2251b2217aee40e2c16ceb7476153cce46d934acc8691b13c4515755a002c1ac

Analysis

max time kernel
143s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe
Size 689KB
Sample260820-b9dmesxgrf
SHA256 2251b2217aee40e2c16ceb7476153cce46d934acc8691b13c4515755a002c1ac
MD5 3decaf8b565e47de1540962b03e834a1
SHA1 dacd5f8dcb7f4331be4a38dbc2284bfae812963d
SHA512 1fa2b33883dc27debeca0191358f0ee87e4947732394e16324639491978a3cca7b126ce30902f4ec699cdb98de8831e51a4c4102b89c8f48f84297c7a780fa6c
SSDEEP 12288:DYHqfShxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:sl9ePSfPFB9nLSb6LOD/f/o
TLSH
T104E4125BA38532F9E2A3963885B5511E9333B8760A318B4F5B68065E0F377D18E36F31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3304	alg.exe
1148	elevation_service.exe
4236	elevation_service.exe
4908	maintenanceservice.exe
3352	OSE.EXE
2292	GameInputSvc.exe
2368	GameInputSvc.exe
4736	msdtc.exe
3392	PerceptionSimulationService.exe
1428	perfhost.exe
4580	ReFsDedupSvc.exe
5540	locator.exe
7132	SensorDataService.exe
5888	snmptrap.exe
4944	ssh-agent.exe
4344	TieringEngineService.exe
4948	AgentService.exe
5548	vds.exe
1688	vssvc.exe
6852	wbengine.exe
6828	WmiApSrv.exe
5740	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\47f913b2957eebe4.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	GameInputSvc.exe
2368	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2032	2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe
Token: SeDebugPrivilege	3304	alg.exe
Token: SeDebugPrivilege	3304	alg.exe
Token: SeTakeOwnershipPrivilege	1148	elevation_service.exe
Token: SeTcbPrivilege	2292	GameInputSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4580	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4344	TieringEngineService.exe
Token: SeManageVolumePrivilege	4344	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4948	AgentService.exe
Token: SeBackupPrivilege	1688	vssvc.exe
Token: SeRestorePrivilege	1688	vssvc.exe
Token: SeAuditPrivilege	1688	vssvc.exe
Token: SeBackupPrivilege	6852	wbengine.exe
Token: SeRestorePrivilege	6852	wbengine.exe
Token: SeSecurityPrivilege	6852	wbengine.exe
Token: 33	5740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5740	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2368	2292	GameInputSvc.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3decaf8b565e47de1540962b03e834a1_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4236

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2368

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3392

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5540

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:7132

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4944

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6852

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6828

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:5740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5c6cbb4f74323bd13955c5e2b210774245d9d26dbff7c53c6461f57b471e3d65
MD5 31797ae9ad50bb9dafc71c50b576469a
SHA1 6b1c3ae92e48e773c5e4c8a5e3dad755980b772f
SHA512 b252e8c26d33cc271843aaf6f917b74e14cf0b80d804049c9601f54dfabe5fa5a34627307b1f1175ee7d8172e058b2a76583a24a065da5a9bec92fed5f98a3c7
SSDEEP 49152:Sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnz9gSFjwTb:03q6gjBwgujw
TLSH
T18CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 925e55c44ab4924e745ef7499e95da53c8de56454f7bce0d04efaca590d1f6c4
MD5 0396ad36a734940eeb4c97dc6014d988
SHA1 748a85daaa3bfdad762ac3481a2fe68efce883a9
SHA512 b5ed5beb49e379381775c98eada31132c8aad276d6cdacc35c6d34e5491a027c47ff4d573205aa2c665deb6a7ed89cf5d494cd3f5d81b22299c247ba39a5b025
SSDEEP 12288:01XLsfwWkxy2lRq2czAaxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:SXYIDtczAw9ePSfPFB9nLSb6LOD/f/o
TLSH
T143050228A39109F9ED67823DC9B29016E733B8954760E78F03E499291F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b675e5ad9338d16508c51fa9c3878cff212ab46ecfcdbc301a10a082d9b9b2bb
MD5 35558d96c034bb237b7c7b2f07880bf9
SHA1 d44456c79693e89cfa3389e95b966aeb95f5963e
SHA512 ab93d61e1168c3e58e4b89a60b97918a2ce2d8aba04e2646005dfaef70dcefbe249e62aea6a56710c558fba82edb57c817078b0bd75f961d7d9a7d2c9b34e6db
SSDEEP 24576:C0Seeae05XxOrM99ePSfPFB9nLSb6LOD/f/o:C3ae0Fo09gSFjwTb
TLSH
T198459E26F6748335D073C0B9C5D2A69EEA723086573089CB4286D77C2F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f54a05fed58810ce7274d60d45cd5cd390ca10427b02f65fcd1e2d36aa8fd27e
MD5 ec430fc6cc9953556ee99baf78fbadfc
SHA1 a3b10b9c61e03f0bf932f5f5e7e05068ca969546
SHA512 e9dc6e5bc7d684ca4ab81693c2414cae421c1214dbf0ee09182a7fdf67f2ea9d9e048a119f76b2b69a4879464b166b9e2b9a7e1b4f716c4bf3d71bbd2da21fff
SSDEEP 24576:pNL/ezSC6vUyD/aqgrvW/6q8wyuA9ePSfPFB9nLSb6LOD/f/o:T/ezSC6vUzPvuHjyr9gSFjwTb
TLSH
T1F1755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 a08a32d468866c5b87f308f179b8edc236590fd6aa12f3288089c7321ef8ef8d
MD5 f19def8e45df74cad7cb105a54a39257
SHA1 38eae33b678c525863560915498cf487c4cc081f
SHA512 7bc5fa9bb883de495ff80ff93592e56cd7409690981cd584c943031b7bd8dbeb167f8ed43402cf684d579246ab6054646600f136cac68f35f4426311f2bf7f27
SSDEEP 24576:IAbSPRIvmv/l+dnh9ePSfPFB9nLSb6LOD/f/o:IAAIvmXl+Fh9gSFjwTb
TLSH
T1EE559E66F6748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 2962aacb96b1cfdb5d20a066125fa571c1da26a595022d857f0fa97c403f33bf
MD5 c71c3f2c7056750607b33d802e40b810
SHA1 330cf9831b69f4da9f5903a220be9ece2755c493
SHA512 6db11d5cd2825f7ee22f3acab79e261b9ab1a3795556c51c8d5aec2e00810e2ede30e9a183f7f05b521ae63b25a0d617b5d77e4b449be6e611796ae2e2b20184
SSDEEP 12288:AHixeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:AHo9ePSfPFB9nLSb6LOD/f/o
TLSH
T13AD4232DC30166BBE7A3563916FDB06F172BBCE60861CC0DA7192D2D023B7D6D272562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 03bade32ff5e7ea2d4be49197893ffae38da656aa59568ed3531b7cdabba31a2
MD5 1098337c57388e4ef3baaf92c9d66b2e
SHA1 8e228262c87ce257a21790abfd346e480be26358
SHA512 fb47844c0eeaf68fcf94e1db7422388d3a33e131d8fe32705866151c96cf75e7af4c0c505a023289c68bc61f9fdd79f675a7a8c9916878fba3eec74a85d50f6f
SSDEEP 12288:6eBNUbTVO86UCxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:6JIUI9ePSfPFB9nLSb6LOD/f/o
TLSH
T13815C03BEE28FCE2C27A8D795791C200977278714F6293CBD265820EDE236E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a57a6ca169cc2836a3c64b4c1b054861c531f648c1293f7e4c63777fefae21b9
MD5 870ab6777c202e549eb1755a8077a4f0
SHA1 32e82c5475063d8eaa7249eb5c7a16f1e4dfeb3d
SHA512 e9e12f26bb10111182c485d95f7a4330212be0e411e77b582f75c1d38ddb32c4c7457d1a569df6dada2dd6b6ce0f83be45856cff9a803a21082436bf5717bf26
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJd9DN5J6NRV3TH1:nQvGAdlCEL8c/dRNe5Ctrgujw
TLSH
T1A3366C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 9e917e1c3a203e9d4bb60daa0f35cf2a89e0184661ead1d78633ea83eac3d438
MD5 ebe9468de447a6e0cf9fe4279b94e8c0
SHA1 469d29afa0198810613bec159c955b9aa5d0f47a
SHA512 4e0633c23911a4ae20c9c1a24bfeef064a0d10917b0b13b611b82df03f189ad14a8578354265c3e15c725ff2f9f0729558e15ba9eac08d9b5c531180e7cdc742
SSDEEP 12288:hFwSfxL/2Dc3bDLLmt0LDQewsAj+xeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3Y:zmewsAjs9ePSfPFB9nLSb6LOD/f/o
TLSH
T17215E031FB74E036C3BB0DB61B3AD31A143DB9604B6119C7E3A84D9E59342D26376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3fdfc6078625f671ea44040c537170c52922964c2cc4dd7640b412f7b715d0ca
MD5 dfd839bd628a16b89827197348500bcd
SHA1 7e523cfed8c837f2ee1deb3522ec6c338923d33b
SHA512 6ad0839d4b2931533a47f754908188d79e7d570e6b299dade8fcf878411b4396db2b32eb1a6b10ca270bbc473742a64ab43c12e610f92787fafd42e1e42dde72
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrNdPlbuJHKk:BUEtQevvqc2W1cpV2Xrf2Kk
TLSH
T164474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 88d3700cc81b8ce3f8375594f3c0d69ba45064b448468d2b2a956e44b3507ce9
MD5 e70afc9b9884bac8b5bba7fc37834e0a
SHA1 43e614c053b4c05af93b063a65df6efba516126c
SHA512 f3635a2b40f8fc4243d1e7f5e8c2e8ddea965ab9fbd2d3e7fc455912fd83f9fd0e4088fea862afdebb7a6e746c8b2d164e29e447d1900c005a2babee23272919
SSDEEP 49152:hQbRquA/m2yL5zMfFiV+XenmE3/zu9gSFjwTb:Uoq1VjnmXgujw
TLSH
T156D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 81026fdb31e604021c2b3179244121ab366ff058d42708cc696d896c6e290a78
MD5 c320b9454f59cb905075f509c626203a
SHA1 3c9d8993da50911fc461a28d69705a83dfe1914e
SHA512 215805f985e0eab59288fc32c2af8162492fb08624bbfc0bc8722b3181f62b395ca396285462ad843336444b590c12de9cce73c89248268f147a4368a69869e2
SSDEEP 24576:RAhGLvYFoiwtA5l7S53W9ePSfPFB9nLSb6LOD/f/o:RAMUFoiq5G9gSFjwTb
TLSH
T1FC459D81E7F955D4F5B3AA7899B69171EA76BCAA5E31C20F2250C11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 8db9d488a83f657e0d2266a5351ff83f9b4e58efb52bbff3c656435e0be186ea
MD5 33aeb8f9ea90453cbf70103e21e98a34
SHA1 d497d660aacd103711274f893b604ea34d79d9f8
SHA512 3dccabaa873e818f1d130450a00bb8157abf11907f9a2e6b5e30536129a02b6c191ece49746b993fa168b66e737da4bebcfe7f5225e9c9b00329696158aa0761
SSDEEP 12288:Ymw5HEjsChNYBFgl0WTm+CvxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:VwuROW29ePSfPFB9nLSb6LOD/f/o
TLSH
T13F05F14973941CF9EA6782388597D036F7B3BC521A21DB0F1760C65B5F37361AE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 f1dceee4733d4b39b433f4b85682274ed1e78bb1bbe74bb378f23f21a6d65b5c
MD5 e97450bf895c3a699bcd468efd255ba9
SHA1 962055aa7b77be9239a82777ec2ac827a01e3faf
SHA512 6ca6eb0e112904d3bac58fa9e42b6ef309604ee91f5fa785d94be165baa5c2c68c915d3db9479d321f08700e3765f91b18ae42cb200d16a459c12f95a6cfefd5
SSDEEP 12288:TG11IOqFxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:C1uJP9ePSfPFB9nLSb6LOD/f/o
TLSH
T1DDE4126D638461FAE2A3523C89F9614A9733B8A6073187CF1719056E1F33BD29E35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f4915c1b350ba965554750775b5a508ec85ef689ceff6af71c92e3a8f7faa911
MD5 340f47ed76cb08b21eb2c90449f99e74
SHA1 db671e7f68f0c6b246c82c0d6ea5b46f33323591
SHA512 e91ecaa0f0466e6b92707551276903f142cce00be12f12f704c42f10f17e454bd54c649479c287ec0375dfc2b6914cdefdbbbb812907cadad43d90c9037594f6
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23US:5QRQyi36YOcP8Lvw2gAf+PN3Xgujw
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 152a10694fde74dffd2cb5679423b71f71285294f4174c0f9fab9c9a668e1513
MD5 0540448ffc88631d1ab3328eac422694
SHA1 3ca7210d9a1f379b791f75a567efa12df7391291
SHA512 dd7a0d4382533b5d8b82a6da0730a3caa58615c060c7952fb3deb7effc222f132e3c6f628e7cc8f86953dde12794a38a897799716495102fa283b6b0f3220bab
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UF:5QRQyi36YOcP8Lvw2gAf+PN3Sgujw
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9af864d55316d6e0009b3866e9a10d8b9a7c8e194d1da9c9325e81a631ab1ea4
MD5 8ef7819ba127687bbffd8fe148b9efe0
SHA1 96efa281da66bc09e859c5d09f7d4bd98a42f9c5
SHA512 48c78c0322b81ed023a708c4486e303bc2dbc383fb1b01889c983448ad1ed1bee60279f7f2d8b4eb3ba244cfbc38d13297b2a2f88f96cfe83eeed42861f4f815
SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0d9ePSfPFB9nLSbI:568Qg55nhMeWu7PNU3/w9gSFjwTb
TLSH
T1C5B55A33B2F200A9C44DE1769F4A973196D27C758FE0D3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0075cb5b4f97c11cae66caa03079735f174a25c0a4bf88058f58595c35327703
MD5 06b0ddfc0065e1946868b5f444c0498c
SHA1 29a580128f305a8df65f50bca14f83e2ba634518
SHA512 dfabf891119a510f11e1ea1210299e154f9b1d8d8f1d41309ae290a085ff080802f758bbe6eb4832244c5c284eabe9918047ebcc2a2355ec536df3a933677963
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99H:Ty5112gYy5azzVv569nLKnhZ3gujw
TLSH
T1A8168B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 43d45e07250b196c5c5f4c6caf0a65cdcb6fee1dc66931b9e988120e128e455f
MD5 f58d00ef14582229a6ef0cc84a0414ba
SHA1 f05573c65ff51e3aab5569f09a7ae33c89a7eb91
SHA512 e645c6a2295282bfcaa335ea924830eefd4fc8ff1dd73b200f2c8fde554ab82132e68371c6f06ea0a21d704725b617893540aa07b267c203b9a815128d856f61
SSDEEP 49152:jB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gln9gSFjwTb:Vu6JmTxd2d9gujw
TLSH
T10ED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0B9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ad811e8991b2836b6571b16ee066b8aa52730e446b1f0bed19158a2a4232118c
MD5 5f78e372dcfcdb1c0aae8e927b40f572
SHA1 f77ceff3fdb6f40f333c72cebfeb0febbf6f7619
SHA512 7b402d1262a749d5567b55cf181e4a9f24b0559142c55dd45757e0eaae5cabda1d568778d146ca2637664acd10ad172eef0f2b96ae3efda9b47e233ad3a3cbbf
SSDEEP 49152:z1hpsNoJpF1A6UU44CwH7R4xk9gSFjwTb:zmifPbRPgujw
TLSH
T164B5BE13F29901E8D06ED178875A9232EA62BC460B34B6DF0A9077961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8ffd8af9d9af94389c9d57da1419bfc4bebf3804385b302ac021c1bc8ed6e194
MD5 e62256690f0ec1d08b803ce69da27a03
SHA1 a8671b87d60c1dac6544b315add34796f9001356
SHA512 3076cec9b48e2dd440f3fa465ee66f555be89deeed5dbf2cc6041f3b8f12e783967e6d010ac7b7421e46cc3b7c10b47e6113887f5cdb4d2a075efee6533a1f8f
SSDEEP 49152:OSuZQIY0Be2K6RVtOnks6NMHqI9gSFjwTb:A5dKoi61Egujw
TLSH
T1D2C5BE03F2E941E8E0BED67487669236EA72BC464B34A6DF064072591E37FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 27f6fa3004e3953879d8cc2590cd5e7f46b0c63e1e519ae0de1af70dda751deb
MD5 4f5c9553253fc852b96dfd208e267c1e
SHA1 55f3201c5ff10927f33ea9020061948e37b49162
SHA512 4380c5715903484ea0c7978bd56ed9495728652a83f283e7a45eedf15c4823b937f355814f553edf9c5e1015e577d8103212531f777d5798fcd647090215b0e6
SSDEEP 49152:KhtSn8EApI0figTgiDn0AP5w79gSFjwTb:rX2iyphqgujw
TLSH
T193A5BE13F2D900E8D05ED178C7568632EA62BC160B35AADF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 dc845fa08b6b0f833b997d4acc470ea0b7c8fd56a653e9166ca8434f38d03c67
MD5 ca86184beadc1f877fcbd02e222e21ec
SHA1 d906d0bfc139162eb1f3985c6ff9a1b58daae668
SHA512 f786ed6cae971c5ca97c36654df0819d77ed6299a674c8349154ebabbc2120a9f48d8db35a6443efff569da98ce59de28a8207c61ad82af99ebb8981a6b1be68
SSDEEP 12288:SnxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Sx9ePSfPFB9nLSb6LOD/f/o
TLSH
T1EBD4232DC30696BBE353563916FDB06F172FBCEB4462880DBB1E181D0337BD692625A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 a70ac3d0cb142b1464516b0e159e1595d839794c563b6ed8849d3c7f8e6bdf57
MD5 dfef2fba4e582cd49bf4c351e76cb031
SHA1 4eaab0616bb7744ae092859237cb9f1a4e00fe00
SHA512 6573197f865a3b8958a607b11d62e78e487c7c89e37a529f388b1037a332764ec5d6e3fe49cdd1faa7bdcf891588f47b7f2defa7f6fd796666b681f5e52acd66
SSDEEP 12288:A9xeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:A39ePSfPFB9nLSb6LOD/f/o
TLSH
T116D4232DC30656BBE353563916FDB0AF172FBCEB4462880DBB1E181D0337BD692625A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 ab615728ba4f18048df596f2deb36eccec1279103d0859fd59aaec5e00a554af
MD5 04ee70bdac6b4e1a740f8e6fd54b76b7
SHA1 ae2ecb665f5fe71cac7dae3791656454dacd7de4
SHA512 fb45b87de58a6ef077497817e7034233a33b7242e9d481710ee09b453ef12ddb642d2fb7f166478a8b128a7f00f08456c0383b4201108d8994bf4603ab27cb48
SSDEEP 12288:GzxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:GF9ePSfPFB9nLSb6LOD/f/o
TLSH
T1A2D4233DC30656BBE353563916FEB06F172BBCEB4462880DBB0D181D1337BD692625A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 3bc7dc0ed4e9c87fefa962567677c245699768d9a9dd15bc8a8b4ceb02f5e5d3
MD5 0c8d4572a396f8451f364c0611cb5ca2
SHA1 63b85fbbdd83cc7ead0d3ec7752d8e178c3bd2ab
SHA512 aa4e752286132878ac8c2fedbf9f92bc0bec87b1ff506aecf46f53c5e34980b4304d5dc41a958b5a1c5e17d2ab738d612b228db57bb0aefdad9e651c3ff495c6
SSDEEP 12288:slRxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:u9ePSfPFB9nLSb6LOD/f/o
TLSH
T1B4D4232D930652FAD663D23985FAA06F933BBCE64432990FAB090C1E07377D5D235B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 e3cb032caa63d6eae987019faafde1d6a13c4a3a12c06b5e59823122f3d4fadd
MD5 6e04302f07a83389cd46ab8fe542820a
SHA1 e17bb6fad12058e5d9df540a1cb5e597d162833b
SHA512 34f1d21f50a101df6564ef9e7218258c3500e279f26233e7d920f8b63b7fb01cd19868d9d829ec38a3df5b20bdaa7e6d7d2fc16e41698bf1371214d83875ef7d
SSDEEP 12288:VAxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Ve9ePSfPFB9nLSb6LOD/f/o
TLSH
T1B1D4233DC30656BBE353563916FDB06F172BBCEB4462880DBB0E181D023BBD692665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 2f550b57f66fa9b3cef5e76f62734e7bd2f2d1098422bcd47e10b61a62ced772
MD5 b6e017b1d92cc7d5d689a4f1d66ca5cb
SHA1 694afca8bf3b3f29358230e98298473bf6b7aeac
SHA512 cec081d204206e09dfa489a29d143ac1a6a9c8530507f35e4c29a33056ecb694604ac1dd9077ae44e97eb868de0fc78ef5c6630f67802993790e0ac4ac79b23c
SSDEEP 12288:mrxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:mN9ePSfPFB9nLSb6LOD/f/o
TLSH
T198D4232DC30656BBE353563916FDB06F172FBCEB4462880DBB0D181D1337BE692629A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 91bd6190ce1e510b1832742fca954c89793bec2c5775b97ea5b02640eb7da057
MD5 eaf63a67da3795b6b95e8c9d693cf3d6
SHA1 d816d053edf00b251f23f793751cb9ccafe64fbd
SHA512 a1b619ad7c6edd98baa9529d2bac250f50b1cc92f93fda83ab2340769450d6b1d33af063179a7301d5e05f57b9181c3687f0b8a7001525768ee154a6781e292c
SSDEEP 12288:7lxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:7v9ePSfPFB9nLSb6LOD/f/o
TLSH
T1CCD4233DC30656BBE353563916FDB06F172BBCEB4462880DBB0D181D1337BE692629A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 64e1beb14cf397e31269c763aa851b152725e2e0818675d5b62cfae356584cff
MD5 d63af0a45a9f35ebbfe1509e520db831
SHA1 3a8960989cf48d4ba91e9f12b7586abc31519cd3
SHA512 c7a357d38d7484da3db574b22923466b463e224971b17ccf1af5eda9702e19faa44a50e0f8048b47e9eb39427b29105e8bc6aa068720e4be77431ef5d86a807e
SSDEEP 12288:uiZwbCIzFdpSxcPvyfxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:RZM1zFDS9Z9ePSfPFB9nLSb6LOD/f/o
TLSH
T1B41502A9B34018F9ED63813EC965951AD6737C5A0670CA0F13A8362B1F333A15D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 3c2056d3a06ba6b138d963fadfbda4e42967a5bbdb4cdcd3c8a5a757e384bd43
MD5 ccf9d0a58cdfa697e33f0c6354376821
SHA1 0a445439ccb770a4edb9663250733bc5cffe2618
SHA512 562546615a29e38956ebc83af180c321f5585d9b309f13ecc2a5b9d52c86e0b8e8c6c0d1dc163b274b7c38dffa494903af341ec5b02b4367c766b5de873e944c
SSDEEP 12288:SeSxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Sd9ePSfPFB9nLSb6LOD/f/o
TLSH
T16DD4232DC30656BBE353563916FDB06F072BBCEB4462880DBB0E181D123BBD6D2665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 f4adcbd9556422bfa1d7f812f5a02388033b481630c0ec346aeddb37069b8269
MD5 db6fb6f425c72be3e8fef5384453ba14
SHA1 e0468930d0cf172421dcbcf9494221e08820e7a9
SHA512 bce4049b1adb7c096873cc7040d1d70328c36b4904a742fb9355a4d1bc62d072173e5cbf350c110fa7914f0556960815fa45416ce9c0f82bf33250aaf2efa42b
SSDEEP 12288:sbIxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:sbW9ePSfPFB9nLSb6LOD/f/o
TLSH
T1B1D4232DC30656BBE353463916FDB06F172FBCEB4462880DBB0E181D1237BE6D2659A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 4de4b97956b1edb86bf40cb4e92bfb11af69a2d891ef7f2f2713205f1d10a466
MD5 2a752c9f0895e67b4638b39a429128ad
SHA1 56e87d122e9567b43e7972e501f049c1814a7d0b
SHA512 adaa40e99fe0ab9c5d07ae75a0c1c168af6d9ea094335423d0a51d76759830fa007173e91ebdd7cbe8b90dbc4b411af6913399aaa83b13b250205a296a8f3f81
SSDEEP 12288:yPPz5L8z3xeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:azyzB9ePSfPFB9nLSb6LOD/f/o
TLSH
T101F4121BA35131F9D273823889A62516F337B87607208E5F6764067A1F377E19E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 1ac9f1d33c739d26cd6f3f7088ec087f0ca98de74f1a5bf18296a3a0a3eb437c
MD5 649a9e9c93feae44a52cc4bf750c0a80
SHA1 c5bc293cd9679282c267747f382ed55d4db6dd03
SHA512 438d0814ae2c9d5bc59817e91f2037947c1ef1e96933eb2e1e32f7e153b344557327e298e76042ccf42975e8fe6ab9d1cd3c7cc978392401007e9b6edc7ba795
SSDEEP 12288:qfYxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:qfm9ePSfPFB9nLSb6LOD/f/o
TLSH
T16BD4232DC30656BBE353463916FDB06F172FBCEB4862880DBB0E181D1237BD6D2665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 da556a08e7d698f214cace24613e9d9057d68699bf9d48f224d887de57aeb82d
MD5 0f898ccf10dc0339088ca478ce0933cc
SHA1 334e91591df32a0e078a013acc15a8e0f5ba1266
SHA512 686d24d5a1e90f062a9b8e8743dd9f71909255435568831aaaa274a5f6b0391fcdf682ca4ba72e1ce8c99821447642a17a79cbd8e7ca2e90effca177c42095b5
SSDEEP 12288:CE9xeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:CE39ePSfPFB9nLSb6LOD/f/o
TLSH
T121D4232DC30666BBE353463916FD706F172FBCEB4462880DBB4E181D123BBD6C2665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 d347021bc0c9246ae8d4eb7b49930471d7ed079e11685311c58732966375729d
MD5 053f86e518f1df8b8fe964eb6af06916
SHA1 34b8321f94d0b239342ef9c8dee8087d52d981cf
SHA512 03a827a9e323a733a9c49a6152e35d7cfc18a12b71831a6206caddb966da3d13b6f8791a059a604ba5673c8e6c673914cb3d2ad9e60aac24d80903a543b4941c
SSDEEP 12288:zPPz5L8iaqxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:LzyiaA9ePSfPFB9nLSb6LOD/f/o
TLSH
T1C8F4121BA35131F9D273823889A62516F337B87607208E5F6764067A1F377E19E3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 7719be17fa44b9c7d2319990611b7e0df5e0290982210c9ab61ff03139c32307
MD5 bfd3729afca744d7d1d07982aead5f3b
SHA1 8179de6dd8d29f104a8d6065d3e1d1050fd9d0de
SHA512 53010f8c2ec21fbf1b56eaca1ad027494a8d99ff3fce0283aed03a441abdd10580de717a27b1d52a9ffec79b265e031591e4b14de9f5ca082841b43b3044c0c9
SSDEEP 24576:sTzaLm3z0z8Sb9ePSfPFB9nLSb6LOD/f/o:sT+LmjQb9gSFjwTb
TLSH
T1F61502A8B34018F9ED67813ECD65951AD2737C5A0670CA0F13A8362B5F333A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 996d696e573e7b5ffc4ecf030b3a190a2a998f8f935b2f07d5fb24a9da1fafcc
MD5 c1a6d913a200abe22ff4dd39b1cdd53b
SHA1 d10077012e4a8ce722051e9fa6c0bb878acdd5b9
SHA512 612f2891422a345fe7cbc8d828c4e17ba0d89bdf9555dbec7b8d548d53d3ad438b31f74ce6241cb958e67812a9ca79f299e51c8e055dade9e323bc59afb11cfd
SSDEEP 24576:o3VdSCHFy7WZTf9ePSfPFB9nLSb6LOD/f/o:yVdSCHFy65f9gSFjwTb
TLSH
T10D35CF90F3D410E9F1B79A3589765512DA767C9A1B31CE8F03A8251A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 7da73849ad3836dae71dc83fbbf8f97b35a05c1f11af38edf3e2e24e5876e086
MD5 206a2f98778008a7a1c01525b78d990c
SHA1 aa0bec3d59b6e7f2221dd5ebf2349891166fecca
SHA512 39e2b258ffd678553b7afa4805380702142e95d18469d86b93c1ef9adf8e5715eef53735c7164062c4349bdf963f839d528bace2628d30ed981305f51c8b1f67
SSDEEP 12288:EEuxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:EEc9ePSfPFB9nLSb6LOD/f/o
TLSH
T1D3D4232DC30666BBE353563916FDB06F172BBCEB4862880DB74E181D0337BD6D2625A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 85b8d52656f2d5e35784634a1a7657e83b35d6203a62ed400eccdc3ad55e8250
MD5 933f9e887ee9cea8c3318aae3d413ffe
SHA1 9eb733773569c9c90a3609cd9787ac3993180611
SHA512 951e393cc384fcb9a903b0625360398f2086bbeaffb9625db9f108b6a327ef6ac6d37e4523207088be602a362102b3dffb25592804bfcaadd3894571fa579e82
SSDEEP 12288:StyxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:St49ePSfPFB9nLSb6LOD/f/o
TLSH
T131D4233DC30656BBE353523916FD706F172BBCEB4462880DBB5E181E023BBD6D2625A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 b216e75b782045313bffe369d8fb4c67f7de2c79a8a5f45ca22a991bfe535157
MD5 275e2ffeee7ca7d49e3f42c152e94e88
SHA1 6b5aee542ead62aa23f702d35fd98da28dc9f568
SHA512 6fe1f3e3454c8fd04c8a51845f8ba60c5bcbfa19c496a5a69405631b3e185ac97fe8b552d8f7a66a327457de430e1fbbcb872037945ad1c54a221831d8fa716a
SSDEEP 12288:L9wxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:L9O9ePSfPFB9nLSb6LOD/f/o
TLSH
T186D4232DC30696BBE353463916FD706F173FBCEB4462880DBB4E081D123BBD692665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 718355fa0396f2c934b78d18a6185096f65925c3672786500dce189f6a08bdf5
MD5 7f695b3af26153f9ce2fd24b61cd8239
SHA1 be7e87fd0fe9642fe15f2a1d715c769e98b36ebc
SHA512 bab909a3fd61fde15e1616cbe252551dcd21dfde2168d561a6cd10b924b7517faa1c401fd5ed6ec02b9fcdb8d3af06cf4e936b14ddf5d5c40d99391fcc7a4c8f
SSDEEP 12288:cGDxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:cGV9ePSfPFB9nLSb6LOD/f/o
TLSH
T165D4232DC30666BBE353563916FDB06F172FBCEB4462880DBB0D081D1237BD6D2665A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 815880630187e3020dce2735f25977e471974ee6b9f736c88a0fecdc6e713cec
MD5 3952301cd3de4151452b2f5a80e63cb9
SHA1 cc4ce61d28d844e6a387f9a0cdc62a973e4a5726
SHA512 73441d2b8066d7ec7f9e517f74730a4038ea40dcc4df91dd7835dc944f6a0e565b796276f4b88e3429ecc9582378170dd8db4308080bf6ccaecd14c98398b894
SSDEEP 12288:6TsfaxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Nw9ePSfPFB9nLSb6LOD/f/o
TLSH
T192F4F119C34412E9C16F6239C7AA5145B3377C6686E1D28F67C0F83E0F366919EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 d3822f57ff38dc6a3203eafedbc5b88cb70552e2925e822a7d9b22c90f961cd9
MD5 4fb7fc3e569ed8c42de53df1f88fea93
SHA1 e15bbc8a4e07ac501d7ff933cefb2721a9feb962
SHA512 359f53bfd7702235676d452341eba4c1fa0e0dd41c867aeb02ad820457642eac8c093444d04d396c94fcc5a100c08e5338162f470d263ee7fa6445761e6bb0eb
SSDEEP 12288:sY7JxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:BL9ePSfPFB9nLSb6LOD/f/o
TLSH
T1D9D42339C3059A7AF273563415BEA03E132FF8FA0A21C80FBB09191D1237BD6D671666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b968081b8394238178711444f466e53b36a56f7f47650b0651f2d20062204d59
MD5 538790304e64243938e7cd8eeaf20f7a
SHA1 f3c7d360bdb0e3a6f63bc355506f4644ee929eb7
SHA512 f59265d93b8ed118084670809933111a60a448108c5fb3148e9cb3307b6ceaed3307dcda68c258416dec2a5615f2321c5e75074fcf30d753f0b9cce13a300919
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYo9ePSfPFB9nLSb6LOD/f/o:fgb4mBIBhGF39gSFjwTb
TLSH
T18665AE1E22E802F5E1F6D2B89DAA4417D6B378160731D6CF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 72e114a8a52ec7840c1ce1befae91e090f1d447f4106502a8fbe663e4943a08f
MD5 c6d9d8af1e01c1395cdece9c9d350e64
SHA1 83a1444ee5f13ce985ca210bcb34edf799ea4d7d
SHA512 1b39336d40cab7296edc45313384ce8993f04fbc81ebcbba25617121d2ee47175b3803d11a85511fa6a3757752a7f1256574f7f9da3cce14bebb016e27d5ee31
SSDEEP 12288:GZGyxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:+G49ePSfPFB9nLSb6LOD/f/o
TLSH
T176E4223D934272E9C637C23945B9A06B763378F1072098DF4B99583D4736BE1A339DA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 c15f46aa422135e27ac1a9e9c1b9a0334f0c8a00a1540f5d4038e485383bed60
MD5 c3e13811548812cf5258dec7ca55bf13
SHA1 7a3e83f064b359c2e32fd6eb54bb8fc6ee4e65b8
SHA512 bebdb66d3c9ddfbe708457356760244aa5e7675f7b4c04ed938af780d53fe500838fadedc699b532af7f7f9aee229c4c00580b3ef4b8b0a69fbe74f827ac7bf8
SSDEEP 12288:4cxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:4y9ePSfPFB9nLSb6LOD/f/o
TLSH
T1AAD4232DC30596BAE363563915FEB02E172BBCE6076188CFB70D181D023BBE6D2755A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 fa5682e90fe9e0613ccb24f1fc7353537b64f18af936661332117ed708aa8dbf
MD5 ffbcf1d32f7ab025e5f8add869b45ffb
SHA1 93ccfa17e7e451f57891ef0c69fe6cbfac1c28a6
SHA512 fe10491e382ff526edc74a19d6560f39bfc003d60534511f53ed2bcec1799bfe6eab741ff311293e1a33a0457253c21ffdfc0b2d2e6232983b7db05fc129c62b
SSDEEP 24576:y4d838y2JqH1Mzria7/mE9ePSfPFB9nLSb6LOD/f/o:zSMyyqVra7/L9gSFjwTb
TLSH
T12A350165A3E102F1D477D1388A964267F672B8250360EFDF07AC8A551F23BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 a1fe172178206e84bfe1ffd08d6b765eaced6dcade6cbd393cf2f4f2110db3db
MD5 d85f4a5916481c655fb749670734bdbc
SHA1 6e7ee1a6316644fee0d2bfa2d01e865ff32d757f
SHA512 1a5ed41ebc8a3a70bf30e81d1fa6ccef79aa84a887a248a2865d810f05738562f72624e4fbaa57d7441d61b4b13bbdbee032c4cde5091d182db2254a468259f0
SSDEEP 12288:SHvUrBFrEjwaQhxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:SPUr+NQz9ePSfPFB9nLSb6LOD/f/o
TLSH
T15705F12F639918E5E677E13D8596921DE732B8620712D6CF03D1417E0B27EE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 afdbb83c3866bc26812937bad8fa598860c39d76773d3570e9563277681c1be2
MD5 ef00ffb3b73942ad30afbb0395d490d6
SHA1 82c4e754a2c139c22272eb9965fb32b0c6abedb8
SHA512 2c3b42987d7499a48737aaa30825e2c113ecd569f7e4006bc26996d5fc61c7b24d627675f6818ed395d231f5e96d8eb41f70d28c03e9446b85097111e1d98eff
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjq9gSFjwTb:eG05lO43bRgujw
TLSH
T1DED5CF6E62EC11F9D1BBC17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 19fbf1cddaa679d7dae3077c645907189f29ebf75fc2badf3ce5cf2b388d86a7
MD5 1b1327ad1ba13d99d7974bffb40b4544
SHA1 1b91e3ffb3fb4a91a7d1a89725f2a5157c244dd2
SHA512 ae06abb3b48298ae85e42e808905bdc8d1cb2874dc7305503166bda33e1b1d2bec5a4e766de6d1c59ca188616532bdca2e8f953bf09384e020e671adf9e7fc41
SSDEEP 24576:IPa5POZ3dpbWVM50JicR2hG0lasx2+47eidnb9ePSfPFB9nLSb6LOD/f/o:sa5POZ3wJt2pasx2+m99gSFjwTb
TLSH
T1E265BF5EA3EC01D5D176D17DC583461AF5B2342653329ACF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6f5e85957b7972e4caeb269b6941f9eacefa361744db9dd95aedb5fb8b27281c
MD5 01c6a9a0fc898c87d39e90419dd6417f
SHA1 bae1b88822a035e0768b6903c154010ace885b53
SHA512 6e716257c71a0bc45068665f7038d70ece2985a6d9ac24e891201dab5a456e2e36aedb528274544fcaf4266f9537f1bce6faa325ba66a6ad268e91e5c9320022
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkB9ePSfPFB9nLSb6LOD/f/o:PNc/zEOVHFS9gSFjwTb
TLSH
T1A7857B2663E901E4E1BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 d28980fb09008e574696a95c54898f508e36d9fe9379ba5bf64c566aff4c5040
MD5 9714807f9ffbc8aadcef39d2dab9e68c
SHA1 8967db18e4cace34a0ca7d6c24d0f51a2c98e73b
SHA512 991fc3ec483118902393276db5b3e029bb35ddcd5f63cecdf0ec3312da14224f2ecb16695b181dc0070befab8ec062d261a92e6559a4967202e938cc9ed71114
SSDEEP 24576:EJnJPbzB4Sh9ePSfPFB9nLSb6LOD/f/o:EJnJv6Sh9gSFjwTb
TLSH
T1E315D03DD29810E9D4B7C274815A165AFF32387D2B2269CB59B4D4353F12FE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 74fd4aae8d5aeaa94984872232013a5bc01165c1a9c27c932337755485542e9b
MD5 8d6e68f929a2e8692ba335b70dab4094
SHA1 2228a4827e9ba8eb5fcd41e12de96b03a4b1a209
SHA512 21c9000474d9102d772aff6aacd4acd71fa8d2da8b9f5e878f86cf3094f60def5ecb518d39aa65a08c3b98a065a21cfb0599cd8b150e2111769202fbeccb7178
SSDEEP 24576:vCLHGL0MoeVtFumTijCmlKQWDkZ9ePSfPFB9nLSb6LOD/f/o:vCLHGeeV5ijCmlDWDkZ9gSFjwTb
TLSH
T124A56B05E7EB5188E8F3CAF4CA2694169A327C549B34F7DF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 26e1f260a7b86cec2e96b0a1f5afe7bf359352ed97a54730277d7dab51fd611b
MD5 ad91c42e2ab3bce46cd650f7273750d6
SHA1 2cc1e99cdd3206a6553bf81773663fa03ded4024
SHA512 e9080963ba79591b97f5dc01b6856b3af1c8c978d35460928fa6b4c9012d71045c3a32a160c1b4dbfa2421ee8dbe420ff2b9af9cfae92fb9960788fe618f3ccd
SSDEEP 12288:61Hck6j5ZI7DxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:G6DIx9ePSfPFB9nLSb6LOD/f/o
TLSH
T1F305012D636A11FAD167D03E86930016D273B4B1872259CF5B98C87E4FB3ED8B639E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 4f91c52ee23010d2b6b2161543f18ae14a6882de66ffbb136ba83559b8ffe6e1
MD5 056709ee20d1794ca3f1454101397db8
SHA1 5d6a651fcf69eff3c3711e0908c9a9be11aeed15
SHA512 e6e4225724730d1310e81aa4f102ca2e8bc11a25a5a5dbe858983bab802359bbd783d28e56819b7fab267462b7581a292416413036ee2970d18dafc002869eb4
SSDEEP 12288:UG6kyzxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:FtyF9ePSfPFB9nLSb6LOD/f/o
TLSH
T1DBF42318934461E9E7B702384AB790A95B37FC714B2186CF6790AA3E1F37BD1E531B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 b7fe45a1581fefbd09c34459665912f86fdffbbc259685c7f10355d9f8fe8fa3
MD5 3f6b949ef2f1246e1f402630077553ef
SHA1 e0d1878a4af09d38acdce31e3737382c54f9a453
SHA512 9f91c19a057ecd04f8bf8cd6cf1fb4b3de463bb908563161e2a2c1949b8eeab084c9eb63ed517ab1e6b047cba9340c63022b1e5a5717e9806599191adff7bb32
SSDEEP 12288:CNgxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:Y+9ePSfPFB9nLSb6LOD/f/o
TLSH
T1D5D4232CC30666BAD653563905BE606F133BB8F60B2298CFBB99583D433B7D29231D51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 e588277581f38c8b99b3bad26b91124c83cdca4db1944c2ef5f09f39143106d0
MD5 9e8a765aa70a5e02a1d2fe2e243decc6
SHA1 5c5a6f039f95246d60569195194c608921030d70
SHA512 0042f36b53cbce266c0c076c60c2733ed2ca3f9b27c4a86b99cfa3c40937c3ae6e6a55b952a93876a88e638cd07c6a308d486712451453cd7529c345c89080dd
SSDEEP 24576:aggILoTfaidZ+9ePSfPFB9nLSb6LOD/f/o:vgHTrZ+9gSFjwTb
TLSH
T148559D1DA3EA05DAE2B2D235D9725493D633B4311772C6CF2548C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 34265fdd86b34ef226e75f011098e6ea14a70d109f3cd02e6d11793e35e9d9de
MD5 39b02b7d078727d48276475c000ed4a7
SHA1 fb406cdabcc73c92c161359d74c6f0fc6daf8cd5
SHA512 5ab1a5aea9c3050fd5ede596635fc421eb947e947e8cf06379c3c344bdcc7e002b28f0415a3086e6747d43fe2f0f35740b1cb787b32516205d1a5c613a304153
SSDEEP 12288:mpJcm8CNhxeGeDLdcY2XPXxvB4mn/l5SmAGbzLHucc/3P/9G:mrcmRz9ePSfPFB9nLSb6LOD/f/o
TLSH
T1AF05F11EB36E00F6E2B7C13C8995411AE773B471172257CF43A1873E4A27AE9BA34B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8f6c119a64f2b3747020ece886ff3c233313dcd443269732a58a8039187e388d
MD5 5aa745c30fc47404a7112a45454edf10
SHA1 bf5d61d29179e39315b3548dfae9e362b60cccdc
SHA512 234bbe0614630f667d4eda5633f026608599f233c85ada2a7fb9e76b9a24730b3bb456f5a6ce72908f87091ac63ca2ace1ad0dd34f894cb2e33c3b8fba691e57
SSDEEP 49152:dDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS389gSFjwTb:e3Upow8sBzgujw
TLSH
T1D0A58C3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-28-0x000001B0AEC00000-0x000001B0AEC66000-memory.dmp

Download

memory/1148-26-0x000001B0AEC00000-0x000001B0AEC66000-memory.dmp

Download

memory/1148-25-0x000001B0AECB0000-0x000001B0AEE09000-memory.dmp

Download

memory/1148-27-0x000001B0AEC00000-0x000001B0AEC66000-memory.dmp

Download

memory/1428-276-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/1428-349-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1428-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1428-271-0x00000000009E0000-0x0000000000A49000-memory.dmp

Download

memory/1688-359-0x000002618F760000-0x000002618F7C6000-memory.dmp

Download

memory/1688-445-0x00007FF7BC2B0000-0x00007FF7BC781000-memory.dmp

Download

memory/1688-360-0x00007FF7BC2B0000-0x00007FF7BC781000-memory.dmp

Download

memory/1688-361-0x000002618F760000-0x000002618F7C6000-memory.dmp

Download

memory/2032-2-0x000001E42E260000-0x000001E42E2C6000-memory.dmp

Download

memory/2032-0-0x00007FF76FBE0000-0x00007FF76FCCA000-memory.dmp

Download

memory/2032-19-0x000001E42E260000-0x000001E42E2C6000-memory.dmp

Download

memory/2032-22-0x00007FF76FBE0000-0x00007FF76FCCA000-memory.dmp

Download

memory/2032-3-0x000001E42E260000-0x000001E42E2C6000-memory.dmp

Download

memory/2032-1-0x000001E42E260000-0x000001E42E2C6000-memory.dmp

Download

memory/2292-318-0x00007FF7158B0000-0x00007FF715979000-memory.dmp

Download

memory/2292-234-0x0000022380F30000-0x0000022380F96000-memory.dmp

Download

memory/2292-233-0x0000022380F30000-0x0000022380F96000-memory.dmp

Download

memory/2292-232-0x00007FF7158B0000-0x00007FF715979000-memory.dmp

Download

memory/2368-241-0x00007FF7158B0000-0x00007FF715979000-memory.dmp

Download

memory/2368-243-0x000001EBCFCB0000-0x000001EBCFD16000-memory.dmp

Download

memory/2368-327-0x00007FF7158B0000-0x00007FF715979000-memory.dmp

Download

memory/2368-242-0x000001EBCFCB0000-0x000001EBCFD16000-memory.dmp

Download

memory/3304-11-0x00007FF7D6FB0000-0x00007FF7D70D3000-memory.dmp

Download

memory/3304-12-0x000001E74EB10000-0x000001E74EB76000-memory.dmp

Download

memory/3304-61-0x00007FF7D6FB0000-0x00007FF7D70D3000-memory.dmp

Download

memory/3304-14-0x000001E74EB10000-0x000001E74EB76000-memory.dmp

Download

memory/3304-13-0x000001E74EB10000-0x000001E74EB76000-memory.dmp

Download

memory/3352-56-0x000001F093550000-0x000001F0935B6000-memory.dmp

Download

memory/3352-57-0x000001F093550000-0x000001F0935B6000-memory.dmp

Download

memory/3352-55-0x000001F0932D0000-0x000001F093429000-memory.dmp

Download

memory/3392-337-0x00007FF7493B0000-0x00007FF7494FA000-memory.dmp

Download

memory/3392-263-0x00000166ECDE0000-0x00000166ECE46000-memory.dmp

Download

memory/3392-261-0x00007FF7493B0000-0x00007FF7494FA000-memory.dmp

Download

memory/3392-264-0x00000166ECDE0000-0x00000166ECE46000-memory.dmp

Download

memory/4236-37-0x00000245C3160000-0x00000245C31C6000-memory.dmp

Download

memory/4236-36-0x00000245C3160000-0x00000245C31C6000-memory.dmp

Download

memory/4236-34-0x00000245C3000000-0x00000245C3159000-memory.dmp

Download

memory/4236-35-0x00000245C3160000-0x00000245C31C6000-memory.dmp

Download

memory/4344-389-0x00007FF6FB3D0000-0x00007FF6FB565000-memory.dmp

Download

memory/4344-329-0x000002100D420000-0x000002100D486000-memory.dmp

Download

memory/4344-328-0x00007FF6FB3D0000-0x00007FF6FB565000-memory.dmp

Download

memory/4344-330-0x000002100D420000-0x000002100D486000-memory.dmp

Download

memory/4580-284-0x000001D4725C0000-0x000001D472626000-memory.dmp

Download

memory/4580-358-0x00007FF7D12A0000-0x00007FF7D19E4000-memory.dmp

Download

memory/4580-283-0x000001D4725C0000-0x000001D472626000-memory.dmp

Download

memory/4580-282-0x00007FF7D12A0000-0x00007FF7D19E4000-memory.dmp

Download

memory/4736-335-0x00007FF7B1380000-0x00007FF7B149A000-memory.dmp

Download

memory/4736-249-0x00007FF7B1380000-0x00007FF7B149A000-memory.dmp

Download

memory/4736-250-0x000001BCF1060000-0x000001BCF10C6000-memory.dmp

Download

memory/4736-251-0x000001BCF1060000-0x000001BCF10C6000-memory.dmp

Download

memory/4908-50-0x000002294EC90000-0x000002294ECF6000-memory.dmp

Download

memory/4908-45-0x000002294EC90000-0x000002294ECF6000-memory.dmp

Download

memory/4908-52-0x00007FF78E730000-0x00007FF78E898000-memory.dmp

Download

memory/4908-43-0x00007FF78E730000-0x00007FF78E898000-memory.dmp

Download

memory/4908-44-0x000002294EC90000-0x000002294ECF6000-memory.dmp

Download

memory/4944-386-0x00007FF66EF80000-0x00007FF66F223000-memory.dmp

Download

memory/4944-320-0x0000024F7E220000-0x0000024F7E286000-memory.dmp

Download

memory/4944-321-0x0000024F7E220000-0x0000024F7E286000-memory.dmp

Download

memory/4944-319-0x00007FF66EF80000-0x00007FF66F223000-memory.dmp

Download

memory/4948-340-0x000001C5DCE80000-0x000001C5DCEE6000-memory.dmp

Download

memory/4948-339-0x000001C5DCE80000-0x000001C5DCEE6000-memory.dmp

Download

memory/4948-338-0x00007FF73A4A0000-0x00007FF73A7C1000-memory.dmp

Download

memory/4948-344-0x000001C5DCE80000-0x000001C5DCEE6000-memory.dmp

Download

memory/4948-346-0x00007FF73A4A0000-0x00007FF73A7C1000-memory.dmp

Download

memory/5540-367-0x00007FF7F9EF0000-0x00007FF7F9F9E000-memory.dmp

Download

memory/5540-290-0x00007FF7F9EF0000-0x00007FF7F9F9E000-memory.dmp

Download

memory/5540-292-0x000001F069950000-0x000001F0699B6000-memory.dmp

Download

memory/5540-291-0x000001F069950000-0x000001F0699B6000-memory.dmp

Download

memory/5548-444-0x00007FF6F0A70000-0x00007FF6F0CFB000-memory.dmp

Download

memory/5548-350-0x00007FF6F0A70000-0x00007FF6F0CFB000-memory.dmp

Download

memory/5548-351-0x0000019453930000-0x0000019453996000-memory.dmp

Download

memory/5548-352-0x0000019453930000-0x0000019453996000-memory.dmp

Download

memory/5740-392-0x0000015983DC0000-0x0000015983E26000-memory.dmp

Download

memory/5740-391-0x0000015983DC0000-0x0000015983E26000-memory.dmp

Download

memory/5740-390-0x00007FF63CCF0000-0x00007FF63D02F000-memory.dmp

Download

memory/5888-378-0x00007FF6309D0000-0x00007FF630A84000-memory.dmp

Download

memory/5888-309-0x00007FF6309D0000-0x00007FF630A84000-memory.dmp

Download

memory/5888-311-0x0000013BABF30000-0x0000013BABF96000-memory.dmp

Download

memory/5888-310-0x0000013BABF30000-0x0000013BABF96000-memory.dmp

Download

memory/6828-380-0x00000195307B0000-0x0000019530816000-memory.dmp

Download

memory/6828-379-0x00000195307B0000-0x0000019530816000-memory.dmp

Download

memory/6828-381-0x00007FF6462F0000-0x00007FF64641F000-memory.dmp

Download

memory/6852-373-0x00007FF75FD00000-0x00007FF760207000-memory.dmp

Download

memory/6852-368-0x000001CD9FB00000-0x000001CD9FB66000-memory.dmp

Download

memory/6852-369-0x000001CD9FB00000-0x000001CD9FB66000-memory.dmp

Download

memory/6852-446-0x00007FF75FD00000-0x00007FF760207000-memory.dmp

Download

memory/7132-301-0x000001F9F7E10000-0x000001F9F7E76000-memory.dmp

Download

memory/7132-300-0x000001F9F7E10000-0x000001F9F7E76000-memory.dmp

Download

memory/7132-299-0x00007FF686CF0000-0x00007FF687107000-memory.dmp

Download

memory/7132-374-0x00007FF686CF0000-0x00007FF687107000-memory.dmp

Download

memory/7132-441-0x000001F9F7E10000-0x000001F9F7E76000-memory.dmp

Download

memory/7132-443-0x00007FF686CF0000-0x00007FF687107000-memory.dmp

Download