5f54faa2db17bf24fa89e4c58990f3cdca45ba0d3decf7a84d129e755a14e0c0

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.4MB
Sample260816-3apdesgd99
SHA256 5f54faa2db17bf24fa89e4c58990f3cdca45ba0d3decf7a84d129e755a14e0c0
MD5 a6d0d7a968014d55161cb84a01651947
SHA1 da775b6c51e5eecf8e22850783043110719449e2
SHA512 72e15f1759b28be9c41a7b4dcad9a7daa4bb3c24d967222bd24d8c1dcb027a3b8b7ca6efa443b4d0a7a53bda0014e731a65390787d16b6414a8ed1994c78ce97
SSDEEP 24576:dzJ4oDhyLP7DhspWcY/0eai5+J2r0FTnu6gYCRaXgmpeLwvUOz:dzq8yr7FspHY90JdFT0plqeoUI
TLSH
T1DA65C01BBA6910FDD029C179C7469232EA71B8460B70AAEF039193693E777E05F3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4668	alg.exe
2144	elevation_service.exe
3288	elevation_service.exe
5500	maintenanceservice.exe
1800	OSE.EXE
5328	GameInputSvc.exe
5740	GameInputSvc.exe
5196	msdtc.exe
2288	PerceptionSimulationService.exe
5420	perfhost.exe
5292	ReFsDedupSvc.exe
680	locator.exe
3512	SensorDataService.exe
3976	snmptrap.exe
844	ssh-agent.exe
1360	TieringEngineService.exe
5152	AgentService.exe
4604	vds.exe
3956	vssvc.exe
5948	wbengine.exe
2116	WmiApSrv.exe
3908	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f11bb5c1e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5740	GameInputSvc.exe
5740	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4848	2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	4668	alg.exe
Token: SeDebugPrivilege	4668	alg.exe
Token: SeTakeOwnershipPrivilege	2144	elevation_service.exe
Token: SeTcbPrivilege	5328	GameInputSvc.exe
Token: SeBackupPrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5292	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5292	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1360	TieringEngineService.exe
Token: SeManageVolumePrivilege	1360	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5152	AgentService.exe
Token: SeBackupPrivilege	3956	vssvc.exe
Token: SeRestorePrivilege	3956	vssvc.exe
Token: SeAuditPrivilege	3956	vssvc.exe
Token: SeBackupPrivilege	5948	wbengine.exe
Token: SeRestorePrivilege	5948	wbengine.exe
Token: SeSecurityPrivilege	5948	wbengine.exe
Token: 33	3908	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3908	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3908	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5328 wrote to memory of 5740	5328	GameInputSvc.exe	96
PID 3908 wrote to memory of 5868	3908	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_a6d0d7a968014d55161cb84a01651947_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4848

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3288

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5500

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5740

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5196

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5420

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:680

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3512

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3976

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:844

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1360

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5152

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4604

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5948

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2116

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bacfbf41a3256a43b6897e8e1570f690af83384afdebd3f8f97df7679605c317
MD5 052172a509bc6d2fe51d0e07346f231d
SHA1 5e94f3b233730f7683fb48224c8c0e8de575a179
SHA512 affa16e460b8301af3e14b7dabeff6e6c1659eaaa2b9f35b16a19671c2a921840e71af69182366c4df01ed99d83041bcf0bc9e64203663e3754c65510713004e
SSDEEP 49152:hwL632BuPkFKRrdE6oh7stBhuXjfS4LWxnxJdFT0plqeoUI:/3q6gjBgeWUI
TLSH
T1BED59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 9d634f48bfa4c56e80ad173bc4462e411c266bb58c27184b1338c03c83691055
MD5 99aa635d91373996463fd8bc093404bf
SHA1 fe2608d190b1de3d8eabd5279f34d9c5136a0a1d
SHA512 e18bfc5a5b75439f8685030d4004396c8ddf9eca2543841fd4915b99d8265ad1904b2d785e2ad17713347655d5a82d5fe47a5a729874e810edb6e779568eb829
SSDEEP 24576:pXYxDTczAN+J2r0FTnu6gYCRaXgmpeLwvUOz:6Tc5JdFT0plqeoUI
TLSH
T1EE05012977E404FAEC278239CCA2C616E673785943A0E74B03A48A655F237D45E3FF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1b776e178ddca9e1b1ceb5fcc5e0be10880a5cae99809eff5600233627139a5f
MD5 c4471d4f42924a1ba681952990235979
SHA1 6e6b79cb1ddd7a3b52b0dae0aacd8c0a5e219cb7
SHA512 6f53f032827445fdf1edd54fef2204ae5d66478da4a22c02882fd587b3bfbb76616e9448145e2e64711be25260da3b5fffd780d30d695ec2a51871f2186982d7
SSDEEP 24576:p0SeeMz0vOxOrM3+J2r0FTnu6gYCRaXgmpeLwvUOz:pLMz0moDJdFT0plqeoUI
TLSH
T136459E16F6748331D073C0B9C5D2A69EE972308657308ACB4296C77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 40398cca8fb91a94dc716fc75d2ebaafd105754acedde6fd585e2cf92778aac7
MD5 78f935a9b7abda9d8378a1c49b564f1d
SHA1 8b3ec7cfc9d3c6f32af6f88e36f679ccfb4dbac5
SHA512 56d0a11b9a681aa501a6f6ef2673d0b981fe8b620a6e46c13f41a8f4284e17e953c3650c88cd0921996e45c8149e892f696bc808f82f7dd8a69f9d6c35353f1a
SSDEEP 24576:muE/ezSC6vUyD/aqgrvW/6q8wyuQ+J2r0FTnu6gYCRaXgmpeLwvUOz:C/ezSC6vUzPvuHjyQJdFT0plqeoUI
TLSH
T164756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 2217243413a21c30a6f19d1fd9672b011e3fdcccc5910d3a4f31a6de45b7ec6a
MD5 8dfc34078f2744c87dde3d830095f8ff
SHA1 7a29ffefd4958c457e623a4b3ceb6677cc7e7d70
SHA512 89bcd9a015986783768c1ce15b36112895baee9a2f156e5bc9ad5234b16e2c5a539d5d1a2f18a2ff3b0c53001b5546701f3085fd532f606f95f76f491456aa96
SSDEEP 24576:rAbiP2Jnmv/l+dO+J2r0FTnu6gYCRaXgmpeLwvUOz:rADJnmXl+TJdFT0plqeoUI
TLSH
T14555AE66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 018d5b907a38b032f6c3a3f58c33c7cb833c9e7a5cc267a9deae039410ad9878
MD5 bb7f1f2e0570fa79bfd38271a1bf95f7
SHA1 dfd2fd6673220e21e7cd0996691a4a8875df9ddd
SHA512 cedb7d9751e7b898c53b4d632dc12869198bb8e266256ae05d7726bae8e7d199c8595ef95c563c1b9fae1e6441a01fe4938af4e135518e66e577448390db9dfe
SSDEEP 12288:+1LQJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:+1LC+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T15BD4234F7E386133F914197299ADD76BB4722C8C71944F0EC62A17A4F836BE0A193E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 1c1d67c17c4a040d8b3522a50ecf12a2b77855adb11f78dcb02200ea0337c9a4
MD5 7005a2aab8203b6b3b97fd5e236bab72
SHA1 6667904016e00a963bd10da0b7e114c21fba8417
SHA512 f86bd3c559bee778fd8862b01fd1904cce34f7651c7b5f7a6023aec3ce72776083fa8cb1a86c525479ef85fc45dbabdb9624366173b33a002ad19bfe4d14828c
SSDEEP 12288:qeBNUbTVO86UqXJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:qJIU6+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T13B15CF3BAE28FCE2C27A9DB95A91C700E77274704B6193CBD165830EDE235E05E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 e281dc2161fdc88173dd38d75172dc9831b7b2f7762cbc48b3706bd8a63cc4cb
MD5 222d57454dcdc8cff9cc860d7475f87d
SHA1 d7606b1d8bc0f1c125e18ca84b581c591a2adc26
SHA512 d3bd989bd710ae8ee81e9fd76f5901b9aa6839be283831a9d59eeeec5a9d710dd9ee123f9c48fc52b3bc537abeda07372366931c95ce29abd8cd44590673b294
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJT9DN5J8NRV3THS:BQvGAdlCEL8c/TRNw5CkeWU
TLSH
T1E0367D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 aa3c38fb53efa4e6f29ce02068f7efb9e9b82ed47b151e9d8aa96b82aae22bf3
MD5 0c432d9f563f9a2d48db1a85ad44fa98
SHA1 6c49dfcb3d59d0fc4d350710bda05fc8a3621d55
SHA512 8c5d925b819def8d58181bbe5a6e812c344a7ed15672a8abc7dca49518a7ff716946b12044899198624606f15c7971581b0c74c93bc1c98620f51ba0f409c506
SSDEEP 24576:imewsAj1+J2r0FTnu6gYCRaXgmpeLwvUOz:JljQJdFT0plqeoUI
TLSH
T13615E031FE74E032D67B0DB21B2AC716647D79604BA11AC3E3A84E9D99306D22377E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 300a4ca1a6fe0a7bdbcb198cbc77d43d60018fa756410d520dd313c008275fde
MD5 a93b348ba8a040c243449208a74b2706
SHA1 f74c15802b8011e85a53fcb3ba24fa547ff03aee
SHA512 dd2d0bbd2912a8258477d115d1ee2bb1be47f10cd861761845aa5f831f64ed14c94ab5edf38426985a7962654b26eff1a73ee576701eb374dddd11d055448536
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyXLldPlbuJHUeWU:bUEtQevvqc2W1cpV2XL32l
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 51e7999e53e6ec74198d416cc3a6d2bcc11b417065ab3ed4f41fba8d0f39a82a
MD5 da9e3de02cc132f7133827f14f83964d
SHA1 9fc2711d969eea9d9e8ff063536781367bacc212
SHA512 6dd1d294b0dc1b3dc02ebca6c55dd566e91d1a3fca38fa1c4ea07ec0edb8579d2c28f3a085cf5e2866a217a913f608535b6bca24b86f1b2bfa564aab32cafe95
SSDEEP 49152:Uy1RquA/m2yL5zMfFiV+XenmE3/zbJdFT0plqeoUI:Hoq1VjnmmeWUI
TLSH
T165D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a276efebcad5eb24875501fc4310b7839c517b890372be722085d78f2bff2365
MD5 af47c76d1ec67961fcdf57523ed7e7ea
SHA1 7ec4c3ad96e2435d229b9d4662ddc6789e431e25
SHA512 f6b939da254f2a397dfc5970fc09f8b01140f15e12e0b1ac3e8ef8ac9563fd8e3ca912dbea0d37578eb33e021a84340399b25899dac51c6f551474e6f0f1768d
SSDEEP 24576:bAhGLvhFoiwtA5l7S534+J2r0FTnu6gYCRaXgmpeLwvUOz:bAMtFoiq5jJdFT0plqeoUI
TLSH
T1D345AE81EBF951D4F5B3AA7899B68171EA76BCA95E30C20F2150C21F1E33E509D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 04de791589a4f1b4a3f62b63f64f3b0cec3a965f51d0187aa82696a1dfdc7bcc
MD5 e9d68d13d98f72febc7e9af0a9385db2
SHA1 09ce57c8bbc1f6f741b693a9b6b062e488cf1a70
SHA512 ed350980f7a6bb4c3dd8f5801363ae0a0239a934a4d5e2d3b3365d089af2c93d48ee11d1861bd0c73485bee2fc67b20d86ea9869230aef0abe0702c8176fab0f
SSDEEP 24576:UwusOW5+J2r0FTnu6gYCRaXgmpeLwvUO:UwfOTJdFT0plqeoU
TLSH
T16F05F14A77A418FAE9668139C597C236F7F2B8052621CB1F4760C75B6F333617D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 a609fc668deaef0054561f29249818ba2e9a2a0355bcb7d7887beb153e4c1b5e
MD5 818fb98f9393b385ddb18b0989438e8d
SHA1 d50d2111883da025d20b5e85cb0aa53977cd22d9
SHA512 31739acecf873600b3073a0b0c95273224194890fdb8080b38b69c230b33d710deb94bd46029d2f44f430a1bcf18b4e0ace58d87579cb4f38b881fc196bf0ceb
SSDEEP 12288:CSO1IZfJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:TOuz+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T19BE4124E37A830B6E5625239C9E9870BE7B2345A337543CF462503A56F23BD12D37B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d50a3872096938a76a36e48b4656ad72a7831f18513e288be3dfd3ef8952ec38
MD5 0504c286ba10de5ad109ea9bc94d9526
SHA1 20617d48320d36f53617fe830fd76e2f6bace544
SHA512 d22657cddc81c78fb7acff6bd7b235226f25ca290656ac3468560879d7edece8665fa9fe29752b31f58d7c4d0ebfe4103012007f1700d178ae7b719fb34232ec
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uq:pQRQyi36YOcP8Lvw2gAf+PN3IeWUI
TLSH
T189667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 03be6893d034cd036fc175bdac84bf8853580a924abd76fce35af1476ca8d11a
MD5 618e08453f9b5dddaf24208cad6b649c
SHA1 5af6eefa8532d81fae88c251daa84b8776ca4071
SHA512 2aa97864c705cff47385a23782134fd771f7c1dc9421525883840af455a418cad33bee3f59cc1202303141b508b96a70fd39b967fa72c969cf1602b84a54949b
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Un:pQRQyi36YOcP8Lvw2gAf+PN3DeWUI
TLSH
T187667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e2f25291d1df7cfbc13168d731af37948e1f3bce1c856687e5c7e9359d16f070
MD5 8d202a5c6ee9f3625684c244a30907d6
SHA1 ddf9c0b21e760fb801d82a5c1466847ea248c1ef
SHA512 7c198d64fbff80ec4e56519e549b7e5fc43da2bbfb90d4b38927537790f6ea39b5861141cfb0ef77d9a8d983df0b9e930af79dee0f9003c3b93f56440976af5d
SSDEEP 24576:qwvMaf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0X+J2r0FTnu6gYCo:D68Qg55nhMeWu7PNU3/fJdFT0plqeoUI
TLSH
T172B55A33B2F600A9C44DE1769F4A873196E27C758FE0D3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9fc00c502db25a1469d7ea8f3fa0f8ceffec2db3eb87cb47efc334c3d1b87c1e
MD5 a71f54e43c96509b85a99dc751a4c71d
SHA1 400f447b08d2812bdfd64d2a743cb589db5d4a74
SHA512 01272f20492d398f19ca845a1a70cfb4d7d97d45dbaba16adddacbcc497511a0c2f0e7ba94d6e37f3951c72e423c967c5496afa8fc7b28b34809e8ac845f86fa
SSDEEP 49152:W3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99B:Hy5112gYy5azzVv569nLKnhZieWUI
TLSH
T122168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ca8f91e3d1db37df2109c3972765dfb7a5b0d59414604a3d8b4c4f6da46f357c
MD5 e1ccffa74501a2da8f8cbc47b99c27b0
SHA1 ec4fbd952d72c94dd98eb11003300116c3cb1c6c
SHA512 8204bc99fff7e8186f2d476cb1167b93f8a3cf3201bc186622d4989eab3b53470b339faf90c9340d13783bfcc19dcb69aae8434b41081fac5fd030fcb455c854
SSDEEP 49152:wa+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmJdFT0plqeoUI:Bu6JmTxd2dQeWUI
TLSH
T132D59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4db27259f62ad1ca5c12f87e0f178b0a656235d6ea0e0190e73e44954e5f734f
MD5 765cdb9068cd8ad47627bc6ac77b019e
SHA1 c8335c9c32e02ae257e640cfb9c58e7ab6ba0035
SHA512 85ec7df7e6637b40629826b36d0e844ff02c480475cb8e487be2d7fc1735576a062ac1f7014bd47ffbe660f63c5016de90a9cd04ad858232b9419d86bcb6d253
SSDEEP 49152:V1hpsNoJpF1A6UU44CwH7R4xAJdFT0plqeoUI:VmifPbRFeWUI
TLSH
T1DCB5BE13F29801E8D05DD17887569632EA72BC450B34B6DF0A90B7962F7BBE46B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c6fc26b836dd10fdf285ea111db47acbb9bd84f16ac4684f3b42c850ca0678d9
MD5 4f023192fad24c574c082193316cf2cd
SHA1 8ddf5f73709ff6679ba922015469c8c6461ca536
SHA512 c65722ea160b8e3382b3b23a98b5f72304a08dcac1e18b6f7c48232e71b5844dbd41c21f94c9bced664141e227872603835bbf735f982bb53b228a5ef4a1948e
SSDEEP 49152:rSuZQIY0Be2K6RVtOnks6NMHq1JdFT0plqeoUI:55dKoi61ReWUI
TLSH
T1B2C5BF03F2E941E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 29131de0c7026be506d48fc5122aeb5a1de9de1877b22e55c5e2490f82b12c79
MD5 a5baf74377792fad57b3775f0a03355d
SHA1 c9cad95e67ab70aafb4afe130006817b18237888
SHA512 46fedb22cd7eecb1a8bc7000e17f86a24fa42fa56f375eebdeaf5750a65d021c8d9af04d4eeb5523b770523d5cfd34946dc818200b1d15fe68bc7c96a545008b
SSDEEP 49152:5HZSn8EApI0figTgiDn0AP5wx5JdFT0plqeoUI:GX2iyphaNeWUI
TLSH
T157A5BE13F2D900E8D05DD178C7568632E972BC160B38AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 7daa40d2bba021379bdac4403c52f8cb03ccda884599e1e6765147ea2c8e53f9
MD5 6aac25cbfefd39ae427be2d8cde987e9
SHA1 475566ec354fee0995e8209d3abc22128b670c90
SHA512 f0852dc5750d9ff2f1b6b5221147e4539cbd463f006c7d8bcea490e40d2caed964e6250d9060e23767e61837e7d07a61e275ab62ba8048ca198bcfcc030be7db
SSDEEP 12288:zHJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:zp+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T131D4235F7D685233F8045672859DD75FF4B1298DB2A5070EEA2E0760F923BE03583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 9302404d105183b0a050394dd29f37754dd82bedf80bc456d6bf06b2c5d0678b
MD5 7c76bbfe9ee5edb798b053e3953e735f
SHA1 197fe9e1127a06052d81a56865fd8ebafb8635d1
SHA512 943872f69392c6d906a3d5527aae1f31f21d3a6fdcb6a1348fa213d47ca47c17f7300497066c3a50fe07d96d769e66d852d4a193846ec7c665d489695efc9cb0
SSDEEP 12288:FFJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:FH+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1A8D4235F7D685233F8045572869DD75FF4B1298DB2A50B0FEA2E0760F923BE02583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 8b1ada76b66a54bed5bc716c57c3cfd53cc7bc75e3d66e47ac4823ab5246f1b9
MD5 d0194768d368818f360e735722ad87b7
SHA1 e7423bcbc5d8a33379a3bdb062194f8d9c71aa7f
SHA512 a012bc9c14ca36435382292371f11920b3c200d6938b756c3cb747648eaae57ee6d9993583f37032a0950ba3236d44255990b1473d9250bd46b942e4ae00a777
SSDEEP 12288:LtJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:LP+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T15AD4235F7D686233F8045972859ED75BF4B1298DB2A50B0FDA2E0760F923BE03583E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 7911740a500277c71aab167e98210eee5f9c338f108b1e17daf63cf862ca2963
MD5 03c4e80277f748c4b5abf32b557d6839
SHA1 0a3ac7a7add2efb3c474b7919b10f5f9113e3147
SHA512 ae806bf520bcfa5ca3620290c665963d5265f3c96842c93f42d1dcf95e0705335941ab5e17c13c50e38b9527b9e63fdeb4fe6da60c2ea873dae8de97898c9fbd
SSDEEP 12288:hldJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:L+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T171D4234F3E7851B3E8149671C9AAC72BF5B1389CB2714B0FDA150764AD237A039A3F91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 0d61613be38cbde8a435803f1f454e15885f9fa6ea814a807e7354c926730092
MD5 54d4cf4ab1f89869d7ad69ade53cae78
SHA1 2d31ba92bb4876085b6f5cf3a134da77d45c62e7
SHA512 94199e0775c5fd8319268f32e5880343791f435563664dbcfd69324eaf2b79eb6f201922fda7adac73e34116114fd161b3eba319ef2286750280456e146f6ab1
SSDEEP 12288:KeJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:KQ+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1DDD4235F7D685133F80455728A9ED76FF4B1288DB2A50B0FDA2E0760F923BE02593E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 b962e49e46dce688287d1ad3325b42233e3288ffb31b8c8b172bcaf69318ad2e
MD5 91f40e696b38fd7e7a2a284654714fe3
SHA1 240e44f50e6689ab03da008c5a1d3085189e890e
SHA512 767905bc7e5319c93ed75da419f7993d1ab6b73a0c80b053bf08c4ba569c4652427131502b52ce53e17f3f790e1c1f876ec128f7b955cd358012224497d8bc4b
SSDEEP 12288:5vJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:5R+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T135D4235F7D785233F8145672899DD76FF471298DB2A50B0EDA2E0360F923BE02583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 f92294ed51441e8455c414ecfab20f2f44b31a45089b5eca8192caa0ffc67584
MD5 bd663890070fbea334d96a2b365dbac5
SHA1 38e1c9ab2546e4028865315c48006399e2b739aa
SHA512 6bf537c8e0afe27eddcbb0d88ffa57683eb8b1fe434b1f21778c1b4211e308b7cd0ad61844e1e889d2f0cfec06979dd0ad6582b2e3fce27dce2ebae358e08c13
SSDEEP 12288:oAJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:oS+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T109D4235FBD685233F8145572899DD76FB4B1298DB2A50B0FDA2E0360F523BE03583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 52d77d274ecd1584ee9492ab54e57b6af1b838e49911f84fe69200ace50687d1
MD5 fc6b29bcf76d6b519fa6cf1f5de1d035
SHA1 3c34dc6ddb0fac7d7539503fc32d6f77f20d6e08
SHA512 3a5109d1c26603b2cfcb7deed8211b89646539aeee397d6785f5f3412c35ac7903ae776272757d9c2d2fbd7e2ccba931a57facff64658a272c7fb3f358ceea5d
SSDEEP 24576:HZMnzFUSPF+J2r0FTnu6gYCRaXgmpeLwvUOz:HZMnzuHJdFT0plqeoUI
TLSH
T1C7150199B7A018F5EC66813EC9558A06E6B27C5A1770C61F03B837665F333A01C2FF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 8c411619f91245a52d5d3f48a28322fc3e98c436c1aa1e828cae7baa5b439e4b
MD5 c247db949ba09dfe169f3814d827f472
SHA1 afa8d52cdb2e9f6f5db7731ca10f46cd1d53006e
SHA512 1f0376f5888f824c3352117fb8c2d53c36ef7dcde10be50884a9005bdc7105aff7a2bf80a82e30ae70e726f0fe15446a6cc0ff61a09d389a81819451c63a7b47
SSDEEP 12288:dUJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:de+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T14CD4234F7D785133F81455B28A9DD76FF4B1298DB2A50B0EDA2E0760F923BE02583E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 23bab660d0c358d3496b8a4520fccc4831c3433215e368926940ade397dcb17c
MD5 6e2850de810351bcbd67d25295d66553
SHA1 bc11e95da8086a5b8a127482e0b9a56d0d7581cb
SHA512 fa68ed652b5edbe2e30b3d9d7ae03790417a746462d638ac6a3f886d43d3bd9b0a914b45086be295bc6033c14d0cdb65a556c605a49beb8bdea949e7fe8ae4d1
SSDEEP 12288:neJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:nQ+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T107D4235F7D685233F80455728A9ED76FF471298DB2A50B0EDA2E0760F523BE03583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 b5396c15d26e21f52e371e5b9f73240dce314ccb9755e7a613b733350d00cfa9
MD5 2ec183cc7a02a96188fa9b96c5f00ff0
SHA1 c4171dc71492676d6e662262f9118b34ce842775
SHA512 1f02a70fef75004e227b95ca75aa638521e6f5fa57b442769be6ccf81e40a907d5e97624449729fcf07f623fffca868a608e3876946817007345e518eb9c2d0a
SSDEEP 12288:llPz5LfwJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:PzBi+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T15FF4120B77A430FAE0259235C8A65B07F772783A57208F5F576407766E237A06E2BF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 615545d0eadd93e27574cec06d0c71149c0a7400bedc33c83df7810ed4fb5099
MD5 084cbd793b05f2711ac567fcbdecb1bf
SHA1 8b851cabbaf46aedc8e36490b5d9e23388ad6605
SHA512 6b849b929c5a6f79f24458b0bef96805b372676c1f516073c435fd53ccda0871cd8de0c1556d5eaf9c2a17b95e5366cced40092e9bc4a911c1022c68837e9aaf
SSDEEP 12288:B5J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:BT+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T16FD4235F7D785133F81455728A9ED76FF4B1288DB2A50B0EEA2E0760F523BE02583E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 1d78c9e2cb33b0fb8e98cf779380206187c4d96294bc121a183368812e147751
MD5 24568e7c19c3074aa646fa2b53b97945
SHA1 06f4e0515c494a0b94acdb97b9afa3a1c056f142
SHA512 411cb8ffe149f1d636e4adf385de22d41418dace829e2069968a83b63ce9897e6da2e4e51b7a4c9d9951ed2c331be22924b55a6e25a480561fbf86fcc2217845
SSDEEP 12288:1kJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:1O+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T195D4235F7D685133F81455728A9DD76FF4B1298DB2A50B0FDA2E0760F923BE02183E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 b0049274bd2ee34e28fb9459f6df8e0f4c1e3e5bbd1597d94efc4c52135fd8a4
MD5 be82764b8363f7268c444df6cc2a2771
SHA1 f8d767f9e440b1f5cc3c4d2a891dd789326fe5b8
SHA512 596967b65a3044e84c1cc4e077b5706fcef69dad3fd8cf7293a8a343d2360ba4bf165d5a709a7d170321317a5fa86531acc93214fcb6af1d4467ec6740e68c2c
SSDEEP 12288:4lPz5Lf6J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:SzBU+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T12CF4120B77A430FAE0259235C8A65B07F772783A57208F5F576407766E237A06E2BF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 64483b97b0bdc18537670a31a693232e7a7db20b80bbe30b72dccb40cbad6520
MD5 85c7abdeb65485e68faa76e0f690f76f
SHA1 bd3203ae8c3ecd8b9df2e582b62985a662a35416
SHA512 0224163438401b762e10c062c17a37cfa0bcba4a7710235ae753429eb6a6900e4696294a3680370ebc59612349b85a0ac898c4666dfd5d4675e8d5ec26d9c881
SSDEEP 24576:KTXaLl3z0zH5+J2r0FTnu6gYCRaXgmpeLwvUOz:KTqLlj9JdFT0plqeoUI
TLSH
T13D150199B36018F5EC66813EC9658A16E6B27C5E1770C71F03A837665F333A01C2BF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 23f5420a5939ffeb67b2a7faed4b64ec3de36c29276235896a791e6c25283d7b
MD5 28a8137f9be996bad135945d3b6efd7f
SHA1 5ddad4cd7299e00914c285d6145a14b4fc4e8447
SHA512 7ba317ed6000fdb4b744a55ff65e81f95aa066c933ce72e6d90a76d9af8c756df471edbaeaf7ae50016518b953c9c7ac823225d66d0f25d3a1a652e5e7f39d48
SSDEEP 24576:g3KdXCH/y7Sn++J2r0FTnu6gYCRaXgmpeLwvUOz:qKdXCH/yudJdFT0plqeoUI
TLSH
T13435CF90F7E410E5F0779A3589768612DAB67C591B31CE8F03A8265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 910d342e778a15440190eeaad8aff1854fd566e4213967ec03e86381522bc1bb
MD5 0255f1c0921a25ac6cba0378427c54bf
SHA1 64ad971567668545cf509023197b17f2a08ea884
SHA512 d105b65ba107e6b5619440fee80deda1320cc8ea27e11562dbe682488d697e9e8edb0722f688882226facb5d4d6122a8d36aaad05d2d4bbbc3bf599fb48a1525
SSDEEP 12288:diJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:dc+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1C7D4235FBD785133F8045672899ED75FF4B1298DB2950B0EDA2E0360F923BB02593E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 d8715102d0302a34c9fe7cafffb10f6f83fd201646e352bce05a4f8e50e74acc
MD5 8ec0957c6c3a5e5550e574754849576b
SHA1 35e6ecc133fe41a42feb7f9a7c9759befc367e9f
SHA512 d77f219721988711c5910d1f88bd330ec859d0b7c9dad8d973015e087c802d4df815ce082d82c6c8ee529ed2dc53debce0fc1833a3b677e4a0fc99e4ced20a97
SSDEEP 12288:VHJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:Vp+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T152D4235F7D785133F81455B289AEC75BF4B1298DB2A50B0ED62E0760F923BE03583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 a7b2765189eae252e17da95ac4c1359ed08bc03f997db77edc925cdd5caa011b
MD5 79f9c7d021b52e3c82c6a354e139867b
SHA1 e94683398176b1c07a0651c17d68cdb43cb8d6bb
SHA512 cbf3e44fe1b9dbba8f0422c5be3b2006d9438e9b7e24366745f595d54bf78dc169308059d65cd8831a01d50a866c4456409bbec27bcae5f85dfcf91480101142
SSDEEP 12288:ABJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:Ab+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T19FD4235F7D786133F81455B28A9ED75FB4B1288DB2A50B0AD62E0760F923BE03583E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 8bad175da079505b9aeb20d3ab4613a5ef9146fffbf6775f07fb23aa9161abd9
MD5 adf15b694a006b5f7a5b6c82425f7a50
SHA1 5ec7c20633d98435cd68f62a23c9f86bfefd5e05
SHA512 15b88a89873d38360b622c3bbbd5f76acbe01fd7a43ddaef6ebefe0f03140729eddc167c50bee622613d26b2d41b21a4eb1e2ac0684266d5d39b149788316df0
SSDEEP 12288:3tJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:3P+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1B8D4235F7D786133F8145572869EC76FF4B1298D72A50B0EDA2E0760F923BA03583E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 aaac0e41e130955de3c4fef4333941c193959953d5dfdd8d11806e409407440f
MD5 635a8c1bd64a3684343bd93288deccf3
SHA1 1057e614808f34f8d63fb8ccf07ebb7bd7901282
SHA512 62ab4685793161996a0c1425bda0054b6be8662aa884bbd32d2ddd8be466f2b05ccea7883fe39cec1f2f0fc71f7ec1eafc16a64c43afdf1d18604b4bac72aa97
SSDEEP 12288:1Ilf7J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:yF+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1D0F4010AE66802E5D02D6175C75A8A46F3333C6993E1C38B96D0F63D1F366906DEBB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 820c910016327f2a7740d0a4cf97450b1388b0fea773af4bb2181bcea6feaf4b
MD5 f42f3c71f1ef3eaed98e3707d55dd8fa
SHA1 8b85530ef6e116028fb7ab576635a436e152d881
SHA512 0411f94b73f33a5f00b26ee50146024efb0641ac880fbc170f94ac96b4828454b34cf9592c180b916a5c8249c7a29cad65ee4f04450b6ddcf5ee2833b08655ec
SSDEEP 12288:Ku7kJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:lO+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1CCD4235BBF6C6133F824667185AEC33BB572349C6754474BE51A03A4F832BE06DA3E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 37ae6f5b48eae13d5e72ec1a0e5ce44fb53ff9cfbefcb274f723af9e9adadd1b
MD5 c51bbcceb002881753596ac63db6ad3f
SHA1 0903178c1d9df5f0f10d3acf6d2d2f89e7c95d5d
SHA512 658e702c98411f6a847f99642c3b5ff1eeade6a256bb36852860cb574cb60413f016800c7ce0db3f8b987847d58ac8942776201b47cf627a846d70fba053f21e
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYJ+J2r0FTnu6gYCRaXgmpeLwvUOz:Ogb4mBIBhGFHJdFT0plqeoUI
TLSH
T1A565AE1E22EC02F5E0F9D2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 56e46407be9912dbb0c7eea0d74eee4954a7308065dac7cd94bbf1198668579c
MD5 3cb1cc0a2cc4f192334a514d4e6f4f70
SHA1 cff3679e027d301fa6de82329b77283ea0a9f180
SHA512 f8a4db30a12408429f47883c0bde67a166a88ea017676e0f6d9a5a67a13051eace458dc48391ce9f1a8b2b6e24eb92a8adf6c8b41dfac1bebbbd0297209527fb
SSDEEP 12288:msG6J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:fGU+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1FCE4236E39B87172D83486758869D727B4B1349C632407EF89A58374EF22BF03677D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 187a955db4c3201d89a3a4eaffd40eb4e4e269e6eb0ac0a18f1ccc97fb4c2db3
MD5 fa720c977e09a451470271168a3e3e9f
SHA1 e892c8cf3fecec3d25c33e796fc8e8e8c7a54c1a
SHA512 de0545a327075d9769c7bf5d2dfeb27195d86122054921d3f4d020528f5f24d01bfeab7db5285680cd3a8e137b81d798338d7201ff0c9169b1988fdaef3077b4
SSDEEP 12288:toJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:ta+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T183D4234E7D28A233F8145672896ED72BB471259D73A40BCBD52A0360F527BF035B3E92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e759882bc23cd7661afbc84c1f48ca580159836bbf51ae44d4ce148eae2ac7ab
MD5 777406ef0cdf9691aefb9fb426cd4f94
SHA1 d667362a8f594444a62dcdab2dc96a4ed2bfecd5
SHA512 fed673e7369ef474345a45eb26fbfe29d00f28fdebedde82188581849f7fb418f82373301ec879a8f762f607e410e70a8e48e71b8100b0f43aa6949835265be3
SSDEEP 24576:fkz8u8FpJqH1sWrya7/mi+J2r0FTnu6gYCRaXgmpeLwvUOz:s4ZFPqVma7/OJdFT0plqeoUI
TLSH
T11A35F16576E001F1D47BD13889868667F6B2B4291364EBDF06A88B511F23BE10B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 01fb7108b547216160cf9a1de8beeddce6d9e9788ead20af434f09a8afcc4851
MD5 86d7594a5d63ac8a6a0777716d600f19
SHA1 9fb53fb86eb94b5db1f5edc981332524ddb07279
SHA512 29eef722d274443dcd6673f2ec899625fc76a7d8e869ac4723fe256739d211322d5a80882bd3f78c94a7632164700d0eb4227e67f320a47ce46c4333151fa07f
SSDEEP 24576:fPUr+NQl+J2r0FTnu6gYCRaXgmpeLwvUOz:fJQAJdFT0plqeoUI
TLSH
T1B505F12F36AC18E5F675A17D8986871EF7717466131192CF02A0817E5E23EE8BD3BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 45c1ca0d0b2a2bfa7eccc3b0343735b0d6a8dcaf3c8eb10054c9d274ce8f0a7a
MD5 f84255fe361f4ff7c82f9f998732b1a2
SHA1 526784bd06abd2b26ff230bc1855b4cb273911a2
SHA512 b854198571259c80cc8382176e7ae653bfe7250217594d014ff84411af2e2fbd8ceebba1d951d05788ce3afc6be68014cad5a032201c5e7cac6bb3daa07b439c
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZJdFT0plqeoUI:IG05lO43bmeWUI
TLSH
T1CFD5BF6E62EC11F9D0BBD17CDAC6860BEBB23415032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0a6904f0018a66740136301c26e94b037ccdfdc34c04f5af5f9739988b2e396d
MD5 4ee9c819260a884a77cc6a3acd849a87
SHA1 1b18653c902cd54945beec7fb25908798d90d9c8
SHA512 5eb8a85324b5ee7f059792938269662b8475871a482369928b695e92c7e2bd53bfdb657c2197d674296ff90925665530941fb2526e301fb18523ba529a0de06d
SSDEEP 24576:1ra5POZ3dpbWVM50JicR2hG0lasx2+47eidnU+J2r0FTnu6gYCRaXgmpeLwvUOz:Ja5POZ3wJt2pasx2+m9JdFT0plqeoUI
TLSH
T1A865BE5EA6FC01D5E179D17DC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 18eaa7d39247648e59376c02b42864f50ed707be296c28142e759f244e388f77
MD5 717ba0e02a1cb200ef976f89c4edc632
SHA1 e02502578606eb5d903fd3b3bee7254dfea42ff7
SHA512 fa161787639ebc79ef39acbd716bb8f73648b990fb09be787dbc843c417071476ab72ef749b2af96f9c92053bbf0ce401dd0024e33c60e5c0178d876799c50cb
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkY+J2r0FTnu6gYCRaXgmpeLwvUOz:PNc/zEOVHFYJdFT0plqeoUI
TLSH
T1C4858C1623E901E4F5BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 a60c687837c0a2c2511966abb12f02d960f5686d939865f339b5e45522e89dd8
MD5 28c680a35d716b3b4e7aa014fcab6e45
SHA1 b3f85fe192b9986b0298849da9c2f99070943e26
SHA512 5395b590a2a5c794aaeb6d79e793901504d45b28746ef14031ebd480370a6e3069fa8c7125b641c798079acf79fa40eb0681ee8a14c16de92e088fcf51465df7
SSDEEP 24576:bJnJPbzB4SF+J2r0FTnu6gYCRaXgmpeLwvUOz:bJnJv6SgJdFT0plqeoUI
TLSH
T1A715E03DD2A810E9E4B7C2B4815A175AFE31387C2B2169CB59B4D5343F12FE0A97AF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 fd1104c2c35cb716037563d351500d6e3413c1b77a62489da2798c4d4fb83027
MD5 556acb6a57c12f3a211cd9067893530a
SHA1 94689b6c326639fc6fb0bcc1e8647c444a9cd4fb
SHA512 b413a98920d9f86f0fd47583e8cb6e36b35dc2edeef6fe6c75a627ee3033f474902d965f2247de8a729dcb1236f3cd5e43e68c42ee78d2ce4b94b064ebdacc84
SSDEEP 24576:gCLHGL0MoeVtFumTijCmlKQWDk4+J2r0FTnu6gYCRaXgmpeLwvUOz:gCLHGeeV5ijCmlDWDkTJdFT0plqeoUI
TLSH
T192A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32FD0D539B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 200676fed3a422be03b760d09394b3d39dcd181bb53a817231caaa9caa3d63cd
MD5 04ded03e8f8b210a239ceeedf559bece
SHA1 42841083ffb8eb8bd10fe3936c7de1ac3d85714b
SHA512 6ad7ed8e897599d8a761e0ad8463fa3c8aabeae702c6e8950a5692b061a796a679c018d77f50696ee58f385148ee690ab93e6dc6b3275a221e61e7efaca0539a
SSDEEP 12288:/tHck6j5ZI78pJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:D6DIIj+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T13AF4025D377910B6D027D03EC5834616E1B270B893620ADF4798C6B99FA3FD8B93AE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 42470cab482d86e2ac398f1c076556d734123eef7366511d19474277bc9ce52a
MD5 71dbc81ed17e2842bd91dd666746ccb0
SHA1 fa11a6f698c6a5b1ca3436d905280d41d7878349
SHA512 790bc247d2ac90fea54deac2f717af7f57c947d1bce26ed421493e896593e51d7174036dd5fc80472441831c6a85963af27de3c1c94d62123ea9ce2b0207842f
SSDEEP 12288:TG6ky5J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:CtyT+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1A3F4120977A860A2F93406748A67C366AA317C28672147DF95A1973D7F33BE07873F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 72959ee0568a8b0912625cbaa4a231186dcac0e12d26235852f65d1f38005854
MD5 9d265c4cefb9cf9c734f971b8d13ae3d
SHA1 5b5410a2a547e04eb1fca0802d34416ec1135477
SHA512 95d2bb33c8c0e96bd5206138296bbadbf5d8e42ebd4d4c41ce27006e3f87f13d93fd017acad29a35134170b8321a6f1727aab04ce2dd141acc67b3c7a106b1f1
SSDEEP 12288:0WS0J7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:FT+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1E2D4235E7E386133E8146A71856EC72BB07134AC77650BDFE9694370EA23BE025B3E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 f0129a45faae68df3817420c473060f52b9bbb0572d325e354ec22e62f4a9007
MD5 f31d508bc815773f535c04c91970ee14
SHA1 163cf862639fa052c4b50df49bb28cd16b2f1a16
SHA512 79fffcb3fed7a55740b53c32f6a6937319b0d91a46a9785176ec6b5249aa5b9b857b06f161ae9bf743d0c0c9757aad8c75d2c9f4960598bf91df6199fbb8e4c9
SSDEEP 24576:lng9LoTfaidZ++J2r0FTnu6gYCRaXgmpeLwvUOz:FgSTrZdJdFT0plqeoUI
TLSH
T116559C1DB7EA05DAE2B2D235D8625493D633B4315372C6CF2448C03A4DABED8AE75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 d549a529cff08385f00fb9639530b922ba9a047d0da9434f1ce8fa27c211179e
MD5 01a468ce997e81702f5a8fbce6a480e2
SHA1 ec94a6483ba06fa87746e78e32b9ac0d6e97909b
SHA512 4b6b269c9f84f2424bf5cde8d61ae8460fff4ea280d02c94fd0ba2f2e34dea79b7e448f43e2fcfef62700c47be1cebe6bbcf102ce49c652585896cc6b96b8f39
SSDEEP 12288:NpJcm8CNgJ7aJ2ukJbgFTng3lMhLkY0XoCV7E5X9So5peOwL92v3Wrolz:NrcmRy+J2r0FTnu6gYCRaXgmpeLwvUOz
TLSH
T1DD05F14EB66E00B2E177813CC8868616F6B37074232257CF42A1877D9E27AE97D36F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 711c1032ed7b7ae9c2476f98280f70817776c9327a03054ba59ee324b19ce6f3
MD5 d9e56f5b005b8225697efc578b5dec75
SHA1 c701a19f3f0c54e36156fc64e933594f41a8d67c
SHA512 1462b95756a39a1d5978230aeb0419b7369c01387fe20de7c51f8055d931e20e385c14c99b39fedc02effc4bf2145e02ab2296a4501b0e7cec4e32c03cff5f58
SSDEEP 49152:YDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3PJdFT0plqeoUI:F3Upow8sBgeWUI
TLSH
T14CA58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C178BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-289-0x00007FF772B70000-0x00007FF772C1D000-memory.dmp

Download

memory/680-291-0x0000021C63EB0000-0x0000021C63F16000-memory.dmp

Download

memory/680-290-0x0000021C63EB0000-0x0000021C63F16000-memory.dmp

Download

memory/680-366-0x00007FF772B70000-0x00007FF772C1D000-memory.dmp

Download

memory/844-319-0x00007FF7FEC20000-0x00007FF7FEEC3000-memory.dmp

Download

memory/844-320-0x0000020829EB0000-0x0000020829F16000-memory.dmp

Download

memory/844-321-0x0000020829EB0000-0x0000020829F16000-memory.dmp

Download

memory/844-388-0x00007FF7FEC20000-0x00007FF7FEEC3000-memory.dmp

Download

memory/1360-329-0x000001A687A70000-0x000001A687AD6000-memory.dmp

Download

memory/1360-404-0x00007FF60C350000-0x00007FF60C4E4000-memory.dmp

Download

memory/1360-330-0x000001A687A70000-0x000001A687AD6000-memory.dmp

Download

memory/1360-328-0x00007FF60C350000-0x00007FF60C4E4000-memory.dmp

Download

memory/1800-56-0x0000025A20850000-0x0000025A208B6000-memory.dmp

Download

memory/1800-55-0x0000025A20850000-0x0000025A208B6000-memory.dmp

Download

memory/1800-54-0x0000025A20620000-0x0000025A206D3000-memory.dmp

Download

memory/2116-376-0x000001D86CDA0000-0x000001D86CE06000-memory.dmp

Download

memory/2116-448-0x00007FF73CB40000-0x00007FF73CC6E000-memory.dmp

Download

memory/2116-377-0x000001D86CDA0000-0x000001D86CE06000-memory.dmp

Download

memory/2116-382-0x00007FF73CB40000-0x00007FF73CC6E000-memory.dmp

Download

memory/2144-26-0x000001ED97100000-0x000001ED97166000-memory.dmp

Download

memory/2144-24-0x000001ED96F50000-0x000001ED97003000-memory.dmp

Download

memory/2144-27-0x000001ED97100000-0x000001ED97166000-memory.dmp

Download

memory/2144-25-0x000001ED97100000-0x000001ED97166000-memory.dmp

Download

memory/2288-336-0x00007FF699AF0000-0x00007FF699C39000-memory.dmp

Download

memory/2288-263-0x000001B59E2C0000-0x000001B59E326000-memory.dmp

Download

memory/2288-262-0x000001B59E2C0000-0x000001B59E326000-memory.dmp

Download

memory/2288-260-0x00007FF699AF0000-0x00007FF699C39000-memory.dmp

Download

memory/3288-35-0x000001DB6DCB0000-0x000001DB6DD16000-memory.dmp

Download

memory/3288-33-0x000001DB6DAD0000-0x000001DB6DB83000-memory.dmp

Download

memory/3288-34-0x000001DB6DCB0000-0x000001DB6DD16000-memory.dmp

Download

memory/3288-36-0x000001DB6DCB0000-0x000001DB6DD16000-memory.dmp

Download

memory/3512-432-0x000001A9815B0000-0x000001A981853000-memory.dmp

Download

memory/3512-300-0x000001A980BE0000-0x000001A980C46000-memory.dmp

Download

memory/3512-433-0x00007FF729FE0000-0x00007FF72A3F6000-memory.dmp

Download

memory/3512-381-0x00007FF729FE0000-0x00007FF72A3F6000-memory.dmp

Download

memory/3512-430-0x000001A980BE0000-0x000001A980C46000-memory.dmp

Download

memory/3512-299-0x000001A980BE0000-0x000001A980C46000-memory.dmp

Download

memory/3512-298-0x00007FF729FE0000-0x00007FF72A3F6000-memory.dmp

Download

memory/3512-429-0x000001A9815B0000-0x000001A981853000-memory.dmp

Download

memory/3908-389-0x00007FF780200000-0x00007FF78053E000-memory.dmp

Download

memory/3908-390-0x00000285C93A0000-0x00000285C9406000-memory.dmp

Download

memory/3908-449-0x00007FF780200000-0x00007FF78053E000-memory.dmp

Download

memory/3908-387-0x00000285C93A0000-0x00000285C9406000-memory.dmp

Download

memory/3956-446-0x00007FF7F4120000-0x00007FF7F45F0000-memory.dmp

Download

memory/3956-359-0x0000017FD7410000-0x0000017FD7476000-memory.dmp

Download

memory/3956-358-0x0000017FD7410000-0x0000017FD7476000-memory.dmp

Download

memory/3956-357-0x00007FF7F4120000-0x00007FF7F45F0000-memory.dmp

Download

memory/3976-309-0x00000151D3AB0000-0x00000151D3B16000-memory.dmp

Download

memory/3976-384-0x00007FF6E4090000-0x00007FF6E4143000-memory.dmp

Download

memory/3976-310-0x00000151D3AB0000-0x00000151D3B16000-memory.dmp

Download

memory/3976-308-0x00007FF6E4090000-0x00007FF6E4143000-memory.dmp

Download

memory/4604-351-0x000001A996480000-0x000001A9964E6000-memory.dmp

Download

memory/4604-350-0x000001A996480000-0x000001A9964E6000-memory.dmp

Download

memory/4604-349-0x00007FF781040000-0x00007FF7812CA000-memory.dmp

Download

memory/4604-445-0x00007FF781040000-0x00007FF7812CA000-memory.dmp

Download

memory/4668-12-0x000001BE32320000-0x000001BE32386000-memory.dmp

Download

memory/4668-11-0x00007FF7973F0000-0x00007FF797512000-memory.dmp

Download

memory/4668-66-0x00007FF7973F0000-0x00007FF797512000-memory.dmp

Download

memory/4668-13-0x000001BE32320000-0x000001BE32386000-memory.dmp

Download

memory/4668-14-0x000001BE32320000-0x000001BE32386000-memory.dmp

Download

memory/4848-2-0x00000288EE1C0000-0x00000288EE226000-memory.dmp

Download

memory/4848-0-0x00000288EDF70000-0x00000288EE097000-memory.dmp

Download

memory/4848-1-0x00000288EE1C0000-0x00000288EE226000-memory.dmp

Download

memory/4848-19-0x00000288EE1C0000-0x00000288EE226000-memory.dmp

Download

memory/4848-3-0x00000288EE1C0000-0x00000288EE226000-memory.dmp

Download

memory/5152-345-0x00007FF6772F0000-0x00007FF677610000-memory.dmp

Download

memory/5152-338-0x00007FF6772F0000-0x00007FF677610000-memory.dmp

Download

memory/5152-337-0x000002C319FD0000-0x000002C31A036000-memory.dmp

Download

memory/5152-339-0x000002C319FD0000-0x000002C31A036000-memory.dmp

Download

memory/5152-343-0x000002C319FD0000-0x000002C31A036000-memory.dmp

Download

memory/5196-327-0x00007FF63DF70000-0x00007FF63E089000-memory.dmp

Download

memory/5196-244-0x00000258836F0000-0x0000025883756000-memory.dmp

Download

memory/5196-243-0x00007FF63DF70000-0x00007FF63E089000-memory.dmp

Download

memory/5196-245-0x00000258836F0000-0x0000025883756000-memory.dmp

Download

memory/5292-283-0x000001FAD8C20000-0x000001FAD8C86000-memory.dmp

Download

memory/5292-282-0x00007FF6CA1A0000-0x00007FF6CA8E3000-memory.dmp

Download

memory/5292-281-0x000001FAD8C20000-0x000001FAD8C86000-memory.dmp

Download

memory/5292-363-0x00007FF6CA1A0000-0x00007FF6CA8E3000-memory.dmp

Download

memory/5328-231-0x00007FF72C550000-0x00007FF72C618000-memory.dmp

Download

memory/5328-232-0x000001D3E5520000-0x000001D3E5586000-memory.dmp

Download

memory/5328-307-0x00007FF72C550000-0x00007FF72C618000-memory.dmp

Download

memory/5328-233-0x000001D3E5520000-0x000001D3E5586000-memory.dmp

Download

memory/5420-270-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/5420-348-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5420-269-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5420-275-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/5500-42-0x00007FF6C7C40000-0x00007FF6C7DA8000-memory.dmp

Download

memory/5500-43-0x00000230D4720000-0x00000230D4786000-memory.dmp

Download

memory/5500-44-0x00000230D4720000-0x00000230D4786000-memory.dmp

Download

memory/5500-50-0x00000230D4720000-0x00000230D4786000-memory.dmp

Download

memory/5500-51-0x00007FF6C7C40000-0x00007FF6C7DA8000-memory.dmp

Download

memory/5740-240-0x00007FF72C550000-0x00007FF72C618000-memory.dmp

Download

memory/5740-318-0x00007FF72C550000-0x00007FF72C618000-memory.dmp

Download

memory/5740-249-0x000001B241FB0000-0x000001B242016000-memory.dmp

Download

memory/5740-250-0x000001B241FB0000-0x000001B242016000-memory.dmp

Download

memory/5948-369-0x0000019C8FD20000-0x0000019C8FD86000-memory.dmp

Download

memory/5948-368-0x0000019C8FD20000-0x0000019C8FD86000-memory.dmp

Download

memory/5948-367-0x00007FF7CD890000-0x00007FF7CDD96000-memory.dmp

Download

memory/5948-447-0x00007FF7CD890000-0x00007FF7CDD96000-memory.dmp

Download