A2D3841F7B951A1CD33FEF6020A8E73CA15460EF6D28D86B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 771b5ab3598d42898df61a9da803a2f1c732ebb6977c2d41344962ffe66615f8
MD5 aff8549e6ca643f03abd8f8bf09af9a9
SHA1 19fd6cde144bacf50fddac0b3da48a408e3fe415
SHA512 7f2822232bc6da783074709d16d2ac84a62557dad93865193b7e27b2c4728a4038eeaabe8ab71e92b823ceffedf09a21747396fc83462b6875f0440b360074e2
SSDEEP 12288:AkbkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:AkbH2fpY18e5Px1aYZ3/j
TLSH
T1DAD4238C3625671DE53A2D3841B7F951A1CD33FEF6020A8E73CB154A0EF6D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 9f54da7db4ad828787df5bf12bf061e435c4cb8c61a7eb0d844ee037bc577d85
MD5 4853ba5e70134a0226a415e001eaa352
SHA1 fdd1f8c251ae2b7b05517b7777c27cf54fc32ccf
SHA512 3679d41d7d3001e7ae5c2c714f611e70bd6fe4c61b33f141f6389d3fae915971e8e5b1f54fa7957cc700d70bf195c899b88d2a4878fca01985938572a053a793
SSDEEP 12288:bMkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:bMH2fpY18e5Px1aYZ3/j
TLSH
T133D4239C32256B1DE53A2D3841F7B951A1CD33FFF6020A8E73CA154A0DF6D28D96B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 b9dd77d773aa655dd98a62a7cab954435999d5f884555743cace9c283fd7805f
MD5 1d7e5fccbb4adc837bae100a52823cb2
SHA1 c9e2c409875a213d17612451b835733f89f83295
SHA512 037cf1fb373f1c6ac0494666b5fa79194d72620d181dbe679eb02404c4f899a8921f619d14aa70a5d3730ee505ec566226c1621012a0c563f477e76362021240
SSDEEP 12288:QFRfEUkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:OEUH2fpY18e5Px1aYZ3/j
TLSH
T1AAF4014DE26412E8D02E6538C756AA40F3673D6593E183CB63C0F53E0F76A949DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 3e3fff3502af053d8101999bda78d0ee129f80c4b75a9b1c10c2b196153893fb
MD5 bdb6c90a59494da525fbcfd8fd504278
SHA1 faeb3f12d4d6a9840e124c52b5a2cc89a026f5c5
SHA512 9dd528f7abc02e15b51c9bbee5c7c48185ead6cc037cbc24128ac9731c7dd726d7464cdd88b9deca65204a324d82b037e50e1c2e23796d91d516879e085bafbb
SSDEEP 12288:K87uFkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:buFH2fpY18e5Px1aYZ3/j
TLSH
T18FD4239D73286B1DF43A2D3841BBF920728E33B9E70105CBB386168A5DB1D58DD7B918
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3d049a73904c73a6af3a742dc2230d958ffb43dd1084d61724d5c874e5a1d246
MD5 67fa064e687ca14c15e459a1af66c10a
SHA1 9578e9ba4bbcc2b4b7dd0ec8334557db545a0619
SHA512 0eb3a379a137428152c3bc3e19dec404fb009fa3ebd9d05bcf0c92a1e445cd76376ed5597946816cc84d5eb035524c291f0a802ffcad952f4c31be1328db90d9
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYoH2fpY18e5Px1aYZ3/j:ygb4mBIBhGFX2RM8e5ba+
TLSH
T12A65AE1E22EC02F5E0F9E2B88DAB4417D6B278161731D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 5c1240f82d6a715c73a1381b2696705b1f2701a50711b546ee2cafe1a35c2e41
MD5 58985501312f300ecc651c412c01525b
SHA1 df7deec2dca0ff7f59b06da0ddea88a55b8f64df
SHA512 019d8b69fe2c4a50e43dd24eb9cc856ad96bbb78ce36327bfbbeb240cf81c8767b95a2f719566a26e59b2487efdecc0586f7ffd15f567e774abb4ad11fc5633c
SSDEEP 12288:uvGYIkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:QGYIH2fpY18e5Px1aYZ3/j
TLSH
T112E4226C3275369CD43A9E3844B7B822B0E532B4A7000AEF12C5557A8FB5DE4EA3FC54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 322a2b10ab8598c10defdb1bfb5bf78cf8300f3f8e26d265eae0abcfaeab33bf
MD5 8b7742aeea0212b50cd78eb17b7f3df9
SHA1 8fd17e078f4820a0a565ff7818e914e3f66f3e4e
SHA512 1f4fccc1769f413656ff9ade9eac5282db4d635cc669d2eb80b7cdc8af5b3ff4e93b34542ebb9696f0bbc208ce0fa4e4a3a5b9198b20dd7244bf6025b79547e1
SSDEEP 12288:gakpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:gaH2fpY18e5Px1aYZ3/j
TLSH
T1F0D4239C3225AB1DE5362D3841B7BC2161C933B9E7020ACB73CA15874DF6DE8D97B864
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 27a5d32cfae233803a3f462c3eba74c74256f62c2eebc2f569d194f8f0bf2c2d
MD5 3b8fa512349546e5538d03222c56f683
SHA1 01e2cdd39b2e318c4d8ec1776096ed4d840201de
SHA512 7eaa195e01f4ac16193ce52beb4f565534a4199c19ae601c4d1e8f576d3c0fb645b3ba4f45797ffc529543924e0e71df979d2bf386ae57c3987af3bc96f8f042
SSDEEP 24576:RG88u8FpJqH1azria7/mTH2fpY18e5Px1aYZ3/:07ZFPqVla7/M2RM8e5ba
TLSH
T15F35F16977E102F4D47BD13889964663F2B2B4251324EFDF07A88A551F23AE54B3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d4373e5583abf134f50ff909b8aafb0a17ffdee7e6dbbff87fd63b440dacc2ea
MD5 07beb117cd3eb58691224266f535757d
SHA1 b0cdb1e0230eaa103e3b43c75e8f560232706be7
SHA512 25c71196cebc526ca8916e16cc684bab9d0fc2bdca43cfe4ce16316e7de861d4c803ae55cb796e5686e517284f7ffe99fe1ebb31c19d699bcf43014cd1957735
SSDEEP 12288:rHvUrBFrEjwaQCkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:rPUr+NQCH2fpY18e5Px1aYZ3/j
TLSH
T16E05F15F32A818E9E67AA13C85979619F3717462531292CF02D1817E4F63EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e288a86c4a1a891645a5b4e450433beac07d7da9e4ada2af7ed017d22a7390aa
MD5 aa6a69d8a5cdf4fc78d44e1536eb9656
SHA1 44a70a54101770927d5d40739c076d8c6fa6a80a
SHA512 795b7b00913f8196a571ccbee5950a02bb9d5f4dfedb52ac1ed6a1971dfff62aa24e9982c42e8c55ec89969599da6c785cb65f75cb41fe107d797bfe4da3df72
SSDEEP 49152:rBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/2RM8e5ba+:0G05lO43bnUp
TLSH
T1BCD5C06E62EC11F9D0BBD17CD9C64A0BEBB23425032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 8ec2b25a97027ca7b99a869cc2502f7fd5a2c113acde1116f3d90536e5da4a90
MD5 6a44a7f9c27f735f332b7e1377081c72
SHA1 70546f05680fe7762fbb46d470f110c1ba72f151
SHA512 3c3734506c389660b1ba62ffe060419ac63bfba1e6411912cb4a832200c31c277a9ba6402ed765727fb9280081eed91df75d319fe66f29a259102c5945ce973b
SSDEEP 24576:3za5POZ3dpbWVM50JicR2hG0lasx2+47eidnxH2fpY18e5Px1aYZ3/j:Da5POZ3wJt2pasx2+m/2RM8e5ba+
TLSH
T1D565BF5EA2F801D5D579D17CC583861AF5B1342653329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c095fce22217cc822d9a5f55aeca60c1c5b185bfd862c51b5662693e61ea32b2
MD5 bb92f99d33377c1679f2fc7048b7120d
SHA1 5fad7a86106a6862624c0708b28fdf5e08460fa3
SHA512 c6946f47b017fc34b23a0ef27ac4ab41c0a2a72bb4af4a971123d017748ddae4014da0ee284e4828915ca54178160196eb7e252e84d766a7c852f26a0a17d04d
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkQH2fpY18e5Px1aYZ3/j:MNc/zEOVHFD2RM8e5ba+
TLSH
T1C0858C1A23E901E4F1BBE1BE89779546FAB1786553308ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 dbe18ede16b70d0ab0a970d6916e8a9dfcd9c89731f1810a34b8361d396ddfe8
MD5 41b9e354dba6564ecd62acd820b4d3c3
SHA1 58ae5645edc7424174ae917c2d3a1967704a2e8a
SHA512 c877c0fc5203e4864e490c10368cb4e98e1266da238deff47fcbb2b24b3765d2cb58ed2eada689a1ee6b58b9e946ec7e2b6e5be0b14782fbe8d3079c6cb0dbae
SSDEEP 12288:dDHPJnJP6szeCs6Rl28dYkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:VJnJPbzB4SYH2fpY18e5Px1aYZ3/j
TLSH
T17015E03CD2A810E8E4B7C274815A2A55FF71347D2F2269CB19B4D5353F52EE0A93AF18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eb2e0cd5aba343eee547cb2d747a807df86d3cd4f610839567fe7f4df6cf7ae3
MD5 dc90b55166dba986002c9cf2d5d4b474
SHA1 2bdbc88daf701f20448c5567b36801c589d31dd4
SHA512 ebf255e9ebb781b5a26d324b14dafa318c53ed9929bd9e63e0f292cce80c0b3c482e4eeffef3678d3d16470f8ac5a081b42c1507a9088da1c70c5a1591911057
SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDk9H2fpY18e5Px1aYZ3/j:8CLHGeeV5ijCmlDWDkd2RM8e5ba+
TLSH
T1D3A56B05A7EB5188F8F3CAF4CA2694169A327C549B34F7DF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 b18449d3e5896a42ebd08aae5a90213f05015bed53c93d657d5467e5bb0fdcc2
MD5 d3a4f6767f5ecc9c60bd993db4350e60
SHA1 4b9b2e28cb9757ba3b32d1ebca1b98951ec0ffa5
SHA512 b9b127d8fe5e913ac02f348e2afe7dd53771be56bd96d47485b9a4e03ac36dd8c52dc3cc5a347f79749851b4b74236f2b3416c0ed717d5a2e96e896fcf21ea3f
SSDEEP 12288:V1HLk6j5ZI7XkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:Q6DIbH2fpY18e5Px1aYZ3/j
TLSH
T1E6F4F15C337A11B9D07BA03D86934512E2F2B1B5D7121ACF17D485BA4EA3ED8B93EE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 74d28fa6837068f43d5daa99d426f96d03e630b6916b7e27a0454d513c55d4ce
MD5 1fb563b30a335cff1cb7f4cda975119d
SHA1 3b237046c1b348dcf241eeeebabc7653c957f4cb
SHA512 16335a4429e8d95e90ef54501afae917cefc0f470511f0762911a47f419b0905e6e5bf4c2af87cc49a0b63091f5aa70c47d9ab32be0bd280bbf2f8475f9b09e7
SSDEEP 12288:fG6kyNkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:utyNH2fpY18e5Px1aYZ3/j
TLSH
T108F4124C33646198F97A1A388AB3916096B97D70AB1107CF62D1A63F1F72FD4EC36B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 ebbfa6196f429434341689d4dfcff2ff6e5a2997ea98790f6986f81f3f2b00d2
MD5 d08828068d10617350a8a96869f1a2d6
SHA1 4155f4aec8a7d15ce40422c443a2c8e1a7abc9ed
SHA512 05aa0bf2b7168a82b412ffb14e82cc6fd1897daa8b0ab282fe70ddbe472d4f788f53012b71e1f5764f83d3a8a563ce12528f51e952f5fc0b4c5b3cfb1e6ba70b
SSDEEP 12288:V/skpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:NsH2fpY18e5Px1aYZ3/j
TLSH
T1AAD4239C3224771DE83A2D3801BBB911A1D933B9A7020ACF72C656764EF6DD4D93BC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 5999e73da13e588697be478bc92eb60bbeff87cd561d2a6c11f523c6da5f7c79
MD5 a57dfc23656759a6f74274f11314ff36
SHA1 31052fa51ca0a52c418b3e3bce5557f61d4d15c2
SHA512 57967db2b0ec688379f0ad005012453d65390c64e805b6a6e615b120e7f040a7f61b61ac41d2976761918b0c6412a63b6fbf76ac821e23bbcf4529ebdc37a774
SSDEEP 12288:8dgkuZyFDK3tT5Tr7aVLIH9lH3cmkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/D:8dgkLoTfaidZfH2fpY18e5Px1aYZ3/j
TLSH
T1C0558C1D63EA05CAE2B2D639D8725493D633B4315772C6CF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 ed95e87dbf99ff981a6648c27c8ff07428e90f9837bfd3ffdfcc329fa286bc9e
MD5 39a5d561739b193f715eef6b141e8ba7
SHA1 15b679a86d7c908c5d1d9dbc89c40fa11ce519d0
SHA512 9d6286f27eaf736eec812b69f322d71afcf0f41f57ed4a0c6004ae8a2b579ce0be43ed5739bcdd94d643793b7181a187d954b18b44ab64a864887e88eb2995bb
SSDEEP 12288:fpJcm8CNpkpqB2rCoj9aGYTZMTKBAzAPxArsuDfYZbj/mY/LDj:frcmRpH2fpY18e5Px1aYZ3/j
TLSH
T1BE05F14EB36E00A9E1B7913C88928515F2B37071631217CF52E1877E4EA79EDBD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2fa0c2bec30f40bf8b6371dc9ea7a005fcade8a1b5f36c01d1c58b93943d215b
MD5 6078a509564f56097720393c99299a97
SHA1 93ab7fd24163b30ea9b80938f016f0539a7ac3cd
SHA512 8683a14871876539fa02d0ab9ac5831fe0d47e6c6f85d130dea8f1b05bd0d5d488c281cf03358fb4d7d14e9b0ffd67d17d14be42075a6f00394cd90d7577b680
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3t2RM8e5ba+:93Upow8sBpUp
TLSH
T193A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-390-0x00007FF6003C0000-0x00007FF6006FE000-memory.dmp

Download

memory/252-388-0x0000016062580000-0x00000160625E6000-memory.dmp

Download

memory/252-391-0x0000016062580000-0x00000160625E6000-memory.dmp

Download

memory/904-358-0x000001D701090000-0x000001D7010F6000-memory.dmp

Download

memory/904-362-0x00007FF64EB00000-0x00007FF64EFD0000-memory.dmp

Download

memory/904-444-0x00007FF64EB00000-0x00007FF64EFD0000-memory.dmp

Download

memory/904-357-0x000001D701090000-0x000001D7010F6000-memory.dmp

Download

memory/952-344-0x00007FF6DA7F0000-0x00007FF6DAB10000-memory.dmp

Download

memory/952-338-0x000002D4CD620000-0x000002D4CD686000-memory.dmp

Download

memory/952-342-0x000002D4CD620000-0x000002D4CD686000-memory.dmp

Download

memory/952-336-0x00007FF6DA7F0000-0x00007FF6DAB10000-memory.dmp

Download

memory/952-337-0x000002D4CD620000-0x000002D4CD686000-memory.dmp

Download

memory/1124-240-0x00007FF67B680000-0x00007FF67B748000-memory.dmp

Download

memory/1124-326-0x00007FF67B680000-0x00007FF67B748000-memory.dmp

Download

memory/1124-241-0x0000021C2A250000-0x0000021C2A2B6000-memory.dmp

Download

memory/1124-242-0x0000021C2A250000-0x0000021C2A2B6000-memory.dmp

Download

memory/1260-27-0x000001EF224B0000-0x000001EF22516000-memory.dmp

Download

memory/1260-26-0x000001EF224B0000-0x000001EF22516000-memory.dmp

Download

memory/1260-24-0x000001EF22540000-0x000001EF22688000-memory.dmp

Download

memory/1260-25-0x000001EF224B0000-0x000001EF22516000-memory.dmp

Download

memory/1372-50-0x0000021E185D0000-0x0000021E18636000-memory.dmp

Download

memory/1372-42-0x00007FF6B7FD0000-0x00007FF6B8138000-memory.dmp

Download

memory/1372-43-0x0000021E185D0000-0x0000021E18636000-memory.dmp

Download

memory/1372-44-0x0000021E185D0000-0x0000021E18636000-memory.dmp

Download

memory/1372-51-0x00007FF6B7FD0000-0x00007FF6B8138000-memory.dmp

Download

memory/1596-377-0x00007FF6AE1E0000-0x00007FF6AE293000-memory.dmp

Download

memory/1596-308-0x000001DF87800000-0x000001DF87866000-memory.dmp

Download

memory/1596-307-0x00007FF6AE1E0000-0x00007FF6AE293000-memory.dmp

Download

memory/1596-309-0x000001DF87800000-0x000001DF87866000-memory.dmp

Download

memory/1812-380-0x000001643C190000-0x000001643C1F6000-memory.dmp

Download

memory/1812-379-0x000001643C190000-0x000001643C1F6000-memory.dmp

Download

memory/1812-378-0x00007FF60DDD0000-0x00007FF60DEFE000-memory.dmp

Download

memory/2136-36-0x000001EA7EF90000-0x000001EA7EFF6000-memory.dmp

Download

memory/2136-33-0x000001EA7ED20000-0x000001EA7EE68000-memory.dmp

Download

memory/2136-35-0x000001EA7EF90000-0x000001EA7EFF6000-memory.dmp

Download

memory/2136-34-0x000001EA7EF90000-0x000001EA7EFF6000-memory.dmp

Download

memory/2360-443-0x00007FF77DCD0000-0x00007FF77DF5A000-memory.dmp

Download

memory/2360-350-0x000001A7C5150000-0x000001A7C51B6000-memory.dmp

Download

memory/2360-349-0x000001A7C5150000-0x000001A7C51B6000-memory.dmp

Download

memory/2360-354-0x00007FF77DCD0000-0x00007FF77DF5A000-memory.dmp

Download

memory/2388-275-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/2388-270-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/2388-348-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2388-269-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2672-389-0x00007FF684760000-0x00007FF6848F4000-memory.dmp

Download

memory/2672-328-0x0000022CE3A70000-0x0000022CE3AD6000-memory.dmp

Download

memory/2672-329-0x0000022CE3A70000-0x0000022CE3AD6000-memory.dmp

Download

memory/2672-327-0x00007FF684760000-0x00007FF6848F4000-memory.dmp

Download

memory/2708-365-0x000001FB5A450000-0x000001FB5A4B6000-memory.dmp

Download

memory/2708-366-0x000001FB5A450000-0x000001FB5A4B6000-memory.dmp

Download

memory/2708-445-0x00007FF7065C0000-0x00007FF706AC6000-memory.dmp

Download

memory/2708-371-0x00007FF7065C0000-0x00007FF706AC6000-memory.dmp

Download

memory/2956-245-0x00007FF6D7610000-0x00007FF6D7729000-memory.dmp

Download

memory/2956-335-0x00007FF6D7610000-0x00007FF6D7729000-memory.dmp

Download

memory/2956-250-0x0000029A02310000-0x0000029A02376000-memory.dmp

Download

memory/2956-249-0x0000029A02310000-0x0000029A02376000-memory.dmp

Download

memory/3924-290-0x000001AAAB4C0000-0x000001AAAB526000-memory.dmp

Download

memory/3924-372-0x00007FF619900000-0x00007FF6199AD000-memory.dmp

Download

memory/3924-291-0x000001AAAB4C0000-0x000001AAAB526000-memory.dmp

Download

memory/3924-289-0x00007FF619900000-0x00007FF6199AD000-memory.dmp

Download

memory/4268-260-0x00007FF6ECF50000-0x00007FF6ED099000-memory.dmp

Download

memory/4268-262-0x0000019899740000-0x00000198997A6000-memory.dmp

Download

memory/4268-263-0x0000019899740000-0x00000198997A6000-memory.dmp

Download

memory/4268-346-0x00007FF6ECF50000-0x00007FF6ED099000-memory.dmp

Download

memory/4656-318-0x000001FC3D220000-0x000001FC3D286000-memory.dmp

Download

memory/4656-319-0x000001FC3D220000-0x000001FC3D286000-memory.dmp

Download

memory/4656-317-0x00007FF737A30000-0x00007FF737E16000-memory.dmp

Download

memory/4656-385-0x00007FF737A30000-0x00007FF737E16000-memory.dmp

Download

memory/4664-281-0x000001F3421E0000-0x000001F342246000-memory.dmp

Download

memory/4664-282-0x000001F3421E0000-0x000001F342246000-memory.dmp

Download

memory/4664-0-0x00000165404D0000-0x0000016540536000-memory.dmp

Download

memory/4664-370-0x00007FF692AF0000-0x00007FF693233000-memory.dmp

Download

memory/4664-1-0x00000165404D0000-0x0000016540536000-memory.dmp

Download

memory/4664-2-0x00007FF614D70000-0x00007FF61514E000-memory.dmp

Download

memory/4664-283-0x00007FF692AF0000-0x00007FF693233000-memory.dmp

Download

memory/4664-19-0x00000165404D0000-0x0000016540536000-memory.dmp

Download

memory/4664-21-0x00007FF614D70000-0x00007FF61514E000-memory.dmp

Download

memory/4796-299-0x000002609F320000-0x000002609F386000-memory.dmp

Download

memory/4796-301-0x000002609F320000-0x000002609F386000-memory.dmp

Download

memory/4796-375-0x00007FF6C24D0000-0x00007FF6C28E6000-memory.dmp

Download

memory/4796-442-0x00007FF6C24D0000-0x00007FF6C28E6000-memory.dmp

Download

memory/4796-440-0x000002609F320000-0x000002609F386000-memory.dmp

Download

memory/4796-298-0x00007FF6C24D0000-0x00007FF6C28E6000-memory.dmp

Download

memory/5404-56-0x000001F5ABF80000-0x000001F5ABFE6000-memory.dmp

Download

memory/5404-54-0x000001F5ABE30000-0x000001F5ABF78000-memory.dmp

Download

memory/5404-55-0x000001F5ABF80000-0x000001F5ABFE6000-memory.dmp

Download

memory/5708-11-0x00000186CE940000-0x00000186CE9A6000-memory.dmp

Download

memory/5708-60-0x00007FF74EAA0000-0x00007FF74EBC2000-memory.dmp

Download

memory/5708-10-0x00007FF74EAA0000-0x00007FF74EBC2000-memory.dmp

Download

memory/5708-13-0x00000186CE940000-0x00000186CE9A6000-memory.dmp

Download

memory/5708-12-0x00000186CE940000-0x00000186CE9A6000-memory.dmp

Download

memory/5888-231-0x00007FF67B680000-0x00007FF67B748000-memory.dmp

Download

memory/5888-315-0x00007FF67B680000-0x00007FF67B748000-memory.dmp

Download

memory/5888-232-0x000001AA37CD0000-0x000001AA37D36000-memory.dmp

Download

memory/5888-233-0x000001AA37CD0000-0x000001AA37D36000-memory.dmp

Download