40b8edddb17df061a49018f013dfdc82ee8a9ca222f6e96ead26fb2b56fda4dd

Analysis

max time kernel
131s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe
Size 1.2MB
Sample260818-pyl2basejg
SHA256 40b8edddb17df061a49018f013dfdc82ee8a9ca222f6e96ead26fb2b56fda4dd
MD5 e051a38c90eceec404109c0db714ec5b
SHA1 e41c616df3c3c53476eaf93267c69b70b2307e03
SHA512 be634d02a2b43b030f73ec75c41878687cf33d61acf12b000b935c589110a1ed9921e1459ac6d8b00112eb43c83fda3ce1320d06cc2a6adbd6a73e1f16d4c19b
SSDEEP 24576:4hfDc6X3lQM3xr4cQFTj0OZeVJMsIGbIjdK8Y1NNz4jSXxpne8:zul13qcQFTIOZe8Pzqvw
TLSH
T15F45E02EBEF1C032C16301319E6AE358A2B5E07248264447BBED675D2F705D39B35BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1220	alg.exe
1552	elevation_service.exe
256	elevation_service.exe
1372	maintenanceservice.exe
4692	OSE.EXE
5940	GameInputSvc.exe
3208	GameInputSvc.exe
3548	msdtc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2e42d393209659e8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3208	GameInputSvc.exe
3208	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2380	2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe
Token: SeDebugPrivilege	1220	alg.exe
Token: SeDebugPrivilege	1220	alg.exe
Token: SeTakeOwnershipPrivilege	1552	elevation_service.exe
Token: SeTcbPrivilege	5940	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 3208	5940	GameInputSvc.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_e051a38c90eceec404109c0db714ec5b_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:256

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1372

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:1264

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3876

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
PID:5532

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4864

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:4816

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:3244

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:200

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2884

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:6120

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2108

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4628

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5300

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5884
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4656
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c93911ad356c0aff9b541d02a3f2a71bca87e1c613b7508d9f9c424fd984aa05
MD5 5f1747c9135271f96ec72a3ff6a249f1
SHA1 e12b23d24ca1c2511310646cb9664e158b1d32f7
SHA512 d44256ac8b4ecd59f3ed9879ef6383eb92f95df1804a343243456c8b78e818a316882eaee489c9c84d4bb5db0ec75622fe0cc5fc1c0afb812f2d84869d3586f1
SSDEEP 49152:rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBPzqvw:53q6gjB0zYw
TLSH
T14ED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 4747c6055f99cb615511870713bc9a55fee4a6a0927e9a89a38b55a212aa9459
MD5 f2cb32321c0f2d33cb77a0703c89aa6b
SHA1 98e03665507994179f3863a8f4523fdccc243dda
SHA512 8c0131f11cf28e344de24a8467bb4772d98a49d42c3f2c67e872b24da3d7c2f2a588544ef448eb10de66aceacd3a27a67e7e3da59e480df299062f2cc134c239
SSDEEP 24576:dXYAiRczA3sIGbIjdK8Y1NNz4jSXxpne8:sRcePzqvw
TLSH
T1A705012877E10CF9EDA7813DC9A2C505EA73B45147A4E78F03E499691F233985E3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 1d8f2d69a6818f5fda53597e01377d6b1010f1b4f6e9c985380e881ce7bc02fb
MD5 356acee426e88eabf9febcdfde2213ed
SHA1 8067a6c640181923ddff3ef7fa6303f8760d2ce1
SHA512 ec7db7ff9659d9e419c764454061c04a31acf0c5721aa8688ef8f8ee8af28380757cfbc3ab92ac1d986d6f2881d9316bc6e4687bfa36a516d230fc853660bcc6
SSDEEP 24576:m0Je9My0LuxOrMtsIGbIjdK8Y1NNz4jSXxpne8:mRMy0yosPzqvw
TLSH
T1EF359E26F6748735D073C0B9C5D2A68AED7130825B308ACB4286D77C7E677E68A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2ae020925bf4c01cd37ff28b6b9760f69fae6c719d4904480ed0b0fdd7ba911f
MD5 2d7954fddd2cf353c1e416f040c11d2e
SHA1 c226b2ad3ffaab535d5a446e974cb26c3d290bc4
SHA512 d1a421eaccfc138674e4a184c2d499651cce785bc249eb939b21f45c3cd26f990e3fda0f6ac2c499b2ac70ba78a7cb8576aa95757cb9e233e4a35bf8d206e87a
SSDEEP 24576:YvM/ezSC6vUyD/aqgrvW/6q8wyucsIGbIjdK8Y1NNz4jSXxpne8:N/ezSC6vUzPvuHjyHPzqvw
TLSH
T1B2755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 44439358ff04ec44ba9f2fe382c64fa11f86dd9bd4a3c124b8a89aaf471c0925
MD5 153a8f34a248d9014bb0925407163f31
SHA1 1b240475e06cded8cc3c9450203f3c0b7dcaec8d
SHA512 49d2bca972bef2936535ae5f920b046908edda33a2e97e0ec26cdb968dae515587db793f25b8559ee0f65f7e6b2fe8a1ab40a75906eba6163551bae147109eeb
SSDEEP 24576:1AbwPHwbiv/l+dOsIGbIjdK8Y1NNz4jSXxpne8:1AYwbiXl+MPzqvw
TLSH
T1F8559E66F5748331D073C0BAC5D3AA9AEE3230425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 5588f2bf30a461ad04b138443812f93318dd979204363b52d3dd45062bbebb48
MD5 90b3a6768d8d777417124ff88328df32
SHA1 b09168442c5b4c8a78049088dc1db4ba4f17e8d7
SHA512 bf49aa9558b2124ad7ba1e716b27a06fe59c43ccb7136e5f6a2caf9bf3ed4fa424aa1054e85b5d9414118dd6ed783e1e739717d32ee5832cb030ba71619d6f98
SSDEEP 12288:QI1roIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:QI1sIGbIjdK8Y1NNz4jSXxpne8
TLSH
T16BD423A22F324DB7EBFA003252D7F918EAFD903157DED24E46E53DC89824355AEA10C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 8d8758506226366fdc8dd8cc3f6449b23eb7a533d15c47dc3e8f70579538ef93
MD5 2129221e08dbe10e8bd6259be529b27b
SHA1 7bb490672117395a182c185d278029623d3cc85e
SHA512 2658047c7f923f172f075d798d50d4097268d4bc234c6987f82e595817980e789744c5b0ea66dcfcfd1f5c45379f2898b6da0fc508662f79a86282b67b89d948
SSDEEP 12288:feBNUbTVO86U2roIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszv:fJIU2sIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1AD15CF3BAE28FCE2C2BE4C795691C600E7B674304B62A3CBD175824EDE236E15E75C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 270694f82d47a2836dfa3e6ea9e91a214cf3fc08f25211c8c811cc69b3e2e164
MD5 88b0f8325de8c509f0ed3fd05a20ab42
SHA1 9aba5605cf633c389a5e1d6e23cd0963af964b3c
SHA512 1dc3aba979f9b8552f082cd3ae6cb7598e6ed3010ae88166e0d2b0e863a72a51a71a91f6434fe80f2ab825b446737abecd0d642b6901420c738d895de0f15431
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJo9DN5JVNRV3TH4:XQvGAdlCEL8c/oRNx5C5zYw
TLSH
T150366C656BF880F5E1A7E138897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 221804449228bd849172d9b9d80db59ddf294993b3d95d02686b24c06985fc14
MD5 d0e0ffb6bf027c852bd52d5caf0e8735
SHA1 4bb9970b5c65734353df6ecc4eb6d3061352502f
SHA512 35b04ab4c50c0dee4fcfd265a6786b6d2cacf99800ae23aefeb1436b67df75929b2485ad46bd7bd62d3a99fc95592a5ba58e0b0c4c4164f9e436f4d80a578c38
SSDEEP 12288:u3wSfxL/2Dc3bDLLmt0LDQewsAjDroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVJ:UmewsAjDsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T10A15E031FE75D436C7BF0CB21B26D716687CB9204B961AC7E3E84E8D59202D22772A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 4.8MB
SHA256 99e2b0402b16e481a2001372d8be00d78dcd09f8b9ec5aef5e66b8af08bb7e54
MD5 10f2569f511c4c63c464d757c8b8e540
SHA1 5f697f800df15d2783d964a475de6deb638dd881
SHA512 149d39938e5e570f821914fe1c286cc2564e3b6d13b638ac023ace61dd8763079ed8dc204f14cb38149ffd05ec4bbb999f62bbaf2b443d3c49ce359e5f889de4
SSDEEP 49152:yYVCPaBGkaXESCMBB7bu+zQ6zFZcDYObMOpTKd6z0EEQ86fHxq455QJ7R9+Ju6aJ:pVJ3MXEJqyQdetVw
TLSH
T14E368D9657B801FAD56BE088C79B8537FBF078050534AB9B86B1CB5B2F37A31592E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bbe510c78a9190bbc2746ac5230b4e5e56ece936c6c0dafb418a87e6c8864473
MD5 ca25699a74280f15a9ac168a416e6a80
SHA1 901165f3e25dcd1bd2ebcdac4aa213555e75329e
SHA512 223532481d8ca4364b63302758cd037c827f97a666c63f8ba833f90b63e9460f4cef8907ce7fc55abb8222c93ea113461f2df11c1c6142a6bece8b4bba788efc
SSDEEP 49152:3qLRquA/m2yL5zMfFiV+XenmE3/z1Pzqvw:Yoq1Vjnm8zYw
TLSH
T169D58D1976B8C2E4D1F6C37886A2C647F37178154B35A7EF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4f2daddc0ead0e454b04f0239d06b5e3a2be6361ae8b3696dc0bdccd4b860608
MD5 715b90e2957e5efb33d15e69318460d1
SHA1 35f4612e83d8ad2a042af7e716b5062d07bfd179
SHA512 7e4f7435d574f46055464f5d9bcc3de22973bd876cc84a8ab6dc3e036e330f38e8ee2981ec2e2a2679602174b17ed35479cc4b7a112b489bd8d66081ef6c553f
SSDEEP 24576:BAhGLvrFoiwtA5l7S53NsIGbIjdK8Y1NNz4jSXxpne8:BAMvFoiq59Pzqvw
TLSH
T18045AD81EBF945D4F5F3AA7899B69570EA76BCA65E31C20F2160D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 cb6ef48c47073bbd49ba4877b39eeb251e126e1ea926bbd376e41a30c66148e2
MD5 dd54679d5824763b5f050c0adb106ff1
SHA1 e8ce980780be790782a2b6f020182c3b212e71a8
SHA512 1373311952628890f1f7f07ff84f8270d598f10f7ae928e9ae0181f80ddc247828acb964f23cf5ddc66b41b9d19d91fb4fe6f0055f854c95596404b5b90ecb7b
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CwTroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSReR:Owu+OWRTsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1E605014637A50CF9EAA741398297D535F7F2B8122B25D71F03A0CA5B6F33321AE29750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 aed5095f2e5c5814273bb62be344dd49b5d9cb47af4bbdd2ad45f46df9b7bea9
MD5 b9436c75ffc5a70772214e1e9da7003a
SHA1 8668521d482b29bb28437b2d7ce22bcf53c9326d
SHA512 66f18e8164f18f3075ad877ead4a6c8e7d2ea465ea7bdf0329ac4feab0262468af158416025f77827a55a45ead1b5cf2ab0a00fbfd456b64b97f8a660d2f08b6
SSDEEP 12288:HeQ1IsHroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:+QuEsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T117E4139637B128FAE6F74139C5E29A04EBB57023277B83CF06A40AD96F227D15E31351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 4.6MB
SHA256 a27bb0239a6eaec3ac485a151f4fba2c16ada8b12d2cba62f4f7d5b3f0bcbd79
MD5 cae735158dee5efe15d0848817e8dc5f
SHA1 f62cb44a148db8fe48316243a76edebbf11cb4f7
SHA512 36cfc0d320513fbc5ff0735b00322a914f21241da044214b2d709608cfc2200b1b854d4e445ab67cc9811f9181890aca920a68ad93c0d673e38704dc17915ecf
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UH:FQRQyi36YOcP8Lvw2gA8
TLSH
T13D265B53E3A511F8D41ECCB4476DA522E969748A4734A3DF0AE84B221677ED87B3CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 4.4MB
SHA256 1906ad663ef067e89adb7242c04643d19af5ed74dbac28b06cfd276f3957c450
MD5 5c16012c4b4941924a59fc9aa3bc3224
SHA1 fa807701b4f061ce0c7ee6f107fb9fd71274b55f
SHA512 1707c85da625502072ab6388a70e451dbf5370fe807fd9c071a148735e4905d8001721557b5c353ecf395c5837ac3620e8fc8c4b2ec39773b868ecf56349ade5
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uf:FQRQyi36YOcP8Lvw2gA8
TLSH
T13A265B53F3A511F8D41ECCB4476DA522E969748A4734A3DF0AE84A321677ED86B3CF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ea8f69d2db2f8010f0f151e665629b7e82bb7c4793c77d34044c801eb246480
MD5 f6a0e4a1f5fd2986714f81da13dd710d
SHA1 0cb65cfc2d4bc3fd828ed3730aec4f96ff96d974
SHA512 bf4fd4235ebf61ea0aff14a59f832b1a2b3435cadb36607d31284115fe50cd0e2f559b896c2c8ca2223b41724a649856c5c3fccad5cae297b1d6797e66e99e3e
SSDEEP 24576:wwvXNf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL05sIGbIjdK8Y1NNr:368Qg55nhMeWu7PNU3/cPzqvw
TLSH
T1B6B55A33B2F200A9C44DD1769F4A973196E17C718FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1564a2f9f92dee564948bb47588ffe71a0595531d975a4c1eada3c1005adfe33
MD5 b84ddefbb4e8287b2dfa134b88d7a6bc
SHA1 7d77caee13247c14a607bdb8f43d31ba6c1d2527
SHA512 ed5022d73e6b92ed991869e3c9e1a31b8458c99a30b266a025695e99ec7048527ebb481779a004de6e9cbc41d6ee1111513edd5ddc0876fabad02558ada7d7f4
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99B:iy5112gYy5azzVv569nLKnhZqzYw
TLSH
T1C3167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e8c3fc72a24b7a81f72ad2e16e3fe33df929e79081fba8b722978b83e19f718a
MD5 a79737ce1b8d55cf6c1f231595361b9d
SHA1 86c66257857bbe1d671f6b3a9e4711fc9a8c8b69
SHA512 604900597e733790bba693dd0de3c9d853b1e02c79cc20777db5ef0876f6b2c5e46aa3a5444d0b561a632421ec6777e13578e1852779d4e9d455b7da57c808e3
SSDEEP 49152:2B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl4Pzqvw:Eu6JmTxd2dizYw
TLSH
T167D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a4c38089f5cba03b5cd4c9ecb0095673304148ecf38757d3b0b88015eab9a8f
MD5 112275ff89be46be07a426fc654b81b7
SHA1 1162213b67ef8e9384db0bfffdfee86f2d31acde
SHA512 0c2eb9cfc0eeb1b6bd95bfb865cab865def05dbfa5207cd67d9223a17e5fda96fa918abbd5e8ce56ead6dac3e4220bf0b3af65ca9d0d2d081a02636a559c856a
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xa2UAZhBUKFvp2NvbKVDD:hmifPbRrAZ0ZvbKVD
TLSH
T1BBB5AD13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4ce8b58e8b95dab0b5c47b74d0af53a222b94aa2b60817a9e00f9d8b9e59fe38
MD5 575e407cd629240459175521db0aed49
SHA1 09befcc6b95c7464f50c7015162f56f73fb35df3
SHA512 364d3648e3058455ba8012215f3a4267fbffbca483ee98ef7bfd13f6e7919c33d3b8aa930dd0551930626cdfa689cb7adee424b43be08b785b9338868d989cc3
SSDEEP 49152:5SuZQIY0Be2K6RVtOnks6NMHqn2UAZhBUKFvp2NvbKVDD:X5dKoi61bAZ0ZvbKVD
TLSH
T15BC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a27bfa10aa7ac615f0ab61e6e6a28b73e3a1a746bb3acbd4fe0cc1db4900ca8b
MD5 4232fc25de34cf42000d85ee300f31ca
SHA1 dc8bc8286f8fbed0783ac78a52414b71f467e8cc
SHA512 9ba7352a96b299942dae3a9d112b3c7349f7692a049caa40e4ef1f41709e8cea1be8151d1ccacb37428c6bb7e4524f669328af73c8271c964a7caf650cfe4d31
SSDEEP 49152:BbQSn8EApI0figTgiDn0AP5wV2UAZhBUKFvp2NvbKVDD:HX2iyphkAZ0ZvbKVD
TLSH
T104A5BE13F2D901E8D06ED178C7468632EA62BC150B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 2b87da55e5a0431d481e6b3b832ea5b4297ad4197879ddb483bf1ea1f2bd22c9
MD5 7280209b13028f7dc7e828704dbc0ec1
SHA1 260cb339fe88a61202fd572ac3f2ebd47f540ec4
SHA512 399f728b35c2d1822b58004571d147269561b4e7608d05c5600ed334f53915612fdad71bc5b842c61884630ae61171e3d71830695abad939fdaea23290601f5a
SSDEEP 12288:iQArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:iQArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T17BD4238AA4A9C3CBF5FF1B758F4030D4CFA7F8245365516C9BB1A18908C4BA05EF56AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 2840009d49c4678a55d0f7325efeb295f4887bf536fd7595f8df55f038d1e65c
MD5 1b3574b69fd731627f66cbd73c5265d2
SHA1 bdeda924a53f24f7203b46338f2d5cd696ec5050
SHA512 b7693fa9a8bd993a65ed3f9497dfbb3d19a7f09ed016418564f6bfc4751d3f84120802aff5b35129a98c85617a25241a671fa5f15a336599fbff23a2c2e11276
SSDEEP 12288:geArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:geArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T127D4238AA4A9C3C7F5FF1A748F4030D4CFA7F8245365516C9BB1A5C908C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 4801701e23a0b803bdc00da8fec2a43d66e69f4b48df1a3e402d05044411727a
MD5 01f773cc285129008ec5dba6f60efdb1
SHA1 a167716b0e141ef90daee4619c6085b2ac267574
SHA512 f8ecf596a69012dee834cbe6acf92c7f253d1674b18252a4c0bd12a937b4eb83a28fc047fb240ff6bc4160453d59631f1ad46d4fb8ff4b50ac2002685f8420cb
SSDEEP 12288:mEPJArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:mOJArBmAZhgc9ig4zwLDtvge2NvW+K0s
TLSH
T1F2D4238AA4A9C3CBF5FF1B744F4030D4CFA7F8245365515C9BB1A18508C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 e1885c4bbc6ad176641cf3649438acea623fd661a123c22aeae4a0f3eaa9a0a7
MD5 9e9c9ea0b35f664c90fb076b51385644
SHA1 c6eb923cc35418c9241be388f77f78099c279128
SHA512 974db0a749bd6cae86832909a2a860a57ef2af79f8d65a2e2b1066ac45256be38f22690c6c39ba8e753daf4669d65654746f3a70ff814ccf925c74d94f0b4165
SSDEEP 12288:elsArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:DArBmAZhgc9ig4zwLDtvge2NvW+K0cDD
TLSH
T1FFD4238A65A982C7F4FF6774CF412090DBB6F8648331526F8BB1558A0CD07A09DF5BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 57968e4b3e0da894f41fea90474a55cb9b0c73fe77a79a5f24886693da6d0ae2
MD5 b2bc4cb49549ebbddd08675022bf3206
SHA1 14df055c5ae4d8b80c57ca553102bc85bd430921
SHA512 903749977522cbaad7e590f26c6ece860dfa3a5280be6158353cf5fe15b5ad8fb816f98d28cdf0fd513750af5ba96acde3b08e5a667482a48c380fef90beace3
SSDEEP 12288:14ArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:14ArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T18AD4238AA4A9C3CBF5FF27758F4030D4CF67F8644365516C9BB1A18908C4BA05EF56AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 f073d687c216972f999337206c6b13e4ed24cdd1248362653aaeeffc3648cb47
MD5 07c97ac79dfee66f51a449727be7cb27
SHA1 1fffe196183a7067630e2c7f09069fe134fe8d4f
SHA512 03cfc65d3944b2975d9d0633afa327124095f59ffe14623b934687f0a605e00f148b25759c0b5198dba5184c07b5602837ef2775149b8b2cd02581e59023776c
SSDEEP 12288:2HArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:2HArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T18BD4238AA4A9C3CBF6BF2A748F4030D4CF67F8245365516C9FB1A18508C4BB05EF56AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 3d98bc7126c0e022d5df2bf654955f5e579e2a68628aba0dbb6644e8d1a97dde
MD5 e797004daed34f13f71de27dae17d192
SHA1 f9f692d567d1cacdd1844f01f77ed00c7b774e63
SHA512 26fdaf62af7d7fd977a0abc52f6cacdeb899f0d09746fa0fd92abede47025026c874bb72aeb7361305665a869ebb7604cce04b9c8a2eaec788787f81097c9b10
SSDEEP 12288:BjArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:BjArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T139D4238AA4A9C3CBF6BF26748F4030D4CFA7F8245365516C9FB1A18508C4BB05EF56AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 6fb7d0c7f591d466bee8eb8a1eb4247e689c6dc15375872bce22b69f3335f445
MD5 0700842e0ec5a6b1dad06c7cd119360f
SHA1 3e99319f924a02f0514deb3f80fd2db84d2c632d
SHA512 ca41e1b0b00be69286018be00047a6e54545bcd982c18535c64a523201b2db53913a526c3713c1324aa3974c5f79e923e8714adb2c1e16611c1e36d5b6a06b4a
SSDEEP 24576:BZMuzFVSHMArBmAZhgc9ig4zwLDtvge2NvW+K0cDD:BZMuzfP2UAZhBUKFvp2NvbKVDD
TLSH
T184150195B2A008F9ECA7423ECE155945D6B2BC290770C61F07F4366A0F733A01D7EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 dbea0b54bf794905384228e49d171ec63820c9fdfb115faa2ec31e0e1ac30c98
MD5 e838b6f25052a15d7b7f252f850ab73f
SHA1 cdc9b36e8a94527054377e5c9e9e361d00382e2e
SHA512 c671fd46ce31fed1ef258efd4fec7421205cb42a9a4fe5a82f03d35258ef56242dd93e76340413e010065cc054f7cfc6243bb10296857f8c666d06b5ad1ddb46
SSDEEP 12288:ihCArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:iwArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T1A9D4238AA4A9C2CBF5FF1A748F4030D4CFABF8245365515C9FB5A1C908C4BA05EF56AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 ce3afce2b8e86a86cdba4ee9c5a847e627695d3a937f406931c57c8443ab3d97
MD5 00e4d1e2994ddbae6c4445bc784f6688
SHA1 e153914c4be22dc06294d662d5791552cb37b8fb
SHA512 3ab06d90c4dad9f56ac87ced009dad3cdf21a8db176a8009d392260833946744a905cc4979be29b8f6db6cdd3e8af4b027cab12cde843d24c0cd7564021a919e
SSDEEP 12288:UDArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:UDArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T187D4238BA4A8C3CBF5FF16748F4020D4CFAAF9244365515C9FB2A1D908C4BA05EF56AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 b4d502cfa0eb9c7c662e3633459961706b55ca3a3b463c248a1e30eb3b615973
MD5 35913c68bb07d75c118b66014295e8d0
SHA1 32d5656bd9c3887ad6425e8c146a833130b000cd
SHA512 5e5024d2892a298a870e27fed70a7e8dd6528eb3f153c36e25bb4395143e6436f9ad3c6fc192e77b845dbf362075bd1c9012761868b6699fa2812320041b3de1
SSDEEP 12288:ygPz5LEAArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:tzSAArBmAZhgc9ig4zwLDtvge2NvW+K5
TLSH
T1B8F4124772A531FAE17B5238CE921941F772F83107208A6F57B047BA1E537A09E7AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 0cfa266e9563b8e420f4abfe0d757b4c7560d4f63388f3561d33b352679193be
MD5 2ce47e47240c5c05f327d4f21758a37a
SHA1 4cd22740c47e15b73db033b76b66b91390044970
SHA512 51f4086d2fd8f0059b2e18c94136ef81262859c0ae54051232e63cf7478921edf9f1b3b34b3d11fd31e313cd24504540507a56c10375daf0235892f620c8d034
SSDEEP 12288:a6ArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:a6ArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T117D4238AA4A9C3C7F5FF1A748F4030D4CFA6F8245365515CDFB2A58908C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 f139ac4a67613982a352d52db45225fcaafe32f519fde95e2af9a3ec6ba02145
MD5 a9aabc8f04fb54a5c159851be82952e3
SHA1 a791b8abe1c8dbf07fd7c168cbcfbfdcf8df0dc6
SHA512 a8400516847a42dd6048e497967984bdfa05d27f5b565bd0d237d99233749b17a5c03839fdfd01110c92ba414dcef628540d1a750b96c00cb236aef546e0e571
SSDEEP 12288:CnArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:CnArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T1ADD4238AA4A9C3CBF5FF1A704F4030D4CF66F8245365516CDFB2A58908C4BA45EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 a1ce51931ffe6d8083d0e529a4dd4a19737abb9cb3dc9ec5a8b566a70509ee2c
MD5 ec44a0efb7d1d998f2e024aba91ac0fd
SHA1 0930b1f40b16e9e7448141e2fb5b7abf6833f77b
SHA512 101d53d17f69bcb4a9f58cc8980d515067125b68a54f7873057fe73793898c1c7d7888b05ee7a3efc0147fd49379cce0db97bd377e42359d8730e718c729a4c1
SSDEEP 12288:rgPz5LE5cArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:szS5cArBmAZhgc9ig4zwLDtvge2NvW+e
TLSH
T15DF4124772A531FAE17B5238CE521941F772F83107208AAF57B047BA1E537A09E7AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 9be745aee7d02adaa46d3f59cc1fbf60ae7080bfad423cb0e8d8bdf4d2044cef
MD5 1ba9d8019d40021e51dfcef8ad205ba4
SHA1 50f83c5aba3b8f923adff659bf0cf23802e15156
SHA512 f784b82bad1d6b732804f1984dc799ad066e32596a1638218d0d2cb79d467d4e2414877c3626054263d0058899dc1027a654f3dfa17db3108ba69dfdc878901e
SSDEEP 24576:cTVaLl3z0zIfArBmAZhgc9ig4zwLDtvge2NvW+K0cDD:cTYLljp2UAZhBUKFvp2NvbKVDD
TLSH
T1D7150195B3A058F9ECA7423ECD155946D6B2BC290770C61F03B4366A0F733A01D7EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 f5c3de465697f48a773301ddc026e35367d1dfa00ef53363fdf185f9e71eebff
MD5 4ea75267b3c93715b22209a16b61214b
SHA1 990bbfcb87435910f1cb87161a85e9cee71810b0
SHA512 c318b2ca7f8f7c4e208e9eac69e7cbdf51684bcbe8915245a2fbf66f198a067e373c6dd723b26b2d19241b03e2b7150e8de7a8d0b6026199325068c26dc27e04
SSDEEP 24576:F3odWCHKy7lRsArBmAZhgc9ig4zwLDtvge2NvW+K0cDD:lodWCHKyhS2UAZhBUKFvp2NvbKVDD
TLSH
T16B35DF90F3E810E9F0B79A358D765511DAB6BC591B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 62da31d5e54d25c784ff06151d14b8ab277ec8bef0c48f8351d6ddc0b5bbcb64
MD5 15d176584ea660f61b5f9166577bd7e7
SHA1 29cf65248c18e3683f2d9f958bb162a7edef28bf
SHA512 a5f88e6cf2f93b9e8d9d76b47e4d13172d68392b99943ca8a4277c88ba250ac4b1d6f1e9794116c2b86974b74b65ce7bbb1a9fa96072fcf22ac19b6fef03bc0c
SSDEEP 12288:E2gArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:E2gArBmAZhgc9ig4zwLDtvge2NvW+K0s
TLSH
T193D4238AA4A9C3C7F5FF1A708F4530D4CF67F8245365516CDBB2A18908C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 cc13a4dad74f01a42062cafa247b976157ea213fa6ce769f5f2fa9aa98367dc3
MD5 240c0bb5f8d2ee5503cff2377a42eae7
SHA1 5b96a64de95de89129a710eb683e812dcb82e0a1
SHA512 319629ff078e1f259fb346f16afe56a9fcad140b30eeb4978de9a9ac1d7a3bec35429f5021eaa4e18c673eb9df1130a9fc7035a7a8fede86f9668f2a61eb40ac
SSDEEP 12288:4IArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:4IArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T1B8D4238AA8A8C3CBF5FF16704F4120D4CFABF8244375516C9FB1A58508C4BA05EF66AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 f94071a48c23a557644008b9367076b56fbdd36436470e918bc52ecb7c325043
MD5 e177467af02f14702c3be254cc74f513
SHA1 dcdc1c6db16f9e6b7d279ae2529a86e682c3099d
SHA512 84edf7869391165709fde0826b86844225af3639d2c9e0dbacac060eedac9166b50bf6785573e7c3b503464db1f4857343db4b6167cae62176814c0851425ad1
SSDEEP 12288:TTBArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:TTBArBmAZhgc9ig4zwLDtvge2NvW+K0s
TLSH
T13CD4238BA4A9C3C7F5FF1A708F4020D4CFA6F8645365515CDBB2A58508C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 38652178d0f36eb9b82a743501c75e9d673b569192a6e0570da035b7281848c7
MD5 dc0ddde3fef1f89c6bd34659d344d253
SHA1 f170cc430035e92a674871c54d6e71cce269257a
SHA512 2744ad46bcde3c0d1dfe3b53cee459aec9102a29d42a09c25b0023349a0f0aa73808169c66529a94a48626e977b22e462a85a67d3ab8b66e0e853670c1f1602d
SSDEEP 12288:kwArocmAZcw5techDE/Gig4lxP6/LDtvY9e2RXZVW+KDiS7qcDD:kwArBmAZhgc9ig4zwLDtvge2NvW+K0cH
TLSH
T12DD4238BA4A9C3C7F5FF1A704F4120D4CFA6F8245365516CDFB2A58908C4BA05EF66AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 43d2146f225608b94f8a481b6a55bbb9af4257a40663f5b7670810ceb77e50ad
MD5 6274b6425de2fcf617d22c9cc4809e28
SHA1 736a913bcb16a27e6a53d91658e1c393ed9a84e8
SHA512 9eef27ce7f6ad99844b2a756f5a8916ef3007b691ed1d40bab0990331081a26b4b97321c7e85a7e9b2f9404b9dd4f09dfbc8fb85dbb49b41f486c96faabbf2c5
SSDEEP 12288:fWVfVroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:2VsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1BAF4F05AE26406E9C1AE5136C3929A00F77B7C2197E6D3CF12D0F87E1F352906EE5683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 3ccee1fb2007a9fb63cb00c370dc8f7c9d5a780780ef0e4379c70a9529167e9f
MD5 2d326477d650f89c3872968c0e68811a
SHA1 8664c7b024e5a30a7120e841a9faa12790d6fb1f
SHA512 3cb02c5ae90e563b6c3a6b3fbff124fa9f341cea5e07c571205ec68280de2aa5ca347b7ccfa4d79d984cd2db5a04153051293a16d403c8e8eff370081ae2816b
SSDEEP 12288:cs78roIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:Z8sIGbIjdK8Y1NNz4jSXxpne8
TLSH
T159D423726B364DB7FAFA003142D7E618FABDB1315B8ED1CF52981DC8A8207956F70489
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 04e66e79c7143d584482b02c5c8028f3b2ff4f5fe323dafb5d485703803ee5e5
MD5 36921415c22b72ee3626725c260f6ba0
SHA1 cc828eba5f95f1fd1b13881c685b6351fac8f28d
SHA512 7a369f0bebf02218e8b80b52ac940a5346ef3f406555336c773461241be38dd8a30696c8cf5bd6f8856d4ab8a4bf3d687173a60feac9858f82436039cda9921c
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYWsIGbIjdK8Y1NNz4jSXxpne8:bgb4mBIBhGFlPzqvw
TLSH
T1F565AE1E22EC02F5E1FAD2B8CDA64417D6B278160732D2DF1251426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 8c899665ad32eced213c3e7ebd62e0ec97b8f6216be61dc6d8f15e00f2a589de
MD5 883aed4d2070c82565a04e2cc2d35672
SHA1 599a1f90249e79cc90698178dadba060af1c92d9
SHA512 0d43f2618ce16cd8f4fc30e7288f2d19f85cf74c7ddb92d788ff5f4f476828f1b9633ff324dc5b500819e3b04ede8d6d3d2204d0b9e4f50c20c136b99fa800a8
SSDEEP 12288:LDGOroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:PGOsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T17FE423793AB26DF9CAFA813581A2A515F9B87031575E62EF05E418B8DF147E07B30CC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d0cf175e88494699472b0691504e148d949191eb5b0a00c2dda96d98cab7e068
MD5 b715d449e6d8dd7037027e53764b40c4
SHA1 3ea06676a4b67d0cfdf1b22e40444e300dc42211
SHA512 d487b485e322b350fcbbc4c23ec712926dad78bf295f60d85706866345ea24c69f9929d3671383495cc0c1ab633722b6fe0d327def0b1a97b29155264f2d3ff2
SSDEEP 12288:iNroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:iNsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T19AD423A13A324DB7EBE600364293E918FABC913257DF92CF52E92CC598143E56F714C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 95cf46c94446aae420216198116f763680a4e7571dca40d4a95a3df87d0db2c1
MD5 d2f1c7803b75dbd21ef763b4bd04fe82
SHA1 ab73d02e2053931b69a0229ada19d9ded42cb2b6
SHA512 401bb37220f9faec30d7d7398fcafa7f0baea657e0271a6ab0464709bcfcbf1a83f157fbe768e70126d1d16f17c36dd80e30ae58d3a157d99757d5971fe34c34
SSDEEP 24576:UjM8Q8FaJqH12zria7/mqcsIGbIjdK8Y1NNz4jSXxpne8:GrPF2qVBa7/2Pzqvw
TLSH
T1E435016577E105F1D4BBD1388A824663F6B2B4210364EBDF07AC8A951F23BE50B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 012c42ab848ea6a5d016b88d5516019059856605667ebcd8efb44ec72acc854e
MD5 90747c893d449ad4173308ec8d5d116c
SHA1 46d62541fbd38da306820a11ce523c8b19884737
SHA512 b0f343f0575028ecf8e10e93f05d52d4d2003adf295e6efc09637757bad650d9fcb32e316a3ba733b4efc0cad5b17a97493f08c9d4a780953965f44729a89f04
SSDEEP 12288:bHvUrBFrEjwaQQroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnsj:bPUr+NQQsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1BD05F22F36A91CE5E67AA13D8582870DF771B4621756D2CF02E0417E5F23AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3ed80b4db24df51fb378004512eedfdf7c8ef8105f6c7d3852318d0625d54848
MD5 c6d7160a638c7f63d2edb2524a5fbb6a
SHA1 2e1a71f118288d6a3965dc6e01a7a3cfdfe43820
SHA512 addee1213ba94ffbb5dd453c9e244ca80e6135eef50912de3f3ce762dacff8ddfa35ad868716fcd697b2c1f187a9d1349049f02a93f1c0584ea00ccdf3ac2e2c
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzPzqvw:5G05lO43bAzYw
TLSH
T1EBD5C06A62EC11F9D1BBC17CDAC64A0BEBB23425033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 162f96209ec5b210920f7bbea7f041de977324e98821a4615d72f24f4c15d9ca
MD5 87dd7005f7dd3b519ce640a4ca7f284e
SHA1 26ae40cab2725c396f4ef7ba46ca553688784ba7
SHA512 ff21acd09cd1c8651a8da9fb9a5c6ecbefbf6e3890c831790bd3e6f7d261dd9c2ac7c779c40badbfab2337f1cb04693beb4975aebf5bf1f5c018d465c1e20bfc
SSDEEP 24576:bXa5POZ3dpbWVM50JicR2hG0lasx2+47eidnZEv1KewSLPdvtxcYPNbBL1R:ra5POZ3wJt2pasx2+m3EMehdFx9bBL
TLSH
T15865BF5EA6FC00D5D179D17DC5834A1AE5B1346153329BCB122182BE3F2BEF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b8c82386ed7933a9705a6d53e647162f41dbf9d663a3d3b3b98602d8d6a6a8b8
MD5 5ffad596516110fd3bd95e4d7e4647ad
SHA1 f28685e195d821e46209547b33134673f9ec5201
SHA512 ed8707a678bcf71941f1fb28509fa03161195ce1788f133a4939983efb76c330fb0345d6decc17559b1cd06aa5965fb148021c1faa53210c3586a8c3304c4c06
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkdlsIGbIjdK8Y1NNz4jSXxpne8:5Nc/zEOVHFulPzqvw
TLSH
T119858B2623E901E4F1BBE1BE89679546FAB17865133486CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 beb67b3ad72b7f4f0cc44f024834553f6b478ae1be1e02c540d4f5ac3b85dfdf
MD5 e74e0f71784c23a5c4d2ede69c69f4ea
SHA1 55c2247e96240df5c52d65feeed56d556ae1425d
SHA512 865e4d38d348fc5a2e16b1c53139ddb5bbc417317769e4744941d2578e84e545ab2c7ff87f83c85fe080c9d8523197e3b878dd1ba0f37a2405404a4decc0a34b
SSDEEP 24576:kJnJPbzB4SSsIGbIjdK8Y1NNz4jSXxpne8:kJnJv6SSPzqvw
TLSH
T19C15DF3DD2A810E9E4B7C274815A1A59FF71347D2B2669CB19B4D4343F12FE0AA79F08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 d55356e9a4bc134d44c2a7e74039cb2e2848b1ea6c0f782c87cd7c6429dd11f5
MD5 6199be9ecb04da4b2270ca1a00334344
SHA1 37cfe5bd3362ac565d8d2e3317a4b05856b2e794
SHA512 85d6146554c0fd8ed800a4eabb126f9df91637a8673ed50b2b9106c9cdea4d6d00b288a67a8d941960f5930d1c3d4bb652280aefbaaef40558e1731e13f45c0e
SSDEEP 24576:BCLHGL0MoeVtFumTijCmlKQWDkGsIGbIjdK8Y1NNz4jSXxpne8:BCLHGeeV5ijCmlDWDkGPzqvw
TLSH
T123A56B05A7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 0ee43303188cb4970e0a1f0a3b5fdea64841ef93a21c5f9cea5baf8ac934f3a5
MD5 6ee80a5da64c5fb16bb4ccd0f8da51ba
SHA1 6bfc57f511e7ac3d3fe219131b253f77b2114037
SHA512 0a685fdb5e007923093ad911e7bd52e847c20605650875efaba174dabcfbdbccc9b6d18352d32e147f5800f41f5f6e827962b0b4c3692d5cd5acf8d78e2b0ac5
SSDEEP 12288:1+Hck6j5ZI7droIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJl:W6DIpsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1EBF4015D337604FAD1BBC03E82834501E6B6B071875656DF07D889BD9EA3ED8BA38D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 2e30e3b81e6de450e8e7f68af57d0f838d7351fb6b9715a05bb9373b3ede9e89
MD5 5aa557bb24601df0e9c28fa320d7386d
SHA1 f800710653b15db3468654abced4cb375fcd8e75
SHA512 d959a89290e53f1bc29faa284768c67ec5ccaed506c69caad258dc8c95dd0f50ab7f30684e941b0c14543e430b75834aba2ea8d393f7618efec34ad7bc41a579
SSDEEP 12288:ZG6kyProIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:QtyPsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T15FF4225127A45CE6EBFA013482A39254EF7CB8305B5693DF12E06A6E6F317E07E30B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 6e0364fb1b5ef50ddbe4ff926255c5a342a156064a2a6429e257b5dbb7e6f700
MD5 86a89e1ddeb1155842be8586208fbda5
SHA1 5f888fceae128355cf3539e62672c71dc1b2bfe1
SHA512 8033036ffcf0dde14d61336247afc024a2276f7e47c30d8879a705d745184d9d55539e3813dea9367c675fd05e622e4e7813e74963e6aec3437fff74e6585e92
SSDEEP 12288:53TroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zVSN:xTsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T1F2D423B93B325DBADAE900364293AA18F6BC70311B9F92DF55E91DE4D9143E12F708C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 3c3dc4542a284fa1b8d9e3a6142a2ad52a053dcf1be243a44e12ecff4003c405
MD5 78d16d3458f8af37b265aeb44a5b4cb3
SHA1 5c492eb0e6356437231e93014eed54a221da119a
SHA512 8be3d7a296d7a306d96107065989d92e7a1e04e056a9576dee4df3b3789962fd4188113dd4096ae847d7831451182e609b0fb8b2f1bd940b68711f35724459e4
SSDEEP 24576:hogG5oTfaidZ1sIGbIjdK8Y1NNz4jSXxpne8:qgPTrZ1Pzqvw
TLSH
T100559C1D77EA09DAE2B2D235D8625493D633B4311772D6CF2488C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 1f76370b41f9c4b560c25c5339c53348185c8d8d1c64511551b68623221cda70
MD5 f46ba46a5406933bb01ac97a2b008e22
SHA1 1499f586272efb49ee6ba758fb42ce2d262499e9
SHA512 f69d731462999ae203c9bd686766dc8918ec60729c6a2c0323f3fe084a5d4ad37cd313c76591972e1ff496da328424f43fb3eedda77ffeee81e4bceac66923b6
SSDEEP 12288:FpJcm8CNcroIBS9UM+hFEwm4CwKuj/la1HTxN5quP1mVjSRefMx7gStpnszJu5zi:FrcmRcsIGbIjdK8Y1NNz4jSXxpne8
TLSH
T12D05F15EB76A04F6E2B7813C89828615F6B37031275263DF02E18BBD4E176E97E34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 d80fda3e6ea33c5cd45ea40963b5707f1f23518693e0637f6c60f743058bceae
MD5 b992dc711e46071afdd29bb2ddc78d82
SHA1 1bffb7c1f9afc0b8997c6d0f874cb3228dfd1c22
SHA512 abfe008bdf40668a02656f151bdb1a178aeb68824085d07b4f26d7f7ec4cac9a8e080c692dbd52fdf10d6250e891221ed334bb56eaeec8f7fa0c07b6b5d319df
SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3hPzqvw:G3Upow8sBizYw
TLSH
T137A58C3DA2E800A8D9AAC379C54213A5EA71742E3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-322-0x000002FEE7550000-0x000002FEE75B6000-memory.dmp

Download

memory/200-324-0x000002FEE7550000-0x000002FEE75B6000-memory.dmp

Download

memory/200-421-0x00007FF71CD90000-0x00007FF71D032000-memory.dmp

Download

memory/200-323-0x00007FF71CD90000-0x00007FF71D032000-memory.dmp

Download

memory/256-37-0x00000273B5000000-0x00000273B511C000-memory.dmp

Download

memory/256-40-0x00000273B51F0000-0x00000273B5256000-memory.dmp

Download

memory/256-39-0x00000273B51F0000-0x00000273B5256000-memory.dmp

Download

memory/256-38-0x00000273B51F0000-0x00000273B5256000-memory.dmp

Download

memory/1220-15-0x00007FF68DF30000-0x00007FF68E052000-memory.dmp

Download

memory/1220-16-0x000002351E550000-0x000002351E5B6000-memory.dmp

Download

memory/1220-18-0x000002351E550000-0x000002351E5B6000-memory.dmp

Download

memory/1220-17-0x000002351E550000-0x000002351E5B6000-memory.dmp

Download

memory/1220-64-0x00007FF68DF30000-0x00007FF68E052000-memory.dmp

Download

memory/1264-266-0x0000020715280000-0x00000207152E6000-memory.dmp

Download

memory/1264-267-0x0000020715280000-0x00000207152E6000-memory.dmp

Download

memory/1264-264-0x00007FF698B40000-0x00007FF698C89000-memory.dmp

Download

memory/1264-351-0x00007FF698B40000-0x00007FF698C89000-memory.dmp

Download

memory/1372-46-0x00007FF72A2D0000-0x00007FF72A437000-memory.dmp

Download

memory/1372-47-0x000002003D4A0000-0x000002003D506000-memory.dmp

Download

memory/1372-53-0x000002003D4A0000-0x000002003D506000-memory.dmp

Download

memory/1372-48-0x000002003D4A0000-0x000002003D506000-memory.dmp

Download

memory/1372-55-0x00007FF72A2D0000-0x00007FF72A437000-memory.dmp

Download

memory/1552-30-0x0000021B93640000-0x0000021B936A6000-memory.dmp

Download

memory/1552-29-0x0000021B93640000-0x0000021B936A6000-memory.dmp

Download

memory/1552-28-0x0000021B93710000-0x0000021B9382C000-memory.dmp

Download

memory/1552-31-0x0000021B93640000-0x0000021B936A6000-memory.dmp

Download

memory/2108-361-0x0000028F488C0000-0x0000028F48926000-memory.dmp

Download

memory/2108-448-0x00007FF7C8E60000-0x00007FF7C9330000-memory.dmp

Download

memory/2108-363-0x0000028F488C0000-0x0000028F48926000-memory.dmp

Download

memory/2108-362-0x00007FF7C8E60000-0x00007FF7C9330000-memory.dmp

Download

memory/2380-7-0x0000000002EE0000-0x0000000002F49000-memory.dmp

Download

memory/2380-6-0x0000000002EE0000-0x0000000002F49000-memory.dmp

Download

memory/2380-0-0x0000000002CA0000-0x0000000002D65000-memory.dmp

Download

memory/2380-1-0x0000000002EE0000-0x0000000002F49000-memory.dmp

Download

memory/2884-333-0x000001EC34FD0000-0x000001EC35036000-memory.dmp

Download

memory/2884-432-0x00007FF6BF860000-0x00007FF6BF9F4000-memory.dmp

Download

memory/2884-331-0x00007FF6BF860000-0x00007FF6BF9F4000-memory.dmp

Download

memory/2884-332-0x000001EC34FD0000-0x000001EC35036000-memory.dmp

Download

memory/3024-447-0x00007FF7AE910000-0x00007FF7AEB9A000-memory.dmp

Download

memory/3024-354-0x0000019EAF040000-0x0000019EAF0A6000-memory.dmp

Download

memory/3024-353-0x0000019EAF040000-0x0000019EAF0A6000-memory.dmp

Download

memory/3024-352-0x00007FF7AE910000-0x00007FF7AEB9A000-memory.dmp

Download

memory/3208-330-0x00007FF795A80000-0x00007FF795B48000-memory.dmp

Download

memory/3208-244-0x00007FF795A80000-0x00007FF795B48000-memory.dmp

Download

memory/3208-246-0x000001B79CFC0000-0x000001B79D026000-memory.dmp

Download

memory/3208-245-0x000001B79CFC0000-0x000001B79D026000-memory.dmp

Download

memory/3244-408-0x00007FF6D62D0000-0x00007FF6D6383000-memory.dmp

Download

memory/3244-312-0x0000022B669C0000-0x0000022B66A26000-memory.dmp

Download

memory/3244-313-0x0000022B669C0000-0x0000022B66A26000-memory.dmp

Download

memory/3244-311-0x00007FF6D62D0000-0x00007FF6D6383000-memory.dmp

Download

memory/3548-252-0x00007FF7112B0000-0x00007FF7113C9000-memory.dmp

Download

memory/3548-254-0x000001E9C60E0000-0x000001E9C6146000-memory.dmp

Download

memory/3548-253-0x000001E9C60E0000-0x000001E9C6146000-memory.dmp

Download

memory/3548-339-0x00007FF7112B0000-0x00007FF7113C9000-memory.dmp

Download

memory/3876-360-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3876-279-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/3876-274-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/3876-273-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4628-369-0x000001DC32850000-0x000001DC328B6000-memory.dmp

Download

memory/4628-449-0x00007FF77DAD0000-0x00007FF77DFD6000-memory.dmp

Download

memory/4628-374-0x00007FF77DAD0000-0x00007FF77DFD6000-memory.dmp

Download

memory/4628-370-0x000001DC32850000-0x000001DC328B6000-memory.dmp

Download

memory/4692-60-0x00000201DA6F0000-0x00000201DA756000-memory.dmp

Download

memory/4692-59-0x00000201DA6F0000-0x00000201DA756000-memory.dmp

Download

memory/4692-58-0x00000201DA7A0000-0x00000201DA8BC000-memory.dmp

Download

memory/4816-441-0x0000026776470000-0x00000267764D6000-memory.dmp

Download

memory/4816-389-0x00007FF6B0560000-0x00007FF6B0976000-memory.dmp

Download

memory/4816-443-0x00007FF6B0560000-0x00007FF6B0976000-memory.dmp

Download

memory/4816-304-0x0000026776470000-0x00000267764D6000-memory.dmp

Download

memory/4816-303-0x00007FF6B0560000-0x00007FF6B0976000-memory.dmp

Download

memory/4816-302-0x0000026776470000-0x00000267764D6000-memory.dmp

Download

memory/4864-293-0x00007FF6E2130000-0x00007FF6E21DD000-memory.dmp

Download

memory/4864-379-0x00007FF6E2130000-0x00007FF6E21DD000-memory.dmp

Download

memory/4864-295-0x00000199459C0000-0x0000019945A26000-memory.dmp

Download

memory/4864-294-0x00000199459C0000-0x0000019945A26000-memory.dmp

Download

memory/5300-450-0x00007FF652460000-0x00007FF65258E000-memory.dmp

Download

memory/5300-381-0x000002662C650000-0x000002662C6B6000-memory.dmp

Download

memory/5300-382-0x000002662C650000-0x000002662C6B6000-memory.dmp

Download

memory/5300-380-0x00007FF652460000-0x00007FF65258E000-memory.dmp

Download

memory/5532-375-0x00007FF7F51D0000-0x00007FF7F5913000-memory.dmp

Download

memory/5532-286-0x000001D571CD0000-0x000001D571D36000-memory.dmp

Download

memory/5532-287-0x000001D571CD0000-0x000001D571D36000-memory.dmp

Download

memory/5532-285-0x00007FF7F51D0000-0x00007FF7F5913000-memory.dmp

Download

memory/5884-392-0x00007FF63E0C0000-0x00007FF63E3FE000-memory.dmp

Download

memory/5884-391-0x0000024E5BF10000-0x0000024E5BF76000-memory.dmp

Download

memory/5884-390-0x0000024E5BF10000-0x0000024E5BF76000-memory.dmp

Download

memory/5940-237-0x0000028E9FEA0000-0x0000028E9FF06000-memory.dmp

Download

memory/5940-320-0x00007FF795A80000-0x00007FF795B48000-memory.dmp

Download

memory/5940-235-0x00007FF795A80000-0x00007FF795B48000-memory.dmp

Download

memory/5940-236-0x0000028E9FEA0000-0x0000028E9FF06000-memory.dmp

Download

memory/6120-341-0x0000020F5CC30000-0x0000020F5CC96000-memory.dmp

Download

memory/6120-340-0x0000020F5CC30000-0x0000020F5CC96000-memory.dmp

Download

memory/6120-345-0x00007FF6482F0000-0x00007FF648610000-memory.dmp

Download

memory/6120-346-0x0000020F5CC30000-0x0000020F5CC96000-memory.dmp

Download

memory/6120-348-0x00007FF6482F0000-0x00007FF648610000-memory.dmp

Download