5c6b90c460fcd734c07150be84ce8c1899cda5a0ffa55dc4d1c83351a8d45ab5

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe
Size 685KB
Sample260922-pywkrattdv
SHA256 5c6b90c460fcd734c07150be84ce8c1899cda5a0ffa55dc4d1c83351a8d45ab5
MD5 642cc4136b6011c348ffc41e6834c554
SHA1 f235a1850ad446b60fdf931ddbbd8263a967bdc4
SHA512 60fc7bf1c5fe7011462277c931a3b41baae720ccca6d7d567e3f583f2666699dbce5c1f4f916981897129579e56562c4b59a2e64cd9a748a69e77c5bef04446e
SSDEEP 12288:G7VqfSNINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:o3INtvvPSb/w76tqALsp
TLSH
T18DE4122F77A931F5E5A255348A240A09D332B8725261DB9F0B75424EAF137E87D3AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1548	alg.exe
4604	elevation_service.exe
2856	elevation_service.exe
4696	maintenanceservice.exe
4556	OSE.EXE
4148	GameInputSvc.exe
3020	GameInputSvc.exe
2916	msdtc.exe
4204	PerceptionSimulationService.exe
4724	perfhost.exe
4852	ReFsDedupSvc.exe
5252	locator.exe
1496	SensorDataService.exe
4464	snmptrap.exe
4568	ssh-agent.exe
2820	TieringEngineService.exe
872	AgentService.exe
5908	vds.exe
2312	vssvc.exe
3840	wbengine.exe
3432	WmiApSrv.exe
5792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69f6a6b567fac3b7.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107328\java.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	GameInputSvc.exe
3020	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5656	2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe
Token: SeDebugPrivilege	1548	alg.exe
Token: SeDebugPrivilege	1548	alg.exe
Token: SeTakeOwnershipPrivilege	4604	elevation_service.exe
Token: SeTcbPrivilege	4148	GameInputSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4852	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2820	TieringEngineService.exe
Token: SeManageVolumePrivilege	2820	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	872	AgentService.exe
Token: SeBackupPrivilege	2312	vssvc.exe
Token: SeRestorePrivilege	2312	vssvc.exe
Token: SeAuditPrivilege	2312	vssvc.exe
Token: SeBackupPrivilege	3840	wbengine.exe
Token: SeRestorePrivilege	3840	wbengine.exe
Token: SeSecurityPrivilege	3840	wbengine.exe
Token: 33	5792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5792	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3020	4148	GameInputSvc.exe	96
PID 5792 wrote to memory of 3524	5792	SearchIndexer.exe	113
PID 5792 wrote to memory of 3328	5792	SearchIndexer.exe	114
PID 5792 wrote to memory of 3176	5792	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_642cc4136b6011c348ffc41e6834c554_icedid_vidar.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5656

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4556

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3020

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2916

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4204

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4724

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1496

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4464

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3432

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3328
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2948 2980 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2940 2912 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e7c4e4dc0e5079b7327268a0b9ff2174e19128e121ef597c809fa421c0473569
MD5 aac4678a8f1464e577fc420a7f2410be
SHA1 13e547858713d0dcef08938ab192681d6e5a6322
SHA512 25d801a798524b11e20fdf8788765ca861167e222cd2677972ba0c6ec134f44cca5dc2204b1016dad258a964fa83e8f2b6ffe97cf687304df1c181abd36fe7b0
SSDEEP 49152:Nb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnzGNt/Sbi6Ab:T3q6gjBJKO6A
TLSH
T1A4D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 0e4ca5fc13d82c0d69086a7637d936008cca64a7da4352e7b59a4fe64f58f7f9
MD5 5e0711008f0940ad38db3109dcf02174
SHA1 3bef0b5645b98a14eb5b970009acc633b37bc2dd
SHA512 dd3e909d2ee129dfeb650caa16f744bd29c53576893126c2361379374438cf612d490c55e4ab4d05e8f05033f4414d96d978de03d0389256319dfdcd1e97486e
SSDEEP 12288:x1XLsrxWkxy2lRq2czAMcINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:/XYVDtczAMcINtvvPSb/w76tqALsp
TLSH
T18805F12D77E508F9EDA74139CD618901EA32789183A0E78B03B489695F237DC7E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a6b17e9e3c892b173bdaf345bf85be81e27fb643decbaf2b0718038fad32c3eb
MD5 4b57f87b05697a49ac2ea5b51a1a8871
SHA1 f4721c3f1525205967761c445a9bc9f78950836d
SHA512 52dfd9f2fbf05e5c405cee98d9a3373ee380a2a57442eeaff1340305a7803337970f6df6a7045654896b7b4de2d3ab82db348cd228448b3329b7b169926ef4a9
SSDEEP 24576:20Jegdk0hmxOrMd+INtvvPSb/w76tqALsp:2cdk0AoGHNt/Sbi6Ab
TLSH
T177359E26F6748335D073C0B9C5D2A68AE971308257308ACB4296D77C7F27BE6963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bfe2596563ebcaf9457ce194879cfc7ed47efa8feb9a2f956f9f3e3d0150df41
MD5 c8c709e2e2ecb8aee3a7b5e798962dfd
SHA1 00bf1a7901fb73c91f563ea5be58eebfe511c6ad
SHA512 6b6e19341f9bc6074448ec52be61cb20eca06957492408512b7947d315dbed4c74d8eace39996f12e8095f39d34f398b5e2eed7c7c2b667af88fb7c9e7a1b6f2
SSDEEP 24576:4GE/ezSC6vUyD/aqgrvW/6q8wyuazINtvvPSb/w76tqALsp:w/ezSC6vUzPvuHjyfUNt/Sbi6Ab
TLSH
T188756C25F5788323D0B2D0BAC5D6BA9AFE323046573089CB0246D76C3E277E69536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6349177ad9e14c8fac97fa994db9799199a013dce72ad2de5bbdffcd5f9a609c
MD5 47e36e8ef05e5a9543fe245e28943ed6
SHA1 3f9784591028f75cc85220cf27d81a1d7987cf78
SHA512 4b6ead399373332aefd98c0de9b403343d00a8788a001114442fa06ed16732dbf1effac6671ad811f945c7cf289b51dee7c36f4fb31dd336ce15328524a733f0
SSDEEP 24576:kablP7tvEv/l+dbsINtvvPSb/w76tqALsp:ka9tvEXl+dVNt/Sbi6Ab
TLSH
T18D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E277E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 78374a622938ceab6d45c5843daf39af1047e235c50d41ceefa3b728de1b3ddc
MD5 9b9c4b758aeffb4ac51c5969e2dc50df
SHA1 84f300bef18b220f0aa6487ad4b2cdde57698a1a
SHA512 f5e7da3a0f20d1594b1cc3cfa797626aea43cfe7517283ba2f27444fe596def08d3ff7ea1158e82fcc908c17d1725dc01b1121aa0ad17b6abe31ecefc0b74168
SSDEEP 12288:Qf8uINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:Qf8uINtvvPSb/w76tqALsp
TLSH
T1A9D4233F9FAD60A2EBE210311E381D0557143C92E0C2E6864576694DFE10BFDBEE6B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 667576f93170cf1fb48ced13ca09e02c2fcf262e41e02d2e80b0ee9968b22cc0
MD5 5dfe1d8310e5bb67fb7b589cab27561b
SHA1 37e5c34e8e140bb65f6c147d892b8d8a7b0c8902
SHA512 5d4ab6514bfe466e2f9e9ba551b6b3ff664bd469cb93befd8dd74bff6414450f0f732db80f8083ec34017ed9165e7a236cbcdca1be114226fa2a0dfaa56f1641
SSDEEP 12288:CeBNUbTVO86UCjINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:CJIUCjINtvvPSb/w76tqALsp
TLSH
T11715D03BEE28FCE2C27A4CB85B518600D77278704B52A3CBD175820EDE135E56E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 e65f0bf0c01976aff18d87429398fd600693c9631f9b6c142f97b8ede29ed26f
MD5 e8fb90bf80aff08a6da61d32721e0198
SHA1 c4dc86f895233546d610d8a9a071bc9f224a4fd7
SHA512 6efaec61862474c8cc3034031878ee4c84781aad559487e36535608711fabb63ddde22168873128fb26f9ae14469006d508fc0d46bb5693ae54bed55d0b1a11f
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJz9DN5J4NRV3TH6:XQvGAdlCEL8c/zRNM5CbKO6A
TLSH
T1E9367D656BF880F5E0B7E138897A85B2F7B678420D31EB4F0291C66F2F336905D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 788bcdbd8bb0344eb0953403fbacd6d1dbfdcef4ca14ed63324c1e339e2de525
MD5 d76b2ec2c8528c6d71aa5abf82f87305
SHA1 db5a2facae677088e6e41e221ad87251600e5eb4
SHA512 12101e5013d8a568817bd324f4e866f226326507e93c15d9682b0d7806cba5e881f4add5fbf70a185a73b04dfea205fcc7a845b775228ed75bfe4d0074bd5c30
SSDEEP 12288:+OwSfxL/2Dc3bDLLmt0LDQewsAjxQINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQa:1mewsAjxQINtvvPSb/w76tqALsp
TLSH
T1DD15E031FE75E036C6BB0DB61B35C706542D79604B921AC3E3B88E8E99206D23776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cec2eecc04a13ab66e0becc43abdb0e942ce5c4d381d0ccbd9be2b94d730a7cb
MD5 ccfd3423bcb50ac7729be681beb8fd34
SHA1 a5b02c30321b4e09dcd7362c20551f94d12db441
SHA512 21d3b94c0d08daceec7b93bed48257227e2deed7cf75d00e635a6f895c3eeeac274491166bf66fd6502175ea9b2039ac1454c4a9334debe0e461f96c36e5bce7
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrHdPlbuJH:xUEtQevvqc2W1cpV2Xrd2
TLSH
T144474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c84b7b7ba46b852535d00cacdabbab0911a49ff27c74238da63f8a881e4eaeb1
MD5 b4aadaa7592a507d75f6662c7c1f75b2
SHA1 823c0da77cd85928f074105d1c1442fbdb726948
SHA512 511e1aecb6948ad074de9ef3ac1975115d6cffdffec84dee2220dcf69eabedaf39ee63c9b0cdd9473a238a35acdb1282ad1e50f910e096ba9542cb7c2ab72c25
SSDEEP 49152:zObRquA/m2yL5zMfFiV+XenmE3/zstsNt/Sbi6Ab:Yoq1VjnmPSKO6A
TLSH
T1D4D58D1976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 100e38f9853c3bb85521bf291aa37da0ef64058d0f923e1204c83e75310ca6db
MD5 6811f3b5bcc7b10b948762490ee38056
SHA1 220020c227c4d96c4cc514692a3812ddf1abcaa4
SHA512 48fa7c9b064103c2c3c72cc113420b3158f0f260021c10e3251dec07cb161c1e0ef8c233b40dc8d7bee27274aa8fe83ac196b44f11bbc8f1705f3bf855bdbbb7
SSDEEP 24576:BAhGLvaFoiwtA5l7S53PbINtvvPSb/w76tqALsp:BAMGFoiq5/8Nt/Sbi6Ab
TLSH
T1C7459D81EBF955D4F5F3AA7859768570EA76BCA65E31C20F2160C10F1E33E90AD24B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 2c16047312e307310177960a2ab6bc1ef230493522f23c66db01b7be5e3c222b
MD5 7057935878972713d9a87b20a362bb40
SHA1 39e2facd88e00560c7ba9ff419c250f9c707f94a
SHA512 e73df53596749cb38853d278b38bbe5c2324e3fd5e82e99dd4d946525018af45d7a0a89aa76ddfdb08e602566700f7d79b5c26c77d88b0b9efd035565bc36e9f
SSDEEP 12288:Imw5HEjsChNYBFgl0WPm+CMfINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsV:lwuROWNfINtvvPSb/w76tqALsp
TLSH
T10005F15A77A91CF9E9A3413886578536F7B2B8022621D71F0770C64FAF233657D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 28c2a9cbed2a5c675487adfbc3bd026dff601324cd98536f3f06c9a245a7e68c
MD5 49f7925b9ad2fb15a4252dd857ff178f
SHA1 657e8cb60bb0870ad75091ec2645f533bd113514
SHA512 7e52b607da97a70907d670d86e8d93b0c68eb4419a8244815935a71daa7c054e597a8fd50e0ee3e8fa9f7473585a255c702675cb1d8f607b4edd9414098a0d99
SSDEEP 12288:TFt1IRr3INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:htuh3INtvvPSb/w76tqALsp
TLSH
T12CE4126E27E820F5E6E311398DB40A05D7317462A37293CF1635465EAF22BED3E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b19016907174c7a7be16954b4ca6abe71fa6a1ab50516eff5cf0e11cfb5f5bff
MD5 c7baf4812f394e65bd2f378231059489
SHA1 41827f5e1741e00c3d71ed791ec9224700d6764f
SHA512 f1ebfaa9933b0a9f07d86fd635c27743b5d2e356d12f453fc33058c37f855770cf7487f8f88a3bffa11cc87beb48f0c9230ef6bf74973ac0906709bea5a22e21
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UM:WQRQyi36YOcP8Lvw2gAf+PN3QKO6A
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 82389fabcc33ba9a09b64da6b1ff83b4a67984f0d768c88dce81b4474830022f
MD5 e9122912960ab81779a879798f52b2bd
SHA1 4c42615d709e40a29173d373856db34044e33d88
SHA512 fcc4f17326cc638be4770c4b64a56201d4ab9b39163f17450e348945a36201d0391bd9024032bf2a440c5bda08cb661f0fae58dd8df44da689cf6f193277f68d
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ug:WQRQyi36YOcP8Lvw2gAf+PN30KO6A
TLSH
T151667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f28ec85fefbe02d5b28367e0e38828e4f0c0aa39aff76a5100f611c9b42c50d3
MD5 896b0785a366a18df6bbdde0da107f49
SHA1 2940fcf8fc8bd488e0d949c659ef435883f23c62
SHA512 a7d722ea7d9a12a8e69dd6e79989cb376343966e3396e16a0e0a6655e3bbab60f2ba4325f7f1c5fb2bf443f1b1b2381ae0ea8a3c4fe7824d11c56da9612493e1
SSDEEP 24576:hwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0XCINtvvPSb/w762:t68Qg55nhMeWu7PNU3/wrNt/Sbi6Ab
TLSH
T167B55933B2F600A9C44DE1769F4A872196D17C718FE1E3DB8511720A1FB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cc3367629802663bd96055d1dc92eb0d42a60e98a1db8a68f3935fa1cb29277c
MD5 1307e734634b26e094ed2153b8a3a817
SHA1 990a8806396de10aeaf0046fa529d6717c8e6da1
SHA512 0d0ee085117941259beb76ae8e6faae4d301041023731ace545ec252da75ea0c68e9dd2cc8ae7ec923305f77d30d6776d4e5b380b50d3ef38859f9a7aac03b2b
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99V:Qy5112gYy5azzVv569nLKnhZcKO6A
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7412d6c288251a53a5d7b3ef02a9b6f7b4c455c3389b184e53067bd454d00ec7
MD5 16c4765d8c9607bcdd6fac068cb24ae5
SHA1 9be268d164ee65c07b34b6643c8da37bbf4a7ebb
SHA512 271c09f8807e1a05419c71d75eca2430bda551c30e5d9bede0a525b6f5c3289f7f3443181995025c7155670c3d279c8fa352da8b848039e98d238aca7d0c391d
SSDEEP 49152:xB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glmzNt/Sbi6Ab:nu6JmTxd2d0KO6A
TLSH
T1F4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 465fa221b1bceccd186237696727b2061860bef5b28139449a8a5af6471a74bb
MD5 f5963c0092df732bfda64d1c06e100ed
SHA1 e3e7c05cb8383f181ff4cddf0da7b3d65e0d95e8
SHA512 60d4fca40c90a4b26617f264a3b680288fecf90aa23de387bb7e6123df055f0a91b4bdd133a11b5f895babf37372858a0f19e4f93f9d629df7d4d6de1d4594f1
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xfNt/Sbi6Ab:LmifPbRyKO6A
TLSH
T11EB5BE13F2D900E8D05DD17887569632EA62BC460B34B6DF0A90B7962F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 450de3e87360be1e3c50b708543d0f2b72362cee73444d89eb5082ce20478135
MD5 72a9e1fd20c929d876b224b8a7fb6d0a
SHA1 a9858fd2d4450ce892dd5089fad5f9144388ae49
SHA512 043e43d9ccdfeb6a65d81512e5feda890e3834dd8c70eecbe4d9f4820163e0b29aaf9bf68d56cbc516dcfaa7e4d1e7f3e8bd16b2fd8a7ad9840eb35928789fc6
SSDEEP 49152:dSuZQIY0Be2K6RVtOnks6NMHqONt/Sbi6Ab:z5dKoi61OKO6A
TLSH
T1F3C5BE13F2E940E8E0BED6748B659632EA72BC464B34A6DF064072591E37FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4db639cf75b663142f51284a539809298287503c48c312e267db0bb7a06b97fa
MD5 5c7a9d800aabec61cdff8340097aaf7a
SHA1 0671d08562296cb0a7d63cc6daed489f16856616
SHA512 769b3d78d6b08fb02cff9f91a92b662cb30b3d5b459d7ebb0ed763cd61625e027b53d691a3c0cec29ee05e2bba0e30464885858420368301626f03f0ca4f57c6
SSDEEP 49152:ehtSn8EApI0figTgiDn0AP5w1Nt/Sbi6Ab:/X2iyph0KO6A
TLSH
T114A5BE13F2D900E8D05AD174C7568632EA62BC160B35B6EF0A90B7561F3BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 68565385d2e072ae23345fdb903f09df443e4fc45cd6edc145473e8a51970ddc
MD5 92e850168afd246f08a38420a1086b9a
SHA1 12b58afceb45b0c26bc95e236ef4d1f0f4d4008a
SHA512 d410ad54e1845827ff2daec3d36581484bca5c76cce1ce2c3e709eafa98660b1710952d9186edd71b52ee8ad057cd26107c0db9eba4ccd4d2fec7c6f81bd9557
SSDEEP 12288:+0INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:+0INtvvPSb/w76tqALsp
TLSH
T132D4233FAEAE50A2DAD110711E38190596183893F1D3E296667B550DFF00BFD3EE6B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 d48861e0f185c489b203705b3d368dd5fbae2a145e2deb3a446cdd03ed7ec0a8
MD5 b09ca8e9d726e4893024498f80f2d692
SHA1 dd3ed4d62fa333fc86dc5b2f418e07869246491a
SHA512 fef41e5805500a66c22103adc8e893b86c14ffc9365bd5936143d269644568c764c5cdd4aba942b302eb79f0326cb48e540e3c585062a5bff316bf8145336552
SSDEEP 12288:MCINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:MCINtvvPSb/w76tqALsp
TLSH
T1F3D4233FAEAE50A2EAD110711E38190596183893F1D2E696567B440DFF00BFD3ED6FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 3c7619af26ecdea4780ca0a6c75a1133361bdc409ea586fabaff58245ca03a7c
MD5 b35f9165dce2f87f0a6573fe14448a8b
SHA1 73bb7b46a530a7103f81fd305dcf2a8193df3496
SHA512 19669e7df98aaf74ec0094716deb95852b9cd5b284cefcddfa6b9dfd6b2910200117cee6345adf09036cfce25c5def4698cb7ac327bcf8afba862955471287d2
SSDEEP 12288:yuINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:yuINtvvPSb/w76tqALsp
TLSH
T112D4233FAEAE50A2DAD114711E38194596183893F1D2E296567B440DFF00BFD3EE6FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 a45e9499cad2e1dd5625e1cff5807af6f319f53d71321f216ccb52f237e980c1
MD5 9f0e772ae0e158ad4a38aa35e75c7866
SHA1 a0c48722e11eaa7403cf1679978bf1302fe2a44f
SHA512 8d06309d8ade9b314d6a2f4368dda2dd2e7fe6f5f9685d812e1d585fa842cf83228a8724f3ade117cfce3f25ecbc6136307bdf4d37dc3001033bd42edd947152
SSDEEP 12288:xlMINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:IINtvvPSb/w76tqALsp
TLSH
T14ED4233F6FAE10E2D9E250758E381905D3247892F162E39F5A26094DAF117FC3EA5F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 b8708320d0aa66edfa0aaee81cf9a4f9855eac569c7d318cf83afcfdf7203e15
MD5 7eac4a395e30c7ae7ec7c398612b64ab
SHA1 c80b4aa09570fdaa4a7f49d7126c3525c0e1bc25
SHA512 461a69a0a2dbc3a53edebf18ea5b28d74a9e7ab0c26789d1f0c93a7c33d4f5927de2866ab14cf230d9b45325149c0a47faf891d1501c382eed35b65aa054d147
SSDEEP 12288:xxINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:xxINtvvPSb/w76tqALsp
TLSH
T10BD4233FAEAE50A2DAD110711B38194596183893F0C2E296567B550DFF01BFD3EE5FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 e1d0cd2feef5baf509238ac5dcc019e13a5f376f760b55c0bab67c8e2ae37225
MD5 0ae64279944d3bc5307616bbb81da824
SHA1 f9be35770a0ce5ddcc97d0e9f479b5974b61eee1
SHA512 a475967a1a4ae4a117db7d00115fdda92c7bc0869e83eb0de8becc60349cceedbb875e26dafe17d61b0d536d6809cdbac15464ea6a3d89b8b7689bc4d8e4b6f8
SSDEEP 12288:a4INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:a4INtvvPSb/w76tqALsp
TLSH
T1B5D4233FAEAE50A2EAD110711E38194596183893F0C2E296667B450DFF11BFD3ED5FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 6e7414ba9fa2c036a77b6dd0083763ecee918c3783ffba3dac6743a5893da0ef
MD5 368d3fb4869c776ce87b5474f537eef0
SHA1 0b46a04749dd662a6b02d34328b3c3be00dcf1c4
SHA512 c7a42fead66d37f7fbf6c83bb9abd1dbc95b4facedb6e7d33e3d381ced59c1785c8d18c54d635aaadf2089e55c160f8cf2f4c5a31df339056d9af46ffe800eac
SSDEEP 12288:RCINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:RCINtvvPSb/w76tqALsp
TLSH
T141D4233F9EAE54A2EAD110711E38190597183893F1D2E296567B440DFF01BFD3EA6FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 a4e8cc209c1d2b6e339753112227f3c43b67856a6e87aee811e4dd616e19791e
MD5 82f997cdfccb8d4df0a1f134eb2913c0
SHA1 12f063ff7927146429b8517f5af483129270b2b2
SHA512 cb97b63de8dfddccc16f3978cca8ab7e3a5a30182659b9148e39f0dae33839c876015893eed1cdccab7d1e18b6d2bc6d73eaa5d9cfa693347c61d0edc128ae69
SSDEEP 12288:eiZwbe5zlvFS9cPvy6INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:BZM4zltSh6INtvvPSb/w76tqALsp
TLSH
T1EF1502A9B79018F4ECA3413ECD254906D6B27C5656A0C61F03B4361BAF333A53D2EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 ec15b7f92a21dd18bde0bc56fbc64a80c1b03abb1b6db02597f8356960e147e4
MD5 81bb32258c4928ab805a5b5b8f6ed38d
SHA1 132b1c059a74035168f2e5b26f1b783531a89b90
SHA512 274f7e0c9720bebfa002003bb5b4fe96a9b93d5c8183f67e4259569c334428557290b60762f90ae9e1d462df0b3b43d9cfb841e587b6bdd56780326e71d949fd
SSDEEP 12288:EPINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:EPINtvvPSb/w76tqALsp
TLSH
T1EDD4233FAEAE64A2EAD110711B38194596183893F1D2E286657B450DFF00BFD3ED5BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 64cc54664bbfeb4f535d21e901c0d48b3431fd5599d7a94366e6eb0f70a5f24b
MD5 c8b99eed6cb6890a752f86a7495b0ec7
SHA1 582ab1bee66cbb73fc60c8a91692ed275e23c044
SHA512 898abbfcf39e2503c15ae8a4097268feab2e1095adc28f96eb031764da2af22f69981a6ec08ed6e00b081b59028257d7d2674432d0d5b798144daaa2e0622610
SSDEEP 12288:CAINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:CAINtvvPSb/w76tqALsp
TLSH
T124D4233FAEAE54A2DAD110721A38194596183893F1C2E296657B450DFF00BFD3EA9F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 ff0bf32c2339fffae29bc9e4e327c6fd254ffa917aa8a3ed54c5c4bebad2dedf
MD5 d7b829bea5ebc10657d8b780642fa2e6
SHA1 d23c36e40d3dec44120855c277f5ad1126b49bb7
SHA512 2447f1458ad6bb56504729f3bc4afd78ca2aaf13ebf8cd49f9208e9a4fe967b7a5d2c93283f50f26b012cb0fd5a02036162204026e933e4d58c68e0f1638601c
SSDEEP 12288:2hPz5L8MINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:czyMINtvvPSb/w76tqALsp
TLSH
T19EF4121B77A630F9D5B2413489650A02F33578329360DAAF1374067E6F237E87E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 8addc71311858bb21c58bd8b58981fe65e0f3770ad26aa9fc7356c87d6498278
MD5 3f0e709ccdd02dbf4382ffcab1bab096
SHA1 db8759812e783e783176534ec9495a30089add7f
SHA512 73eb528496102ccdc5b3575b9333274715ef3a8709fab04867b114425c7e3c2aa4f10e59ce9deb33f143a7bcc6dfa1aaa92d91ccbecc6b706f8344d08c12c303
SSDEEP 12288:w5INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:w5INtvvPSb/w76tqALsp
TLSH
T119D4233FAEAE50A2EAD110711A381D4596183893F1C2E296667B550DFF00BFD3EA5F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 feb6f729b31934269428227aa9609cb876ca5c5c49e0bda212b62b5391d3050d
MD5 b1184d8d51dabfc6d5ed5e55d1b983e7
SHA1 8fcba2b307bf1b6715273d54694761a07125780b
SHA512 d30460a6b55c4d82ae18e3fa3cc99a3afc8208be237dc04639d4d0bd954f55e11fac67c81c4ec6d995922c44990b63842bc401bf80d75073fab7eced795d40b8
SSDEEP 12288:wCINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:wCINtvvPSb/w76tqALsp
TLSH
T13CD4233FAEAE50A2EAD110711E381D4596183893F0C2E296667B550DFF01BFD3EA5F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 45de1517e5b29ca11714e3dfdd2aa9a0ab23f6a197a7851d1a96f11aead7c109
MD5 f7c28ab627b28f6b40c9b0ad9b986d2b
SHA1 9a5606b57622929f0b84463da7184367f8c08791
SHA512 8a84adf6bf4d4054f488a254e2300062ca4e5f4ad02c13ff82669fc8ff1ed31d13c21e957b9b4c2ab9f43fdeb56086faac94954baa082a2c1cf218ad76b0e94a
SSDEEP 12288:7hPz5L86INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:Fzy6INtvvPSb/w76tqALsp
TLSH
T1B9F4121B77A630F9D5B2413589211A02F33578329360DAAF1774067E6F237E87E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 07875c0ffd6ac4fb2d78c50b843fc8dd1f473d059d73cd4291968f3fd5f0582a
MD5 0c7ed64900464d5379f65a4f20f9f200
SHA1 7ec4b0f34cc086900297204152b4f8cf0e1fed18
SHA512 d79660fb2a23d746e69e5c05e7ee0b2a2881432a03696a203fa59758ddfe3a1b3276d03a67f58bdc5be4e4679a1c80b06f0e59d943ed2b2bc7a368aeb4a19007
SSDEEP 12288:hCd9OTDoaLn23z0zk4PDvh0A6INTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqq:cTZaL23z0zT36INtvvPSb/w76tqALsp
TLSH
T1E1150169B79018F4ECA3413ECD254906D6B27C5646A0C61F03B8365BAF333A53D2EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 e1d9b960248dff42346ec4c8d06b54a71376d1f0a45cd17c87cd6cd03058f9a8
MD5 c82b6dd7ad3419eaf551a7e241eb7633
SHA1 82805a4883e9f8ecefd62e69b962502fae7ff54b
SHA512 294eb9a23339a0364c6db5392b647776bb44ec40b92aa324ddfef9b61076d636bb3a36532a2592150c0043fca53ac203eb4f486847e204912962868929048e4d
SSDEEP 12288:li4e7z5dffgwCOKy7oLbbdIvxINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqq:l3odJCOKy7oZaINtvvPSb/w76tqALsp
TLSH
T12035CF94F3E810E4F0B39A358D764501DA767C9A5B71DA8F03A4261A1F33BE19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 2d1e45a318d6c81ba93915a956695a433d92d01760155f5c690b23521d9a2f21
MD5 8ce55a6aa6dd4985e46eb98d7e411398
SHA1 6ac90d8851948de1a940c8c1a0e1627e0318c62a
SHA512 4126b622968b2226cd3a937e6bc48d8da75306eefebe87217365b9560643943f1a5300a7848d78d207cf6086a887bf0401a7facf41e74628c5716474417c5f99
SSDEEP 12288:AMINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:AMINtvvPSb/w76tqALsp
TLSH
T143D4233F9EAE50A2EAD110715A381D4596183893F1D2E296567B440DFF00BFD3EE6FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 8b9f69df0fbe8bd847ffcbe405969d511f810f7e2314d196e7840143a279f991
MD5 d1777b36651660afaaa104e952df35d3
SHA1 7e28329b90daaaeb244cd85bdcbe262bc69b2a40
SHA512 00da2fa6503a32ca64ddd3c1a9dbef68c2e893e2487e6da128d988b5d6915813d99dce6776a825bf20e93fce50dc3a7b87307eabfb57934268a3b4c879e4f050
SSDEEP 12288:wXINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:wXINtvvPSb/w76tqALsp
TLSH
T16CD4233FAEAE50A2EAD114711A381E0597183893F193E296567B440DFF01BFD3EE5B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 9bb45f59b8a3360af12deea23b59b21e585a2346975f0d22f607ec941a2091fd
MD5 7a3f35cb4fa79a429b50d2bd53998da0
SHA1 1c1d8a0feb1c4d6fa0646740ff4c72176890d833
SHA512 439318ee1630d4e2e647848405ef86f7b5694617f7fb36fda0026f6420ea35952552a2237cc31d16034cfc24f45dd6bbdb5b711cd4b7bad8c3bd1a4caf24aa2c
SSDEEP 12288:NZINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:NZINtvvPSb/w76tqALsp
TLSH
T110D4233FAEAE54A2DAD114711B381E4596183893F1C2E286557B450DFF00BFD3EEAB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 0fa6dcccc6c9b14dc592f963dd29173e37f8688c977a7f6dd392c22c921ce7c4
MD5 daafe753c04c0fcce54636c1c4dcbf4f
SHA1 d9a7b37a984c2c1c768d5be7480b49405c71a3ae
SHA512 43bb494c730295f851499b679a0f77d0dab51bbb0dfa760f59ea0585a02fcb46d0500ad31777f28f0c4e29ca5bb63cf33d6188b98e17232d4c018f1e6bad1401
SSDEEP 12288:aaINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:aaINtvvPSb/w76tqALsp
TLSH
T190D4233FAEAF50A2EAD114711A381E4596183893F0D2E286557B450DFF01BFD3EE5BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 7b3a4264bac4040ffa31b8253074983f6021307f6a98f2ce7f09a1371d937876
MD5 6f58a5c9364d438c44b42b258d18947b
SHA1 caa7f7a5e7b8ba76c61f1b5620e99ec4d2075f49
SHA512 a7df9274bb28b282d94aaef61e933cd82e6473be1a58b7f3a33944676a67cf49b139eb06adc8af79b222a0173a8fdd036c0d603c468d6118dc7773a3ddec437a
SSDEEP 12288:YTsfneINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:XneINtvvPSb/w76tqALsp
TLSH
T16AF4F11ED69811E9C0AE2175CB150A41B3233C6293E1D3CB56E1F53E2F356A87DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 71e1282e134635a430dbd8dccd5225c216f72b6ae9a94116480240e76ddb83a5
MD5 cd42bf123abef2410e1613c64c29be1c
SHA1 3ee316391ab30404fd37fa649aaeb947eca2c8bf
SHA512 aebf64bfeefb79354f475e1532a994d10a7043b43a64792ab9b5cd49d5c03cdab935b990b3b820daa9bddc52a76c82bf0a2d7a37b8f9f8c5f0861c84489c9d83
SSDEEP 12288:cq7kINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:jkINtvvPSb/w76tqALsp
TLSH
T16AD4233F9FAE64A2E9F110700A3C1904671D78A2E381E1C7A52A554DFE20BFD3EB5B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d2df10c11055f893404771bd64a460b682ae069ee5edee0988db1f03b667d22f
MD5 37ab2dd75d6c1b50bee8202fc2e6708a
SHA1 31a42de2e54170a6650baf5281f598c3d73c805c
SHA512 59b5ad53d707115c76702024c7bd23bcbea610eeb666b0141de4793d05d92521ca8fa810da50b2f38f8a1721e9fcaf16750629833d72a42cfa7353a838d752da
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYlINtvvPSb/w76tqALsp:rgb4mBIBhGFBNt/Sbi6Ab
TLSH
T11865AF1E22EC02F5E0F6D2B8DDAA4417D6B278165332D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 44c09a5b5bc2b70db0c8ec82ca3acc978c37c3746100084285f8c64c0aa49159
MD5 4f1c880e340e184984484e52e073f7ab
SHA1 8ba6ea6f78df096fe39c64f44fd734a836c0c2ef
SHA512 daf67eafcc7d94b0f3fc8e6adb937b0d8e9b76d0a0cf2ee2daed583598439dc742f6786a7624283abf027186d21f58f116606f0f69531d98683c9777c7fefb73
SSDEEP 12288:jsGVINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:4GVINtvvPSb/w76tqALsp
TLSH
T164E4223E6AFA30E5C9B2417549381906B63034A1A351A2EF09B6D53DEF11BFC3A79F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 e3cc8da4f0c7a73a0d03b8de8cf0029e63de78e5ced2db4543305ebff10c0c86
MD5 9524923446e0cc441dd630ed157c5c76
SHA1 2209809c2d5d4643151f88dd418351ab8a71d588
SHA512 df930e60945eca45c7c8b0616169c3c529a471ebc0d599ff1aa1352b166411739a8192c348e2989a2858c3d8817ddfed9b0fb203fb00ba77c4ec4158af5a1d19
SSDEEP 12288:wEINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:wEINtvvPSb/w76tqALsp
TLSH
T1A7D4233E5EAE60E2DAE114710A381D05561838A2F3C2E2C36576554DFF05BFE3EB9B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 55920a7ea8f270e743c06a8ef0568fcc2e63ace1cc536b2034f6d3d2b71a99c4
MD5 48c97ea1d4707ded48896fa8232e4d20
SHA1 48d1eff2e419ed4acc6b9c56391822b27596dcb9
SHA512 a817a952e23f1398976b4ac4a07ec4102f10abf139a255cb14135a6b8b5abfe5cc70b30adf9f874830e64cb71421badfeec21ea11c3e4041b864da929e17920b
SSDEEP 24576:L548X8FpJqH1Mzria7/mkINtvvPSb/w76tqALsp:1HsFPqVra7/SNt/Sbi6Ab
TLSH
T19835F12977E501F1D4B7D0388A560653F6B1B4211360EBDF07A88A552F23BE92B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 525606d093eb00a1340a26744baeec91d0ee488fa8ec073ea16d52884337eab9
MD5 058cb28304ef19d826736eb7f4c9b802
SHA1 ff7c86beca30b18d9082a1d98f0b077a930acaf4
SHA512 1ea99d85d658dc0945de4b1d0902dea049622bffb78e13d1b101afc9b85c63d20990fbf2fc74a7a73c8bafc6c8b20ca6927cd20ea72535c83943c69cfdebc602
SSDEEP 12288:HHvUrBFrEjwaQWINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:HPUr+NQWINtvvPSb/w76tqALsp
TLSH
T17A05F12F26AD18E5E676A17D89464709E77174621312E2CF02E1817E5F23EECBD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0fda89784af184d8c9e23ee9381f8fd9fb2cfc5d79ff2b89b1b8304cc540786f
MD5 1d6048b4b837e233026efb0b9b2b3d23
SHA1 902781f9f2aa6326c0e012362c3776607e73300e
SHA512 a4a23d0da6856c8a32edc77ab694db99bbf26f037687c275f062a7e94f64441cbb88bddc2d945346247bcce4814819036b8e2b42b3de5992ceb7bece9224aa3b
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYNt/Sbi6Ab:UG05lO43bFKO6A
TLSH
T1E4D5CF6E62EC11F9D1BBD07CDA864A0BEBB23415033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 5c40939dd41216a8757308bd72474669803cfdbe60af06740e6db672782acbeb
MD5 eb96d1e15f998d37bbe9e370b06787b7
SHA1 34d75b7f1a5eeed58a3bc2905656de8a14cd5b40
SHA512 c8aa4b15bd7f3c87fcf2e2a17923c9ce174cf4e2378f7705b38376a4f56476431050d610fd962878b4e05ee41eb4f3cad68cd0f2a83abb0edbbd6e5c24c64965
SSDEEP 24576:Yza5POZ3dpbWVM50JicR2hG0lasx2+47eidnNfnviJ4MII4HWh9Q7sEK1p0:Ma5POZ3wJt2pasx2+mv4BIIGWvQ7sEk
TLSH
T16265BF5EA6FC01D5E5B9D17DC583461AE5B2342513319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a9b4a847f84c26b65ba443d087d585a55c244fa1c19d269887211e5b77a884ff
MD5 9971599576014a02b3e87609bf529395
SHA1 469b262e84653852d59a85b1cd7e9ca742efd6d4
SHA512 87d2db2e06f2f43600cb6e9d8afc4cb51fa943fece31e713ec282ed71183def8acc4c46a6fa0ce1ff52b6d2223a843501b86a111fe4af0bc56edd613d675635d
SSDEEP 24576:ZNcwHdjbyQ4nLC18lb/EOjowL7FktINtvvPSb/w76tqALsp:ZNc/zEOVHFFNt/Sbi6Ab
TLSH
T119857B2A23E901E4E5B7E1BE89779546FA717865533086CF0291811F1E73BF86C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 6dea97e97d021569fe28bbdfd3656c0bc7095620afa8df9b4a904f3c11c56a88
MD5 3c0c50782eb01b3de373879b0fdbab7e
SHA1 84f65e77b422167be7f743a24ef40a2c504d0790
SHA512 0fe8bec66dff18c540e151097f180d0f0b71207a2d0de3037dadd8519bdc5d1b8271e7c2ba0f8b15ee1432791976c0c607a5320e847ef90cedccf7b424dee3cd
SSDEEP 12288:nvHPJnJP6szeCs6Rl28drINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:HJnJPbzB4SrINtvvPSb/w76tqALsp
TLSH
T14815D03DD2A810E4E4B7C2B4811A1A59FF31386D2B2269C719B4D5387F12FE4B979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 40c1bbd49281368d8c420e67399b32e5660132794f026709b3a7eac21159436b
MD5 e5dd025824a376c41c7ed6f7d6141aea
SHA1 805034658a5ece40608afb55415f9d8bf5dc5987
SHA512 74e9da873a982eca4b5b716a3acc2e9f45c09ad4fdf9e507dbe2bb5691d6838509116889bd2d30ebd5fe3a524839620fb053f7ed5bb1d8789bc74da0fb5a93ba
SSDEEP 24576:XCLHGL0MoeVtFumTijCmlKQWDkYqINtvvPSb/w76tqALsp:XCLHGeeV5ijCmlDWDkYTNt/Sbi6Ab
TLSH
T13EA56B05E7EB5184E8F3CAF5CA2694168A327C509B34F7DF4A80C96A2E32FD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 c9e47cc14e463def259593a066dcb6dd7202ac62705d5c0b249ca49bd13c2591
MD5 b9a2cfcbcf924d79b88da77d8038f535
SHA1 af87ee077e4db06337d0baab6bb9e38f7f42488d
SHA512 ef5a5838bf395a05400fbe40541643d4429267a7766483037ac29748cd824ef7b5a4b94c5d68914c7726a2115ace02699ea6d9cd6b93ebcf0759dfe7613b83ad
SSDEEP 12288:J1Hck6j5ZI70MINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:R6DI4MINtvvPSb/w76tqALsp
TLSH
T184F4012D27BA10F5D1A7903E86520502D2B2B0B1D3526ADF0AA4C57E9F63EDCB93DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 b119830913df35ac718b585306986f1acb7dc8ab07c032409093d54fbc3f309e
MD5 b0bd82d1db531947549233f5bc08395b
SHA1 d1cd3d488e4983bb9ac5787b0b66ea8ec0b63f8b
SHA512 99765f53b8ea6f9a02d0a9e7c21e6b3c30911223d82b6d6095584fba8591e84e74ea36c0d579edd8c2e9104e12026819f357898160fac7021bae0cce4fbc4f5e
SSDEEP 12288:6G6kyAINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:TtyAINtvvPSb/w76tqALsp
TLSH
T183F4121E67A860D1EAF601348E3606409B347C21A752A3DF55A1E62EBF32BEC7D71F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 8cd2412680312f1c8de0ad23839780e22100cfd20f643519c79071b1e40e930d
MD5 a3640b081153506f5ea5b34fcdbea7aa
SHA1 a71734056694c869609647c74e8cc21aa444b7df
SHA512 b50683dd4fbe14ec0f5a66a10b477d3c75762e5fef94fd3409e5d082655e292c2a5fa5cde81a27974366ad5228c0d212e244bdb16c4ec7658eb6d5c65270f3da
SSDEEP 12288:kqiINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:tiINtvvPSb/w76tqALsp
TLSH
T11AD4233E5FAE30A2DDE114750A380A05922434B2A383A5DB68B6951DFF11BFD3EB5F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 cd253e52f089b0cce96037c5172e462cc837045eb1dc6274b2b7397c88bb873a
MD5 d8131f8b47cd83e77b50ff34159f3dd6
SHA1 1dd117c6c302ede6d203a2e3ec88fd9c38960026
SHA512 cd0015e00a57eb23a8ff3acc77e39ce763724944604f9e34d0ff1bce0678b7397ddf9b20f8df1e43cbe68a1e43d5ffd1d150efe72ac5c593c4bdb6c8f9d02e3f
SSDEEP 12288:oggIuZyFDK3tT5Tr7aVLIH9lH3cXINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQrG:oggILoTfaidZMINtvvPSb/w76tqALsp
TLSH
T1B4558C1D67EA05CAE2B2D275D9321493D633B4315372D6CF2458C03A8DAAEDCAE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 264a32fd8567650a974b23ed5040d1e24f1a379ffcf3412c271fd62e72f5a380
MD5 cc7540fedb0f303e7874191bc816a40b
SHA1 800fc54eb87277bd7a7180c56b00800e3a973858
SHA512 b122db26be9050d068736e084b2e4f4739cc0eaa2ac8a896c4c7592dd665962ae6ff3c503d4c1250d428a661aa2f1fd1d2c573a619ebd45df1746c9c37eb2088
SSDEEP 12288:YpJcm8CNNINTpvvPxnELwQX4aDO7n+tdTEeius6t7WQr8zqsuKr:YrcmRNINtvvPSb/w76tqALsp
TLSH
T18505F11EB7AE00E6E1B7813C89450606E67370716352A3DF02A1C77E9E17AED7E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7e4aa219694391d1747eda88e0c672ed881ca4bdc3226e32d3a93722ec5c5835
MD5 eaa1e8bcbe9be9691f64cc0b411736a2
SHA1 b57d69a9846847097a6f5cee9bd8ad2f593b40a9
SHA512 9b4a8bf1902c415f216d4b6b14e4108781504c7b0a8427aa536b1e1b64ac8462ec3e11c08ae9ea84b89853e58b07ddcb063b28e0a065accac4068bf100b627db
SSDEEP 49152:bDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3BNt/Sbi6Ab:Q3Upow8sBgKO6A
TLSH
T1ECA58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/872-339-0x0000016D06B50000-0x0000016D06BB6000-memory.dmp

Download

memory/872-345-0x00007FF77CC20000-0x00007FF77CF40000-memory.dmp

Download

memory/872-337-0x00007FF77CC20000-0x00007FF77CF40000-memory.dmp

Download

memory/872-338-0x0000016D06B50000-0x0000016D06BB6000-memory.dmp

Download

memory/872-343-0x0000016D06B50000-0x0000016D06BB6000-memory.dmp

Download

memory/1496-300-0x00000187991B0000-0x0000018799216000-memory.dmp

Download

memory/1496-443-0x00007FF78CDF0000-0x00007FF78D206000-memory.dmp

Download

memory/1496-304-0x00007FF78CDF0000-0x00007FF78D206000-memory.dmp

Download

memory/1496-377-0x00007FF78CDF0000-0x00007FF78D206000-memory.dmp

Download

memory/1496-441-0x00000187991B0000-0x0000018799216000-memory.dmp

Download

memory/1496-299-0x00000187991B0000-0x0000018799216000-memory.dmp

Download

memory/1548-69-0x00007FF702700000-0x00007FF702822000-memory.dmp

Download

memory/1548-14-0x00000190AAA50000-0x00000190AAAB6000-memory.dmp

Download

memory/1548-12-0x00000190AAA50000-0x00000190AAAB6000-memory.dmp

Download

memory/1548-11-0x00007FF702700000-0x00007FF702822000-memory.dmp

Download

memory/2312-358-0x000001ACD6630000-0x000001ACD6696000-memory.dmp

Download

memory/2312-359-0x000001ACD6630000-0x000001ACD6696000-memory.dmp

Download

memory/2312-360-0x00007FF7E12D0000-0x00007FF7E17A0000-memory.dmp

Download

memory/2312-445-0x00007FF7E12D0000-0x00007FF7E17A0000-memory.dmp

Download

memory/2820-440-0x00007FF6108C0000-0x00007FF610A54000-memory.dmp

Download

memory/2820-329-0x0000021070930000-0x0000021070996000-memory.dmp

Download

memory/2820-328-0x00007FF6108C0000-0x00007FF610A54000-memory.dmp

Download

memory/2820-330-0x0000021070930000-0x0000021070996000-memory.dmp

Download

memory/2856-35-0x0000024634C90000-0x0000024634CF6000-memory.dmp

Download

memory/2856-34-0x0000024634A60000-0x0000024634B67000-memory.dmp

Download

memory/2856-37-0x0000024634C90000-0x0000024634CF6000-memory.dmp

Download

memory/2916-250-0x000001D7519A0000-0x000001D751A06000-memory.dmp

Download

memory/2916-248-0x00007FF7F48B0000-0x00007FF7F49C9000-memory.dmp

Download

memory/2916-249-0x000001D7519A0000-0x000001D751A06000-memory.dmp

Download

memory/2916-336-0x00007FF7F48B0000-0x00007FF7F49C9000-memory.dmp

Download

memory/3020-242-0x0000020DA90F0000-0x0000020DA9156000-memory.dmp

Download

memory/3020-243-0x0000020DA90F0000-0x0000020DA9156000-memory.dmp

Download

memory/3020-327-0x00007FF69D3C0000-0x00007FF69D488000-memory.dmp

Download

memory/3020-241-0x00007FF69D3C0000-0x00007FF69D488000-memory.dmp

Download

memory/3432-447-0x00007FF6D5840000-0x00007FF6D596E000-memory.dmp

Download

memory/3432-378-0x00007FF6D5840000-0x00007FF6D596E000-memory.dmp

Download

memory/3432-379-0x0000024FC2090000-0x0000024FC20F6000-memory.dmp

Download

memory/3432-380-0x0000024FC2090000-0x0000024FC20F6000-memory.dmp

Download

memory/3840-446-0x00007FF73B600000-0x00007FF73BB06000-memory.dmp

Download

memory/3840-366-0x00007FF73B600000-0x00007FF73BB06000-memory.dmp

Download

memory/3840-368-0x000001D824280000-0x000001D8242E6000-memory.dmp

Download

memory/3840-367-0x000001D824280000-0x000001D8242E6000-memory.dmp

Download

memory/4148-233-0x0000020054F50000-0x0000020054FB6000-memory.dmp

Download

memory/4148-232-0x00007FF69D3C0000-0x00007FF69D488000-memory.dmp

Download

memory/4148-234-0x0000020054F50000-0x0000020054FB6000-memory.dmp

Download

memory/4148-317-0x00007FF69D3C0000-0x00007FF69D488000-memory.dmp

Download

memory/4204-261-0x00007FF60EF20000-0x00007FF60F069000-memory.dmp

Download

memory/4204-348-0x00007FF60EF20000-0x00007FF60F069000-memory.dmp

Download

memory/4204-264-0x000001E1C9EA0000-0x000001E1C9F06000-memory.dmp

Download

memory/4204-263-0x000001E1C9EA0000-0x000001E1C9F06000-memory.dmp

Download

memory/4464-308-0x00007FF6A7990000-0x00007FF6A7A43000-memory.dmp

Download

memory/4464-310-0x0000024B0C2D0000-0x0000024B0C336000-memory.dmp

Download

memory/4464-309-0x0000024B0C2D0000-0x0000024B0C336000-memory.dmp

Download

memory/4464-385-0x00007FF6A7990000-0x00007FF6A7A43000-memory.dmp

Download

memory/4556-52-0x0000024A38240000-0x0000024A382A6000-memory.dmp

Download

memory/4556-53-0x0000024A38240000-0x0000024A382A6000-memory.dmp

Download

memory/4556-51-0x0000024A38010000-0x0000024A38117000-memory.dmp

Download

memory/4568-321-0x00000158BEE60000-0x00000158BEEC6000-memory.dmp

Download

memory/4568-318-0x00007FF67BCD0000-0x00007FF67BF72000-memory.dmp

Download

memory/4568-320-0x00000158BEE60000-0x00000158BEEC6000-memory.dmp

Download

memory/4568-388-0x00007FF67BCD0000-0x00007FF67BF72000-memory.dmp

Download

memory/4604-25-0x000002052FCE0000-0x000002052FDE7000-memory.dmp

Download

memory/4604-26-0x000002052FF50000-0x000002052FFB6000-memory.dmp

Download

memory/4604-28-0x000002052FF50000-0x000002052FFB6000-memory.dmp

Download

memory/4604-27-0x000002052FF50000-0x000002052FFB6000-memory.dmp

Download

memory/4696-44-0x000001ED0F420000-0x000001ED0F486000-memory.dmp

Download

memory/4696-59-0x000001ED0F420000-0x000001ED0F486000-memory.dmp

Download

memory/4696-61-0x00007FF74B740000-0x00007FF74B8A7000-memory.dmp

Download

memory/4696-43-0x00007FF74B740000-0x00007FF74B8A7000-memory.dmp

Download

memory/4696-45-0x000001ED0F420000-0x000001ED0F486000-memory.dmp

Download

memory/4724-271-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/4724-357-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4724-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4724-276-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/4852-283-0x00000269F0730000-0x00000269F0796000-memory.dmp

Download

memory/4852-284-0x00000269F0730000-0x00000269F0796000-memory.dmp

Download

memory/4852-372-0x00007FF6CA8C0000-0x00007FF6CB003000-memory.dmp

Download

memory/4852-282-0x00007FF6CA8C0000-0x00007FF6CB003000-memory.dmp

Download

memory/5252-291-0x0000018635460000-0x00000186354C6000-memory.dmp

Download

memory/5252-292-0x0000018635460000-0x00000186354C6000-memory.dmp

Download

memory/5252-290-0x00007FF7EE940000-0x00007FF7EE9ED000-memory.dmp

Download

memory/5252-375-0x00007FF7EE940000-0x00007FF7EE9ED000-memory.dmp

Download

memory/5656-19-0x0000028EAB8B0000-0x0000028EAB916000-memory.dmp

Download

memory/5656-0-0x00007FF761D90000-0x00007FF761E79000-memory.dmp

Download

memory/5656-22-0x00007FF761D90000-0x00007FF761E79000-memory.dmp

Download

memory/5656-2-0x0000028EAB8B0000-0x0000028EAB916000-memory.dmp

Download

memory/5656-3-0x0000028EAB8B0000-0x0000028EAB916000-memory.dmp

Download

memory/5656-1-0x0000028EAB8B0000-0x0000028EAB916000-memory.dmp

Download

memory/5792-391-0x0000019D51B40000-0x0000019D51BA6000-memory.dmp

Download

memory/5792-390-0x00007FF7FDE00000-0x00007FF7FE13E000-memory.dmp

Download

memory/5792-389-0x0000019D51B40000-0x0000019D51BA6000-memory.dmp

Download

memory/5792-448-0x00007FF7FDE00000-0x00007FF7FE13E000-memory.dmp

Download

memory/5908-444-0x00007FF79FCA0000-0x00007FF79FF2A000-memory.dmp

Download

memory/5908-350-0x000001ACDA220000-0x000001ACDA286000-memory.dmp

Download

memory/5908-351-0x000001ACDA220000-0x000001ACDA286000-memory.dmp

Download

memory/5908-349-0x00007FF79FCA0000-0x00007FF79FF2A000-memory.dmp

Download