6ae4246e9364d1980d971d1f60609d12d589bc3f36791ac9e9e84370ca049e5d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Size 1.6MB
Sample260827-ty1xpaxhpg
SHA256 6ae4246e9364d1980d971d1f60609d12d589bc3f36791ac9e9e84370ca049e5d
MD5 6163a39fe6380dee7b11de6e6c57ae73
SHA1 25b0c2199cccafffac2d1cc25ea6b64e7ff0d81c
SHA512 9a444c471f405fc42ad8793914d1c61ac7f68e81e9bed60c2a4b156997ec10a95e21b37d1ce5237edcc3719cd166af6e01080a7f5f6d642cf9e57e78e81e9eb4
SSDEEP 24576:sVT0AYyRE9Wx/tEX6PoC0jIMuuILD8F8tEi5klhtKrLlzb6cd:s10AYDWxyXGohjIMrIfHSa9fla2
TLSH
T1F775BE1BB25118EAC2A9C074CE16D131A761BC4D0BF299FB3581F2D92D36AE07F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2056	alg.exe
728	elevation_service.exe
2128	elevation_service.exe
5816	maintenanceservice.exe
2584	OSE.EXE
3676	GameInputSvc.exe
5908	GameInputSvc.exe
5956	msdtc.exe
2528	PerceptionSimulationService.exe
2696	perfhost.exe
5316	ReFsDedupSvc.exe
5912	locator.exe
4852	SensorDataService.exe
5340	snmptrap.exe
1172	ssh-agent.exe
2264	TieringEngineService.exe
3440	AgentService.exe
3924	vds.exe
3184	vssvc.exe
4448	wbengine.exe
4716	WmiApSrv.exe
5308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5ad72459e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5908	GameInputSvc.exe
5908	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2484	2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
Token: SeDebugPrivilege	2056	alg.exe
Token: SeDebugPrivilege	2056	alg.exe
Token: SeTakeOwnershipPrivilege	728	elevation_service.exe
Token: SeTcbPrivilege	3676	GameInputSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	TieringEngineService.exe
Token: SeManageVolumePrivilege	2264	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3440	AgentService.exe
Token: SeBackupPrivilege	3184	vssvc.exe
Token: SeRestorePrivilege	3184	vssvc.exe
Token: SeAuditPrivilege	3184	vssvc.exe
Token: SeBackupPrivilege	4448	wbengine.exe
Token: SeRestorePrivilege	4448	wbengine.exe
Token: SeSecurityPrivilege	4448	wbengine.exe
Token: 33	5308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5308	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 5908	3676	GameInputSvc.exe	97
PID 5308 wrote to memory of 4900	5308	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_6163a39fe6380dee7b11de6e6c57ae73_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2128

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5816

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2584

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5908

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5956

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2528

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4852

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5340

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3184

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d980f46bd053ce7a4862788a500bcab79779cb66422afd2afdb18124bb8eca14
MD5 45d740749a8bbdb2e4c6d0becd91728c
SHA1 eee8dfde3db3d9ef2aa1d3c3d7529c5aa440ada8
SHA512 cc9a879fa4c2acbe81cb2d99ae1bb1ece961e216505b38e257f5bf11b8f059e8858ef0cc58083d8b9b675dd934a4cf12a1367fece59b3d617f9b9f0402a1bbab
SSDEEP 49152:hb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnhIfHSa9fla2:n3q6gjBfflh
TLSH
T12ED59D03F2D901E8E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 018fc3af7b18278227fd325008d949a48f0045122b93079987bf6a833929cc2a
MD5 e0bc06bd252c16cef0eac2760de84d23
SHA1 2b457e343260247a885b4da9868b7edd84f16821
SHA512 e04657dc5742170a71e9569f53aa61df90f91ebce2d61ce8f3e765f05091d9397d8932a6c5918c448405115f29ae3eba5083b5dc22f548f919d7d57e1a072918
SSDEEP 24576:mXYYDtczAKILD8F8tEi5klhtKrLlzb6cd:ctcTIfHSa9fla2
TLSH
T1F305012577A009F8ED67817CCCB19511E773B8804BA0E79B03A4956A1F372E85E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a2bcf29193d9f9bd2d84cabbe03c4b73aedc40cad313effab5db4d2d7666c683
MD5 770290c15ebbf9c44170ad9e940f9441
SHA1 7eb481240ed292d27bd7b804a4579d985eed4e72
SHA512 76f80db66ed6c77ccb6a65cb8837c9c9b6ff057b6126efeb34275f0c610d3a2709fa07a572d2ac5fbe7fa6e964976429f5bfa7ef508bee204560f573d3e81b99
SSDEEP 24576:203eVJ40hmxOrMcILD8F8tEi5klhtKrLlzb6cd:23J40AoBIfHSa9fla2
TLSH
T10F45AE16F6748335D073C0B9C5D2A69AEA7130815B308ACB4296D77C3F6B7E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2bb1a01024ed5100b96c3c8b6834ca3edf9ec81efa643b2b43ddc3bbf87159ea
MD5 c93d96780543a25ae5ca01b9bbc345c3
SHA1 44438866f8b71ea22450d04611abac2550d77315
SHA512 f019f40a9c380c0f7569767fe038660644530c00d8ec3987eeff1c50ebcbc59305b9227b8ba83bd3f7ef1400de4641f02528b6f133e78049ab56b60bacb05efa
SSDEEP 24576:WZm/ezSC6vUyD/aqgrvW/6q8wyu4ILD8F8tEi5klhtKrLlzb6cd:3/ezSC6vUzPvuHjyzIfHSa9fla2
TLSH
T1B6756D25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 30cf19cfbb4f66eb34756bced7fda90813639b2498b1306d9edcdb908f3d09ef
MD5 a5e2fa352eea403b4f7768e813264ad3
SHA1 806c4f02c78519613b10a657e9f4ee957db097e3
SHA512 b753aa783d60803889ce0062bbca861ef422e2cc459b34abd0fd9a1140b94cf08fe83e01d2a9ed7a3310315cca3a30400d365a6ca52f24af95741128d72acf9e
SSDEEP 24576:oAbxPrw54v/l+duILD8F8tEi5klhtKrLlzb6cd:oAhw54Xl+wIfHSa9fla2
TLSH
T13D559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E6B7E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 506adea272865fa0e8dacb03fe63d00eb316a8f967a476850d72c3e26cc2bbb4
MD5 861a39610bd51d1f70db159737e20064
SHA1 1e0cb66b7a38ed05b653e2b0f21653e0c2f0dc4a
SHA512 6644c5dbde483573a78b4757078b1d54cec8b0da8500aa4b3473c161124ec806e2a27de781fc4a4d732aa203f14c9b182e66ec290efd893e84f93fe8d3002274
SSDEEP 12288:+uSLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:+ueILD8F8tEi5klhtKrLlzb6cd
TLSH
T1FAD423222E208344EF492074193C35A167A5B8C05CE9DA7BCB7AF5DE1E3E1F5811ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 5d38a37a3dbae78835a47840ca6c844cc58823cf1cbbbf10a2f1a92cd0b1dd6e
MD5 0afb3fa262ba9c9b8d9117654321b3a8
SHA1 478fede098624344337182a90e89a287e7971eec
SHA512 cee340c15b5af201db5735de80d0be0206930f37b8c6ccab4d2155f387cfd2830f190665992dece6b50fdfdf07bb9160168d2f52acb662e55f3aeccf5c5d6034
SSDEEP 12288:zeBNUbTVO86UaLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:zJIUGILD8F8tEi5klhtKrLlzb6cd
TLSH
T10115DF3BAE28FCD1C67E5DB85A518240E77274704F62A3CBD275C24E9E275E10E3AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 b79ec30cc5f6fc589934d1464a523970f57347989e49fd1347786d12e4b8282b
MD5 f6980b93b5e93b7db8dcddd5ab5446cf
SHA1 0f31b0d126c327cfb2e7a849f3d3083088491c56
SHA512 bf5deebe8a0e33f630f0ff4f0c34914aa238c29926fa5dee2d929d8924c59c804cbe40665ac0a069922e52f00587d2a75a990c1ab3e5c77a4cb99777616aeb97
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJI9DN5JvNRV3THJ:5QvGAdlCEL8c/IRNr5Ckflh
TLSH
T183367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 5bb076974ed038d3e66e4d82a4f32eceacfe6f518a280bb7cbdc94b6057fff83
MD5 b4782d5590a8e8cf39611267f26b0d15
SHA1 3a005f01d8b0e70aea2bfcbd08e1f6034113ae84
SHA512 5167455f376c8f51d014b1bbd35c105985527d6cd82885c8a8cf03f7be4efa108fc6c2b9bc7a35c0e72c62259ff3c29d28baf1eb555606c5d807c43854169b94
SSDEEP 12288:xgwSfxL/2Dc3bDLLmt0LDQewsAjeLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvz:mmewsAjqILD8F8tEi5klhtKrLlzb6cd
TLSH
T10415E031FE70D036C77B0DB61B39D716156DB9604FA11AC3E3A8899E59342E22336E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7804c63064037dda56ce6a5dc2c5d39134243654a5686140081677891b62218e
MD5 d534ec5b7573463271b61487cf2b7a0e
SHA1 d14c0d0321be55ed4289a6504984465efda69c9c
SHA512 6888bab1679458f7b1446205bb3e03730092d9b91b6207266809908f68974cb8a3beb832800b91ddcc3246b84f3a425875f42fb58db482df499cd9ca1c390e0e
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrldPlbuJH4lh:DUEtQevvqc2W1cpV2Xr324lh
TLSH
T11B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 343b9e2fe25d749d8d3c46460c50441d0c7fa904774d4649c1239893e4710f8c
MD5 0f9bc7087b58febcbf0317b1bd1a524a
SHA1 065f7535ab6a8f0d483504bdcd22a37ee0d6f6ac
SHA512 921f6a470b1658782ca55dcba707fd84cb597a1052caafcfa86010e153123e0d85effcd0d0ca2367e92327bdc327b32db340f49b4ddccb9d21a1764c918bcc4f
SSDEEP 49152:YCbRquA/m2yL5zMfFiV+XenmE3/zNIfHSa9fla2:loq1VjnmDflh
TLSH
T146D58D0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5253a2272df48581477b472398183371167b19959baa08b58466d557d64fca07
MD5 a09c5f5ac68fab367543716fb6ad2cdb
SHA1 bfbe147eaf83972d1fd8190720bb50383806669a
SHA512 b9f0513686d33455640e894e197f3d0ee7102c6871d20dc498c137609825ac2afdf48e3010fbb1fb032a4d4d8c97af49dd84aa304807cf71ba55f2bd56e599e4
SSDEEP 24576:bAhGLvDFoiwtA5l7S53wILD8F8tEi5klhtKrLlzb6cd:bAMXFoiq5AIfHSa9fla2
TLSH
T17745AE81EBF945D4F5B3AAB899B59170EA76BCA55E31C20F1260D10F0E37A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 16b0a5b06136858dfdf2fdb024ad48ff9967cb7ac11d0d7952caef24169fbcc5
MD5 822d11991704d629f581ae8caf2acd1e
SHA1 9b131c05330e83696d806d9efb8deca32558e0e2
SHA512 3e32276637c99cb793d135028a394e07cc15ccdca455698d95a7a089d70ce26b564761e7398fb80939cc5491053229bcadbbb335174a535b9aec3810cd45d088
SSDEEP 12288:Smw5HEjsChNYBFgl0WVm+CmLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz62:LwuROWbILD8F8tEi5klhtKrLlzb6cd
TLSH
T1CF05F14636A40CF9EA675138855B9132F7F2B8412E25CB2F4770C65B6F3B2616D2EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 76159e71f5f9d2c33dad837c304ecbc9e883f2ae966dae31ebbd00867acf1412
MD5 1c57fd328f42bdceb3ba436d15ebcd0a
SHA1 74308bfc6602c1692971e2aa993dde227206c141
SHA512 cd8b4304e08b2a8feb0ef121900f3615adb981a1b17bb7ef2027f7272feb2f0fd2b50f6aca07a84a0fc3209ed302f8d80559a5a5439969069ae81a07a1dbc055
SSDEEP 12288:b9d1I4xLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:Zdu0ILD8F8tEi5klhtKrLlzb6cd
TLSH
T16FE4125637A062F4E656117C8CB82641E372B4911B76C3DF4779829A1F3B6E20D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b0fece1ecefabfcdb3181eb342e043354244c7ba7df8fe90e6b32cc6aae4182
MD5 888ace1cdbd5aa26cf9125e3d19d14eb
SHA1 66a6aacaa979705d715ea10f0a3281487c8c9e05
SHA512 4ecc8d025af3b96ea28854b9f04a04466ec14e26cbcb3aafb6c21c8317a838aa4e3f1c363bcefbd020b9a37f0f0225cb2263afd4c315bb22dc63656befef5c40
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ur:HQRQyi36YOcP8Lvw2gAf+PN3Hflh
TLSH
T121667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1fcfc30c5d9cf30e340994931fa5510fb60ed8d8cf89b996b49b878e6140e59d
MD5 9ce7c49b59ce1651b0a1eb22cf00da82
SHA1 e7384ced155b4279779ecec30b39fa016b8804b6
SHA512 c74cefd5ac36a93f089c9ccd83e4855b39ce0855ad1bb7c3f7891173e85b32f97422ace5bb4a2d67da0e6cc020dad2ed9bf6117333a016b9e8605d8cc96bd254
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uy:HQRQyi36YOcP8Lvw2gAf+PN3iflh
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 10117fdc20680c4feb66551686bf6be552f509394ef892c41a57a32c9b0b2378
MD5 d67a3b277d20d02adc76f434dff4e63d
SHA1 11df3b407010227e5a08dd23242536e5a30dc80c
SHA512 e7cc7a36513a08c2b14ea128b92b6c4353dc8bb03e6efda97cd8962f2d2f69714d05ead070d417806ec76c1440f9b1129f95966dd6d46122ceeac8d06ce92aaf
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0VILD8F8tEi5klh0:+68Qg55nhMeWu7PNU3/YIfHSa9fla2
TLSH
T1B1B55933B2F20099C44DE1769F4A973196D17C718FE1E3DB8615720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7b13875f3452fafeb5f3d0a992be8c1a412443d872ba4b3126630fd4e2525ea7
MD5 e25654580ee830d618496addd65ab0f5
SHA1 c0f2f2092f616c4fc008af01cef9389cc1f634f8
SHA512 cba84cf6191095143e7919a4d7fa3b5b5f43206c30274a18b57f09becb85563d32a1c986ab289fa6c16577bbcb6a7881a3996c5fd71b629567d4b65819fdb1ec
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99T:By5112gYy5azzVv569nLKnhZ2flh
TLSH
T198168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a7e5249170f3db3efce7fda051a6ac059f01681f20f1821581c5d6faf55290ec
MD5 d359d7fc127d96c8877f48f0af0104f6
SHA1 aaff5268d56f23fad6f01c7dd4b71ae69f72cae7
SHA512 b60a53abc98b450b27bebfdb010aa417c96c6c63ece62ec78e2058730fd0084ab7ca23c5fc7a7fa2f8e1c2d5d4890d398a8fa06312d04e3459d92a073d04a316
SSDEEP 49152:EB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glpIfHSa9fla2:eu6JmTxd2dgflh
TLSH
T13AD59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 479911583334e53575e276ac6b4495a1c91eec43b8bd7078de69eaf0deb41082
MD5 b956fef1e3265e99cf12e6b2f8b6ff51
SHA1 2fea24be17913496c55a18a21ab4f9c6a69fc4f8
SHA512 c327bc42230cf3febaa8459ff5a3152825e673b20445b3d1734b1b1b68bafa99ce082b7b82a9c40a19c54ad9b09b4472f4284b281c0e09b2ba3e7ab9c6944f8d
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4xQIfHSa9fla2:ImifPbR4flh
TLSH
T14AB5BE13F2D901E8D05DD178875A9232EA62BC450B34B6DF0A90B7962F7BBE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 11f68d389632d6ac0364c8796cd704a48b390111f0aaff15b615833ae000a0a6
MD5 13c44b79a5fa59a055faa3ec3c5f0470
SHA1 be0bcdc2ba06eea1777ee112aaec9f2ce995fdf7
SHA512 664390e23e764124786ef6f313fa191423c1dccf01bb198739f6e70b96157a220b9a9699c4e3ffdf977793c675ccd6bbfb75f9b64314670c4d2200c6050a41c2
SSDEEP 49152:uSuZQIY0Be2K6RVtOnks6NMHqFIfHSa9fla2:g5dKoi618flh
TLSH
T181C5BE03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a1cee9c9e914c10c919bd7eceb89f1639ff3ae190a1a8b1793ba069a432dcfc8
MD5 9afa74a794a979a0cf8b40baa92b7083
SHA1 44c30aad9e97163b9594f00ec4d3f57074d86c86
SHA512 6c6b5f340cbc8935881be8c0d959f690909c98b5ee7e083aed408236be35290c2afbe8bbb886514e5f3afd0baf422fbc7407f913c599e708ce2288c5a4fd208f
SSDEEP 49152:mhtSn8EApI0figTgiDn0AP5wlIfHSa9fla2:nX2iyphFflh
TLSH
T1C8A5BF13F2D901E8D05DD178C7568632EA62BC010B35AAEF0A90B7561F7BBE45B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 69e997494dd6f6d18db208a90d001b5d7dd8d5474ee4c146616648e75160057d
MD5 e7c63ee96ef62a5db21f0badedc83c5c
SHA1 ac9434c0d0895ccd3c2796cc0295640139163377
SHA512 f9b805a75767e6b92dc42ca0e022f5392d2d2745ebf71658e1afa6675605e2be87aca0f6b4db348737df53921879176d63a6265fe9286387b8024d35411f3bfa
SSDEEP 12288:XRLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:X/ILD8F8tEi5klhtKrLlzb6cd
TLSH
T189D423122D618744EF4831B4493C3191A7A9B4C06CEAD67BDB7ED0DA2F3E1F5011ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 dbca2fea8d703b0761ca0952f7e25671bd76538f7710cad4c8cd00e789ae0d7c
MD5 c065bce0ebc8a49bb3eb80f2c90f53fa
SHA1 4e7a4800998fa6aeff426be613bec33c9f19c309
SHA512 1cbefced23b856e9635a3eedb61abe4dfd2d0b90e39dbdb006ff55b7a54c241880721b1001608e4c34bf7ba40840dda4bbafeb992e05a4b41d7dfc7aca64f84f
SSDEEP 12288:lRLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:l/ILD8F8tEi5klhtKrLlzb6cd
TLSH
T140D423222D618745EF0831B4493C3191A7A9F4C16CAAD67BDB7ED0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 d43906eeb36e295733150c155abe68e734e3db6245ba624129bac95c95ac10f7
MD5 995882de29c08c0c359fcddd4857f124
SHA1 15267b81f4e4af8539fdc9ca411d8a69a2496848
SHA512 41a90391b08379543aaccd5947d82eb0445e48e193949177fe46663ad4dafef8fdbcc85a1add639800d656b8a35a2942e418a72689e75b49c7bc68d0c2dfd438
SSDEEP 12288:/eLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:/qILD8F8tEi5klhtKrLlzb6cd
TLSH
T18AD423122D618744EF4821B4493C31E1A7A9B4C06CEAC67BDB7FD0DA2E3E1F5011ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 1f00d903ee9b4e6e96699f0de186d03cba9deb73a3e7c353f54aa55c67eff54f
MD5 44f831b60f01746b3c690bdbea63c12b
SHA1 cc583fa67094ed951ccc839e934b229888b98d78
SHA512 f358488075b0da3280d4790e9b8bc8d829983f59e4fb60961df9c39f5c8e4035dc47b4e1604d9264738bfddbd40b45b3fe775ef1f823c5880ae22f172788be92
SSDEEP 12288:klULhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:NILD8F8tEi5klhtKrLlzb6cd
TLSH
T109D423123A614384EE5961B8893C31A1E3B5F8C05C76D77FCB6A84CF1E3E2B54115EB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 d5934e72d64bb04c26f0d104dcf0a63d9175dd4261b17246b4c40e93b8c56fb1
MD5 589b012b439ca771083079c7eeb231bb
SHA1 6a57a0304b0a06e754838b576d0b1b07e8c808fe
SHA512 b23a9d343770e82c5089b085ec99b73b693a867eb2796127a109e07d25dcfe47a09a1dfe7ef06f28af6a4f9a0197625d26214ccb3def529193d4da484918a2ad
SSDEEP 12288:u7Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:uBILD8F8tEi5klhtKrLlzb6cd
TLSH
T165D423122D618744EF4831B4493C31E1A7A9B4C06CEAD67BDB6ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 b13d33a30967a6e7017879877b7cf69089c041147a8ae8931aa5790f9c2b0ad5
MD5 d9de104f1ee663cf03916cbac6a040f1
SHA1 c637ffd874b1810bf0151582e615b0004fb93331
SHA512 c53376bcab9d6edb28bad6a6bf4c139dee53a0924de1f3510c739316f2fc78209bbb6560c026d0316a7316e52353aecc1ca939b380a39345e62d636e086108a9
SSDEEP 12288:VbLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:VhILD8F8tEi5klhtKrLlzb6cd
TLSH
T198D423222D618745EF0831B4493C31D1A7A9B4C16CEAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 736df34965b6402f0d5f779983e89301b0ef64604db0f59980ccb513ee565255
MD5 254797ba07aa6ea13cf896c98fe66c64
SHA1 e14d060befb3dceba9537fb3b356a40b1cabf946
SHA512 a55653a38d03142da9e56286bdc6d8eba6e6ea6e13706428086411ee9c08758e2da32c0a659f16ad0456c1906b16f2a2badcbae4e8ea87fa2f3d1a609c69b22a
SSDEEP 12288:ckLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:cQILD8F8tEi5klhtKrLlzb6cd
TLSH
T13DD423222D618745EF0821B4493C31A197A9B4C16CEAD67BDB7ED0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 1810bde7ce5ba75a20d8eb6f4520e34caf4c3a0fdd31d0b52e925b02adea4076
MD5 190ee258627e686872243da184db3c62
SHA1 9c53720c61b0015e5dfc5717a5799f64935a88d0
SHA512 a04a8ea97d63f016809d58d68532f6109576b85b35ae911e245cb70a76179c19eb80039cea5cca09e7a2ec2468475435559c4c15f61dbe48c1b1700813e0f552
SSDEEP 24576:HZMZz8cSglILD8F8tEi5klhtKrLlzb6cd:HZMZzL/IfHSa9fla2
TLSH
T1611501A5736009F8ED67813D8D295956D7B2BC550AB0C61F03B8366B1F373A10C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 66e56fadf3e927b4b20a7c1aa919628317f5538d339ffd9da341c5ab11327c62
MD5 24daeb4192e3fd313a122ebac5f608be
SHA1 b0f10b490d9ae088a6a0a94b877928c3a7f40557
SHA512 4a4a391bb650bf42592710124322ece88bd864a7ec713fe809b92b44a6ebc7afef0c021ecc3d4d2580c26d95d2ad8cf3d6ae1cf962a257a9c7b26a67cb12ea14
SSDEEP 12288:vSLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:veILD8F8tEi5klhtKrLlzb6cd
TLSH
T190D423123D618744EF4821B4493C32D1A7A9B4C16CEAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 9582fa7d34efa0c7d399c253b4d9268469d2b8d453d4b332f0bb838364683d18
MD5 5167ff9da6a3f462f1643c32724219ad
SHA1 b74d9ab50fb60c8456e9ad26ecbbe23836a1f9c0
SHA512 7bc7af45422e1310a9c5878a59078348452203fd235526e9276919dcb8c31c2045d3f902d49d26ad6e0864fbd0f6422058da8264c21c1e64b223433e92a1abf4
SSDEEP 12288:NxcLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:NOILD8F8tEi5klhtKrLlzb6cd
TLSH
T11CD423122D618745EF0821B4493C31A1A7A9B4C16CEAD67BDB7ED0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 cc63ef7d9aab303fd473d0974c0b928abadee89434503bbeb2e6e1dd7c76a585
MD5 87f4d70ba4157d57d9ed37651db9465f
SHA1 c8a3d5292e91e0dfccc2920ea9e9afcf498254da
SHA512 b448fce3d221ddf4c743a75d56319fb0b6df017b1075bc2d320059dfa23f992c99e4ed9654a0daa47bfc16f85888fe55cecb093185257554f1a579193eb494f3
SSDEEP 12288:LJPz5L80Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:9zygILD8F8tEi5klhtKrLlzb6cd
TLSH
T15BF40213376121F8D62A513888652A52F375B8710F65CB6F57A442BB2F3B2E14E2EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 9cfbd9fae29d904e206b8f562d57c9419b5e4c45b2915d64158dc8f9b708c12e
MD5 1eb035e1f807386f4980d06bb99c17e9
SHA1 2900fa6d34d42fb11f5d9bdeb052f5ed9c3014a4
SHA512 571723b7c4d9cac41a4cc6af040281db318c4e94f01cb4b307886da48e21f1fde676990314a31d39fd4335c2ab47eacd62d5a2a22e6dc530bc280928cc029e89
SSDEEP 12288:v7Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:vBILD8F8tEi5klhtKrLlzb6cd
TLSH
T120D423122D618744EF4831B4493C32E197A9B4C06CEAD67BDB7E90DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 dc7d487db5e6f8f7607ee7eba6b011043cc354da6b875b8ef72b816e76a64274
MD5 2f355a19403685687fea4fac62018122
SHA1 48853367da0b946973453e5649c867559956247d
SHA512 2236fcec08dbfc16fbe65102ad189d6b2e5a2ea007c6caff7b9ef1e809dc8a69188e5ce657ec2199dcdee9ad47e64650d6434799058a3e471a1acc40b756eaae
SSDEEP 12288:r9Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:rLILD8F8tEi5klhtKrLlzb6cd
TLSH
T105D423223D618744EF4821B4493C32E197A9B4C15CEAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 1c9cfc3da8357a1e692b9e25d71014ad33d39a29c8217c22cbd6fc0cfe7be1c4
MD5 f8b46004e70aaccd8e76790a422c01e0
SHA1 a241e9beaa8565699e6f9b6f72874cddd79b1be9
SHA512 e7deac0d10135ee5548e52b5756daa3dc854b465cf0e66b7170f59ebf820fa815c36f8cc3716adb7a88618ba4c1c6d14333a6dff43ed0dd51c1c9fcae928b33a
SSDEEP 12288:qJPz5L8ZLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:8zyHILD8F8tEi5klhtKrLlzb6cd
TLSH
T14BF4021737A121F8D626513888652A52F375B8710F64CB6F57A442BB2F3B2E14E2EF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 0a23b568fba739869a2d711c9dbc2450e456f412737235790a53d5dbe74d8f0b
MD5 b9391abf90ae806084f467bfd46efec1
SHA1 bfe132bb0032896c12645f838ffaf317773c567c
SHA512 b740b569662fc9b7c9435eba4c32e0fe380b5ab4976be8ac2805c090bd7e2ceb4399d65b2ed8304164c3ecc21b1c58f0066c98dcf68ad18b00b3b4eb3117c001
SSDEEP 24576:KTiaL+3z0z+kILD8F8tEi5klhtKrLlzb6cd:KT5L+jQIfHSa9fla2
TLSH
T1C91501A5736059F8ED67413D8D295952D3B2BC550AB0C62F03B8366B1F373A10C2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 76199b99877c924449bed0a9dd4676352f4ed546850affea17037a446537a320
MD5 780f092ba3a97b6285aa4142c91848bb
SHA1 1c3a1f42f9aba05c596119b79077f6f7037df4f1
SHA512 8dfa252c4b853fb0546e6cfb5b1f3e340f22e1b2053a24ca11b07c74302758a4da946b5804ef3b8dd4212eeba2994d7c84c62da67b80b5666520278e14d3d241
SSDEEP 24576:f3KdCCAmy7mZMILD8F8tEi5klhtKrLlzb6cd:vKdCCAmyKeIfHSa9fla2
TLSH
T1F435DF90B3E411E8F1B79A348D755512DAB67C991B31CE8F03A8265A1F336E18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 260917a7859ffd81736d2c0b4f7a423011674043a9188a6aa20e7abc67df7d45
MD5 6e952a242b49a639dc9ae4e2f5725490
SHA1 7cc8e78cd8e84eac3253d178a270ddaf740e4bf1
SHA512 5f930c25686dd8259a99eae8ca088dd7221bc1316af082c155eebc199de619745a04c693be1216118a7559ba98a8f04814ac00765d7f7f80a50957586d73718d
SSDEEP 12288:heLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:hqILD8F8tEi5klhtKrLlzb6cd
TLSH
T18BD423122D618745EF4831B4493C32A1A7A9B4C06CDAD67BDB7ED0DA2F3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 2e223a45fcef05f7b121826afc11acd243c6086c4ac15b6c7712fd1708e98a9d
MD5 e0705bdb70393c737ac4e91d408ffa31
SHA1 f1029ed5f5bfe560f451f605132c8867271f2119
SHA512 5a4a6a0c18294adf9816842ff5adaf7adbfa04b11757854a4974a3222ed8e79ef531fa93806409661fea2cf76a662efe0c2f5bc5bddf0176a05f0fe120cba0e7
SSDEEP 12288:RWLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:RiILD8F8tEi5klhtKrLlzb6cd
TLSH
T186D423622D618745EF4831B4093C32A1A7A9B4C05CEAD67BDB7ED0DA2F3E1F50106DB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 e4ee98df6b79473b5afedda6af1664029f87b752843dbf8ef676ee46cc409b64
MD5 90df485a066bd834b8be8651186be320
SHA1 2363c04a9c4fdfafa7f27992ed792132339e3d82
SHA512 2378f6c50ae54182fabca57b73dd1661727a8992cabdb88bf29a01f1a96b15a7c7f02466efff691b8f48cf6d2cb6121f234346bba2d283d8241179f9c64310f7
SSDEEP 12288:i4Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:i0ILD8F8tEi5klhtKrLlzb6cd
TLSH
T13AD423123D618744EF4821B4493C32A1A7A9B4C16CDAD67BDB7ED0DA2E3E1F5010ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 40903f617f7bfa631a17da55d490974191e0fb685097c3b6def7a5d94b7a14b7
MD5 0190cc03bb91e15d8822dc1af45b1bff
SHA1 ff4a9f6acd2326ffaa9008774ce0aa11b49efbb2
SHA512 199d6320db70015f272bf76f02cb66bc9b3bf8b36ea57eac6bcc0f2fc7d052605d5ab710becc0ba45494aa9de8977ca433044ab2bbb1580ec43c584dab3dee4f
SSDEEP 12288:10Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:1gILD8F8tEi5klhtKrLlzb6cd
TLSH
T1D0D423123D618744EF4821B4093C31E1A7A9B4C16CEAD67BDB7ED0DA2E3E1F5011ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 3635fce8834cc055bbaaf6e7b81454ea77422870367bff3efea8efe091b00ab8
MD5 e05efb6bdc910d9932c16fe82fdb58c7
SHA1 6833115fc5c0386780b5673e02c1301ccd2c8f26
SHA512 2f7e696d094b382d38d34134c9709383525fbc7ff30a5e963a298123a4b9e75c614d0fb1351507494715fe72bdfc8701092cf901fe9fc6d71c9b864d4e58f4ec
SSDEEP 12288:RTsfoLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:4kILD8F8tEi5klhtKrLlzb6cd
TLSH
T167F4F11AE26442D8D55E6178CB292641B3337C608BE1D3DB57D0F47E1F3A2A04DEAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 76dda3f1dbdf0bde40f9c1b6c4003e95a7e65f24dbf508ea2b38047c06ca315b
MD5 c2f65d77267baca73522ef9993488f63
SHA1 fb78bfc722bb4f82b00bf9900a93228bd8eb993a
SHA512 4d8300fa3dc3b13fc331249f900423f1e0552b448050c11cd5d145e88b22ad413a2a2a5e3dfd0d50c35910152c3eadf7701d460154985faa1d74f41354012fa5
SSDEEP 12288:Ke7CLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:pOILD8F8tEi5klhtKrLlzb6cd
TLSH
T14CD423232A208704FE5C31B4093C31716769F4D01E99C6BBDB6AA1DE2E3E1F5452AE79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cf07c78ba3e50d8f1867d71040947a45a1ec6fe803534a03b53644d1507aeabc
MD5 15ded37a48bf166b4b77c4f4a6df6a8f
SHA1 08022b9899bb369fa79febdac5e46de63c2f1f2b
SHA512 8ebfb8579487bfa632309e540ae5c82be6efb73be109ea9742545de33b772e79275ae009269f4b9609e492335bffba64c3e1297a3eb0f9647a95cf1e2cf18cf0
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bY6ILD8F8tEi5klhtKrLlzb6cd:2gb4mBIBhGFBIfHSa9fla2
TLSH
T1F165AF1E22E802F5E1F9E2B8CDAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 473a459d2ff6a2541bbd454ab1f6752bb48d5bbcfabb0853fb96a82e09149e9b
MD5 99b4c51514fa85c352eda17f6131eaed
SHA1 3c0ebfe5f1ead15df0fcc62331b98684b5bac701
SHA512 44f4c12ae5007309e475776febabb6d2848af7dc6e35e07defdbe3c310c94fdf1800f9d0cfd3a389fea1c109024077fcf5086bb0f08d4881ef24254ae6f8e248
SSDEEP 12288:0sGeLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:FGqILD8F8tEi5klhtKrLlzb6cd
TLSH
T15DE4122A39B16284DE396178483831A2B7B170D05F6596FF8BE5D0BA5F3D1F01239DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 0850adb3b85dd06f5c4120489ed59c0f2c64b506ebd2e67150e8334b672c0a9a
MD5 93ecdb9c10c739738ca2177516efde3f
SHA1 5ad712e6d365539928f0c037cd7168b969794457
SHA512 eeaf39df2fc6512a5ae3f6af2837ace9697204ef15a692fdffbd51d378840d9f73c58a36fa97e1632b9cd33da4695fbd3923ec34f54bedc11e95cc863b6b64fe
SSDEEP 12288:uZLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:uHILD8F8tEi5klhtKrLlzb6cd
TLSH
T128D4232229218744EF4831B4093C31A16765B4C05FEAD6FBDB7EE1DA1A3E1F5013ADB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 2924d57c60414d5e2b6c9906b7b8ab0518d20466db9dae3c0a5741541c726429
MD5 4f9ddbcbd5877ad3a28f0a172aaab224
SHA1 8deaa36cdad54d27003d93618e6ce7d14e7c0d1c
SHA512 e63ef3bbace4607aeb4c6cac6278ba3f050afd53bbffa7ad85243e190bea10ac23e95a8ac897b1fbb78f183d14df162fdb7c9adf5969210c5c5feb5e6d841a8f
SSDEEP 24576:5CL8w8FpJqH1Mzria7/mYILD8F8tEi5klhtKrLlzb6cd:kQvFPqVra7/TIfHSa9fla2
TLSH
T18835F16576E002F0D47BE13889564663F7B2B4210764EBEF07AC8A951F276E50B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 252b25a6d9c2340ba90f3c8158d1f698dcab856539703dfdd48cd0ab2addc5cb
MD5 1e26d9a0a248ad1400b363ed056f5743
SHA1 1aff98286d1e4f92465efd3524b92850bfa08659
SHA512 5907230c40a110f3e82f875bcac6e14b8476a1187350b163b8e6afa3bbcc30f29be0b280204ded5afeefb7da94efcbde73f8d5f63fe0ef9b7a396aa966730a55
SSDEEP 12288:SHvUrBFrEjwaQTULhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:SPUr+NQTAILD8F8tEi5klhtKrLlzb6cd
TLSH
T10105F22F26A818E4E67AA17C89555719F771B4620712D2DF03E1817E0F37AE86D3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 f1b90866d3a95a1c23706efd550c081e3780866f3fae7b5a77a14dc5221985f1
MD5 1520b4e2d336537d53263181c27f890b
SHA1 82ad31d2712e352c1247f7a69f85c8cb95630885
SHA512 f17f525839a334b10abac30b095ff3b5ec1431b0bd0a7a2025957062ca6644af55ee86223977fd44a1c5847b53345463359c59fd105e0fb1a36810660e4d6bad
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYeIfHSa9fla2:2G05lO43bDfflh
TLSH
T15ED5CF6A62EC11F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 6050b914d3c1dea70b9df9630ea5819e718d34f4adf109a89eff35d266c92ba5
MD5 88924c5410f01e1d66ce7ccbd9206fe4
SHA1 54415bc30f537790c8b50a97f60a5ed1aa207751
SHA512 559431c2c5738ea2ff9cef69c8f2cdf86d46bff8f060b48b77b923bddfbb332a6e3470833bc8b1cbdc073828bce33503e741353f3250de16f30337f3f7c0d3eb
SSDEEP 24576:jqa5POZ3dpbWVM50JicR2hG0lasx2+47eidnQexGWJVi6TnEc+y24QHfsH1XZ1ot:ea5POZ3wJt2pasx2+mJJMInd2DHM1IiW
TLSH
T12F65BF5EA6FC01D5D5B9D17DC583461AF5B2342253329ACF012182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a744240cfb958494f4a93a018d075552e8b9b86b3c019952635259718330519d
MD5 12039a2a6fd3ec05e7af82c0a371790c
SHA1 48eadff96c77013e3a50098f9d7178b0c31ed534
SHA512 11b5dd3daad63a088e8ea4c8e57c9c6b86a9b5ecc65692fb6cfe3b4f5f4be37a87f918232d574621cea7af1f7213bd8a67161895adfaf0e71db924702a9df66a
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk/ILD8F8tEi5klhtKrLlzb6cd:SNc/zEOVHFgIfHSa9fla2
TLSH
T181858B1622E901E4F5BBE1BE897B9546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 764d0694696a8f6cb7ba1c9f7053f5c134347743142e555ffb946adb993a9808
MD5 8fde3c9d5ed32920009c33400cf35652
SHA1 4bde3dd65311b60189a494fe0e68a1c77633d763
SHA512 d56fd7b767b3dd9f57778bbceec48e096d2fb108bab94f5c71735bf2c262189b50618f063f8a36ba2616229a5c362d40bdc3628ff6ad8bf3f9ff962f9fddd4cd
SSDEEP 24576:JJnJPbzB4S/ILD8F8tEi5klhtKrLlzb6cd:JJnJv6S/IfHSa9fla2
TLSH
T15915E13DD2A810E8E4B7C2B4811A2756FF31346C2F2669D759B4D4353F16EE0A939F28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2adb7d25f7ed14b80e4b5b1cc856c87029a8e937bee976c619fe1290dd7b6b00
MD5 1ff9fec49542a8b291d059ae9b80f8a4
SHA1 7f55c0125576ddda7b229aa34438008d9e1a3ced
SHA512 ecd2fa19830536187e40c0cbf12775cb727f0b65e50f2ab5ede837a9da420ab58a7b1521412889775f6294a14f14972ec76c573894bc062f731a0d4fc378dd5c
SSDEEP 24576:GCLHGL0MoeVtFumTijCmlKQWDk6ILD8F8tEi5klhtKrLlzb6cd:GCLHGeeV5ijCmlDWDk6IfHSa9fla2
TLSH
T15DA56B05A7EB5184F8F3CAF5CA2694169B327C509B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 295e7fe399f289c135a15cb54b2e35696bc380094f4cb0c89897e4e37c6f0cb1
MD5 75ff01a821a7882d29420f870a47fb35
SHA1 40f3c82f7482d9181a12899767b7e943d6fcebcd
SHA512 4c59000153dd74700870325d3f829a2a6aa26af1de1f9e2e025b0530df3d0894a5b51616da1a67ef2e8f19fa72c78c4b0e7f3afe2f52fb158ea0fe581e479224
SSDEEP 12288:E1Hck6j5ZI73Lhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:M6DIRILD8F8tEi5klhtKrLlzb6cd
TLSH
T182F4011D337611F5D16BA03D85920111E3B2B0A08B625AEF4BA8C0BE5F77EE8B53DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 e54a9e7dd69ccd7a0e3bcd33c57741b0dbae8b77bb6981e5b90f6f52884b0e61
MD5 5a017b3e9f9786d0582086f086480b66
SHA1 1342ad83f494aee643504a14f5bc6cdc7aa97d7d
SHA512 270b317318abb757a63f33ba78e95940040d813d3c7da119448d343b0c86d2c766b014ddd5c4907619657f5d41cfb7f9ee46088767f39d81a510682cc9f885fb
SSDEEP 12288:sG6kyaLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:ttyGILD8F8tEi5klhtKrLlzb6cd
TLSH
T191F4120127A09284EE6811788A3A11A09B35BC505F61C7EF97A1E27F2F3E7F05935F79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 85e708b8776f26619c5e043dc583852c6dff4a119c61b72bafd83fcc42cd8c4a
MD5 e1420da75b362003db25159741f49347
SHA1 ef9772991d27ccac0507c6751563b675ce42a128
SHA512 5f49362d146fe6567903d6fcd40cf3feb407ca192667048c3021edb77d552dbcc4d27cb5f4d73f4ec10b7f0e03c92670e6213ea22e7b30b7d15a9dfe25139b82
SSDEEP 12288:hq9QLhk1LD8o+IGWHtEbu5kLnlfRls/ytKyvsLvNzvz6sBny0:89MILD8F8tEi5klhtKrLlzb6cd
TLSH
T16BD423262A219344EE0871B4093C32A1A365B0D01FA6D6FF9BEAD1FA5F3E1F50135D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8e2173773a2f332c672747fe16d6c1089b08b8ed241de8b423e664058a348dc9
MD5 526e23af05e0ab6d557d76025ef51bc6
SHA1 307a1ad328b783e6fa901bdb28c896007493d22a
SHA512 22e5e6c7435e0f2d1aaa4e92277b2a1cda5dbf069d8add1db471cea3285225f9c6136479876a21e8d2910abba0ec851e6f5fbd9e53bf6bf2337ae88d0c68182e
SSDEEP 24576:HggILoTfaidZUILD8F8tEi5klhtKrLlzb6cd:AgHTrZUIfHSa9fla2
TLSH
T198558C1D67EA06CAE2B2D275D8721493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 ac3a4e5059b008f3d445f16f4edbeb4d6db5473a1c98ecd22fa5793e0e25f259
MD5 7527dd12295dae15901cb19a47c1b3bb
SHA1 189f464ef253347031a57acfbc6dc3ce3b89c539
SHA512 1accbe02ccad8c9eab7cf8f4f450e04f24075b1d82da560b2e8db9f9f151f420b7b722c32102891490fc2dadfc1ae1f704969c4925d8e4d9ac6d5a0768c942d0
SSDEEP 24576:xrcmRNexGWJVi6TnEc+y24QHfsH1XZ1oi43MhWl:lcmRcJMInd2DHM1IiW
TLSH
T1DD05F10EB27E00E6E1BB813CC8424655F5B3B07063126BEF41A1837D5E67AE97E36B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2b1f54652344ac3593837fbae3399a9acc8fab5999274e8662f8fe392c99e16c
MD5 524aad1304e272e61c4ea761dd5dbe2a
SHA1 cbd1b28069c2b97334345d69322540bad46c9651
SHA512 6afcd0a0fa5567b3f31c34c80c22990d98facafd6356282266230338ecff32b5f917504916ad098ad2cf4a1d01617abb73e91f9b4b33b15f2bca0391d895fedc
SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3wIfHSa9fla2:K3Upow8sBwflh
TLSH
T12DA58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C1B8BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-26-0x0000023105E60000-0x0000023105EC6000-memory.dmp

Download

memory/728-28-0x0000023105E60000-0x0000023105EC6000-memory.dmp

Download

memory/728-25-0x0000023105C80000-0x0000023105D82000-memory.dmp

Download

memory/728-27-0x0000023105E60000-0x0000023105EC6000-memory.dmp

Download

memory/1172-318-0x00007FF60CD00000-0x00007FF60CFA3000-memory.dmp

Download

memory/1172-390-0x00007FF60CD00000-0x00007FF60CFA3000-memory.dmp

Download

memory/1172-321-0x0000015A05940000-0x0000015A059A6000-memory.dmp

Download

memory/1172-320-0x0000015A05940000-0x0000015A059A6000-memory.dmp

Download

memory/2056-12-0x000001D8B95C0000-0x000001D8B9626000-memory.dmp

Download

memory/2056-11-0x00007FF762C90000-0x00007FF762DB2000-memory.dmp

Download

memory/2056-14-0x000001D8B95C0000-0x000001D8B9626000-memory.dmp

Download

memory/2056-13-0x000001D8B95C0000-0x000001D8B9626000-memory.dmp

Download

memory/2056-67-0x00007FF762C90000-0x00007FF762DB2000-memory.dmp

Download

memory/2128-36-0x00000185433F0000-0x0000018543456000-memory.dmp

Download

memory/2128-34-0x00000185431C0000-0x00000185432C2000-memory.dmp

Download

memory/2128-35-0x00000185433F0000-0x0000018543456000-memory.dmp

Download

memory/2128-37-0x00000185433F0000-0x0000018543456000-memory.dmp

Download

memory/2264-329-0x0000020462110000-0x0000020462176000-memory.dmp

Download

memory/2264-328-0x00007FF6485F0000-0x00007FF648784000-memory.dmp

Download

memory/2264-440-0x00007FF6485F0000-0x00007FF648784000-memory.dmp

Download

memory/2264-330-0x0000020462110000-0x0000020462176000-memory.dmp

Download

memory/2484-19-0x0000021D75350000-0x0000021D753B6000-memory.dmp

Download

memory/2484-0-0x00007FF7D90B0000-0x00007FF7D948E000-memory.dmp

Download

memory/2484-22-0x00007FF7D90B0000-0x00007FF7D948E000-memory.dmp

Download

memory/2484-2-0x0000021D75350000-0x0000021D753B6000-memory.dmp

Download

memory/2484-1-0x0000021D75350000-0x0000021D753B6000-memory.dmp

Download

memory/2484-3-0x0000021D75350000-0x0000021D753B6000-memory.dmp

Download

memory/2528-263-0x00000202473B0000-0x0000020247416000-memory.dmp

Download

memory/2528-261-0x00007FF6312D0000-0x00007FF631419000-memory.dmp

Download

memory/2528-264-0x00000202473B0000-0x0000020247416000-memory.dmp

Download

memory/2528-348-0x00007FF6312D0000-0x00007FF631419000-memory.dmp

Download

memory/2584-56-0x000002D319380000-0x000002D3193E6000-memory.dmp

Download

memory/2584-55-0x000002D319120000-0x000002D319222000-memory.dmp

Download

memory/2584-57-0x000002D319380000-0x000002D3193E6000-memory.dmp

Download

memory/2696-357-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2696-270-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2696-271-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/2696-276-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/3184-358-0x00007FF7D41B0000-0x00007FF7D4680000-memory.dmp

Download

memory/3184-445-0x00007FF7D41B0000-0x00007FF7D4680000-memory.dmp

Download

memory/3184-359-0x000001A0D3870000-0x000001A0D38D6000-memory.dmp

Download

memory/3184-360-0x000001A0D3870000-0x000001A0D38D6000-memory.dmp

Download

memory/3440-337-0x00007FF788CF0000-0x00007FF789010000-memory.dmp

Download

memory/3440-338-0x000001DB4E030000-0x000001DB4E096000-memory.dmp

Download

memory/3440-339-0x000001DB4E030000-0x000001DB4E096000-memory.dmp

Download

memory/3440-343-0x000001DB4E030000-0x000001DB4E096000-memory.dmp

Download

memory/3440-345-0x00007FF788CF0000-0x00007FF789010000-memory.dmp

Download

memory/3676-234-0x0000015AD80B0000-0x0000015AD8116000-memory.dmp

Download

memory/3676-317-0x00007FF6EDB60000-0x00007FF6EDC28000-memory.dmp

Download

memory/3676-233-0x0000015AD80B0000-0x0000015AD8116000-memory.dmp

Download

memory/3676-232-0x00007FF6EDB60000-0x00007FF6EDC28000-memory.dmp

Download

memory/3924-349-0x00007FF613EF0000-0x00007FF61417A000-memory.dmp

Download

memory/3924-350-0x000001C30D8D0000-0x000001C30D936000-memory.dmp

Download

memory/3924-351-0x000001C30D8D0000-0x000001C30D936000-memory.dmp

Download

memory/3924-444-0x00007FF613EF0000-0x00007FF61417A000-memory.dmp

Download

memory/4448-367-0x00007FF74BD60000-0x00007FF74C266000-memory.dmp

Download

memory/4448-369-0x000001AE29980000-0x000001AE299E6000-memory.dmp

Download

memory/4448-368-0x000001AE29980000-0x000001AE299E6000-memory.dmp

Download

memory/4448-446-0x00007FF74BD60000-0x00007FF74C266000-memory.dmp

Download

memory/4716-380-0x000002E0BF290000-0x000002E0BF2F6000-memory.dmp

Download

memory/4716-379-0x00007FF7D5600000-0x00007FF7D572F000-memory.dmp

Download

memory/4716-447-0x00007FF7D5600000-0x00007FF7D572F000-memory.dmp

Download

memory/4716-378-0x000002E0BF290000-0x000002E0BF2F6000-memory.dmp

Download

memory/4852-301-0x00000164A5DE0000-0x00000164A5E46000-memory.dmp

Download

memory/4852-377-0x00007FF751FA0000-0x00007FF7523B6000-memory.dmp

Download

memory/4852-441-0x00000164A5DE0000-0x00000164A5E46000-memory.dmp

Download

memory/4852-300-0x00000164A5DE0000-0x00000164A5E46000-memory.dmp

Download

memory/4852-443-0x00007FF751FA0000-0x00007FF7523B6000-memory.dmp

Download

memory/4852-299-0x00007FF751FA0000-0x00007FF7523B6000-memory.dmp

Download

memory/5308-389-0x0000024DAD280000-0x0000024DAD2E6000-memory.dmp

Download

memory/5308-448-0x00007FF7C23C0000-0x00007FF7C26FF000-memory.dmp

Download

memory/5308-388-0x0000024DAD280000-0x0000024DAD2E6000-memory.dmp

Download

memory/5308-392-0x00007FF7C23C0000-0x00007FF7C26FF000-memory.dmp

Download

memory/5316-283-0x000001E2B03B0000-0x000001E2B0416000-memory.dmp

Download

memory/5316-288-0x00007FF6B2EA0000-0x00007FF6B35E3000-memory.dmp

Download

memory/5316-282-0x000001E2B03B0000-0x000001E2B0416000-memory.dmp

Download

memory/5316-366-0x00007FF6B2EA0000-0x00007FF6B35E3000-memory.dmp

Download

memory/5340-309-0x00007FF6ECA60000-0x00007FF6ECB13000-memory.dmp

Download

memory/5340-310-0x000001B790D50000-0x000001B790DB6000-memory.dmp

Download

memory/5340-385-0x00007FF6ECA60000-0x00007FF6ECB13000-memory.dmp

Download

memory/5340-311-0x000001B790D50000-0x000001B790DB6000-memory.dmp

Download

memory/5816-43-0x00007FF7ACC40000-0x00007FF7ACDA8000-memory.dmp

Download

memory/5816-45-0x0000021CCCFA0000-0x0000021CCD006000-memory.dmp

Download

memory/5816-52-0x00007FF7ACC40000-0x00007FF7ACDA8000-memory.dmp

Download

memory/5816-50-0x0000021CCCFA0000-0x0000021CCD006000-memory.dmp

Download

memory/5816-44-0x0000021CCCFA0000-0x0000021CCD006000-memory.dmp

Download

memory/5908-241-0x00007FF6EDB60000-0x00007FF6EDC28000-memory.dmp

Download

memory/5908-242-0x0000021BC15E0000-0x0000021BC1646000-memory.dmp

Download

memory/5908-243-0x0000021BC15E0000-0x0000021BC1646000-memory.dmp

Download

memory/5908-327-0x00007FF6EDB60000-0x00007FF6EDC28000-memory.dmp

Download

memory/5912-291-0x0000022216380000-0x00000222163E6000-memory.dmp

Download

memory/5912-373-0x00007FF7B3AD0000-0x00007FF7B3B7D000-memory.dmp

Download

memory/5912-290-0x00007FF7B3AD0000-0x00007FF7B3B7D000-memory.dmp

Download

memory/5912-292-0x0000022216380000-0x00000222163E6000-memory.dmp

Download

memory/5956-249-0x00007FF7EEF00000-0x00007FF7EF019000-memory.dmp

Download

memory/5956-250-0x0000014754120000-0x0000014754186000-memory.dmp

Download

memory/5956-251-0x0000014754120000-0x0000014754186000-memory.dmp

Download

memory/5956-336-0x00007FF7EEF00000-0x00007FF7EF019000-memory.dmp

Download