a6f2d32252aec86962e023c58074f0604fc68c5adb42eb5806b2796311bb413f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260711-fd86nsd16w
SHA256 a6f2d32252aec86962e023c58074f0604fc68c5adb42eb5806b2796311bb413f
MD5 2b8b4a08eba3ada56b111bf5448e5d07
SHA1 a92c4ba9bee5b56098580ae323d2db00c99bd288
SHA512 dc6127222d36e64e5c1a1aa4da36576aa7f326caac25c9b8aedac96ae2e9f8665c62ae60d6cb8df4de196b9d0ba239f438c60f963a7ffc70c44269fec947b58a
SSDEEP 12288:bg49H6LC5SNh3AdsdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:c49H62g3DAOzIg2XBOVioKGBFa0tJc
TLSH
T15A35BE02B7F99134F2F31B31AFB592615ABBBC629D35C60E23D4160D09B0990EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5872	alg.exe
4788	elevation_service.exe
5012	elevation_service.exe
2628	maintenanceservice.exe
4512	OSE.EXE
3808	GameInputSvc.exe
5424	GameInputSvc.exe
1248	msdtc.exe
1304	PerceptionSimulationService.exe
3868	perfhost.exe
4724	ReFsDedupSvc.exe
2920	locator.exe
2892	SensorDataService.exe
456	snmptrap.exe
1684	ssh-agent.exe
572	TieringEngineService.exe
1256	AgentService.exe
5188	vds.exe
236	vssvc.exe
6112	wbengine.exe
4436	WmiApSrv.exe
2308	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32889f58e05f6396.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5424	GameInputSvc.exe
5424	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	704	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	5872	alg.exe
Token: SeDebugPrivilege	5872	alg.exe
Token: SeTakeOwnershipPrivilege	4788	elevation_service.exe
Token: SeTcbPrivilege	3808	GameInputSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	572	TieringEngineService.exe
Token: SeManageVolumePrivilege	572	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1256	AgentService.exe
Token: SeBackupPrivilege	236	vssvc.exe
Token: SeRestorePrivilege	236	vssvc.exe
Token: SeAuditPrivilege	236	vssvc.exe
Token: SeBackupPrivilege	6112	wbengine.exe
Token: SeRestorePrivilege	6112	wbengine.exe
Token: SeSecurityPrivilege	6112	wbengine.exe
Token: 33	2308	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2308	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2308	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
704	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
704	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
704	2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 5424	3808	GameInputSvc.exe	94
PID 2308 wrote to memory of 3652	2308	SearchIndexer.exe	111
PID 2308 wrote to memory of 1696	2308	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_2b8b4a08eba3ada56b111bf5448e5d07_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:704

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5012

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2628

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5424

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1248

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3868

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4724

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2892

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1684

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:572

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5188

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3652
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b65249bdd17e9c9ae48b0a31d38889178a3da7f671944a3a3dd42e959d560f4c
MD5 dd5579f999a994da33d63c9240f62188
SHA1 ce4f65ddb5242c94de401cf0c35f24da4edbceca
SHA512 4f0ea40ba3e4207e6fc9c42b652244c4323fc91fd2c8cc49bb432ed76cc64b6820a58b780fb81d78d4177e59b0eda86298e7f9275c92548644b1abdea236d745
SSDEEP 49152:ns9632BuPkFKRrdE6oh7stBhuXjfS4LWxn1OcgOOM4Fa0tK:f3q6gjB1S
TLSH
T179D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 84fb18a3b35a3980129161cca6ef7065a0f988b687305e10e52d41db987c9aad
MD5 49c6f27a7bace404a682f7370e070cc0
SHA1 a2209c614952171f358e6954e2ac15779ca0e79b
SHA512 d06273bb31e476534041c9b212d1de5a6780fd65d3369499a1e0db943f0f7a9d26ab7d6e4418c77dfea6e6a2134548c8dc18d0d6193562318271b69aa5417107
SSDEEP 12288:u1XLssBEkx7as172czAVdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:cXYyReczAVAOzIg2XBOVioKGBFa0tJc
TLSH
T1C0050235B3E109F9ED67817CC9A28511EA73B8914770E79B03E4D5290F233985E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 fbbca471e76db907d4a2a1862d90b9d3c2c04fbf7a3a0d858aa60455ddb92730
MD5 5f3d2536e6629ba4bf9fa98b45ae2ffa
SHA1 ae0033c6848622cb47fda999db91208beb3fbc71
SHA512 84747d5ae1f841bbb6f2855799dd285e0ae07e39f14719d390d89d97950ed983ddfafd3839d47665bf33ca0185c337d098f0b10be09e1e806d63a69de2d2bf55
SSDEEP 24576:o0DeO9g0P8xOrMiAOzIg2XBOVioKGBFa0tJc:oA9g0EoAOcgOOM4Fa0tK
TLSH
T1F045AF26F6748335D073C0B9C5D2A69AED7230821B308ACB4296D77C6F677E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5db68bd2a57e94c0a55ef0f4a4bf4626294e92956531ab67292b914ad8abfe24
MD5 c69898d73b39299b187eddddb06b6412
SHA1 fa61b428fc97d0a163cfdaf6bd4228e857169436
SHA512 4824a703e590ab7c90a6aa9f4489d60615b7ae8cdeb28e23e345c70d0aa527f1aa4fcd79c889f2b64d00ff84322f878cba4705752a1994fb50802a7636c28774
SSDEEP 24576:uC5/ezSC6vUyD/aqgrvW/6q8wyurAOzIg2XBOVioKGBFa0tJc:v/ezSC6vUzPvuHjy/OcgOOM4Fa0tK
TLSH
T132756D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 cae6f3cb1631679b67c74dad7d4e567984bc09635064060131b100934fff3bb0
MD5 fc02615953fe9887e46bc55883e27969
SHA1 94f390b6c9a95ce0fd8f08ad5a65f05c8c027fe6
SHA512 e725012f84820a4838f0a4ccecc4cb448fca7f3106f7a7650206540df2ce872b12944c1ffd437e6bfd8fc95a140d4e957cc06aecf8f935b3386ce421e5a23687
SSDEEP 24576:WAbLPDPY5v/l+d4AOzIg2XBOVioKGBFa0tJc:WATPY5Xl+xOcgOOM4Fa0tK
TLSH
T17F559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB1246D76C2E677E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 69637083ca9a3f6e03218b248db15f117144916c2b9de734323dd6bdd667e4cf
MD5 651df52aa451c80440baf8ad0221a767
SHA1 2a68468a2ef138219dd4c357319bb74d511f87bc
SHA512 386d86bf688faccc32defdcb5975a132ba54adef216e7e4382cb62c28b186bbdfd438915dc2c1f2e34efc611e7095a5745dd3d3de60824fcacfae4ffe05c9e63
SSDEEP 12288:AQ1dtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:AQ1AOzIg2XBOVioKGBFa0tJc
TLSH
T115D42333E675C3E0F7E9907452AB115209B3FDD12DBACE3A996FE14E0930125CA578CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 3d6b710f100aaf92f47aca4a4f0447052f9890795ca2c51c082f07f5e121a103
MD5 faff582e7f180eb86543dbb0d90aa15a
SHA1 0ae96aef8b88a539f153c4200263277b3d83d992
SHA512 a1ee47db37e2e4f8369b9deeb012dbcc10b4224d695f5a0f6ffb0405372ece7f354b9b6fdd594022fbe2fbb4b813720ef2889d018d969fe66a75888c535c78fa
SSDEEP 12288:veBNUbTVO86UGdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:vJIUWAOzIg2XBOVioKGBFa0tJc
TLSH
T10D15CF3BEE38ECE2C27A99B857918640977274704F6293CBD175C20ECE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 11544b3c1a55b9236349323b70b2cbaf68e86a38bdd3d9265a8e594b1e7b758c
MD5 962b9074d52bbf8388cb662ed1cd9eb0
SHA1 62b0ed5e14d5859584968b8914909f92fdf3aefb
SHA512 008c41a14a1dbab81791eb2502173f698dbd435ae72e86e42a890758cd1a05c90558986198a3558f3b8ca91733d73f5732872129e4094c4c87f62b20361cfbd7
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THv:VQvGAdlCEL8c/9RNw5CVLS
TLSH
T15C367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 af7852c015f8068e95cec3eeb2f46c89ee1e6f13e2ddc51fe407742a4641cad0
MD5 bb2736c02dd3b327b3b3cd44c664da5c
SHA1 4f54a5708faaeed0837fe0260fb0f82cca8b115a
SHA512 6db385273c7a1127133ecbe9f8bb532e985eb96fbaeb046b55538cc9a8e23bc33790cea28824a54e5b88a58e026a274e866067a09dcfabf90bdf2169d24fd3be
SSDEEP 12288:v4wSfxL/2Dc3bDLLmt0LDQewsAjjdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIcc:QmewsAjXAOzIg2XBOVioKGBFa0tJc
TLSH
T17D15E031FE75D036D3BB0DB61B26C716187DB9604F621AC3E3A8898E49302D22776E57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f959c977029fa00d4e21456b9c21eb133cb5b0dc332ed631e226f86e5d7e969c
MD5 7d4c2a6098146be69025728cd278b853
SHA1 ebc271250c945ef35b0e09cd2ed46c2ce4ca36a1
SHA512 02b5313f4146491b63270dea4b8369ff93794481466548e70f6399dd289bee11b713366e7d6d090ea53abc3c47851604dbbe82a55a64b9351e4989959ace36ce
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHV:HUEtQevvqc2W1cpV2XF32V
TLSH
T18B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0199118396fe0df39cc48b3433f3fc98d375ee3b5ec1917054c8ad0cf79b061e
MD5 65277ef1ee880ab85d9385ac057d6c90
SHA1 81420e61c8bfa86bcfde795f39edd5ddaa55fc02
SHA512 37331131848c357c0dbc2aac070af0f5d16ec11ec2c524fbcef89258c0a0d82a4ea041381c3f30499aa33c0c326d92cb0aa1f5282ead55599a70c1267fa45292
SSDEEP 49152:2HbRquA/m2yL5zMfFiV+XenmE3/zQOcgOOM4Fa0tK:Yoq1VjnmaS
TLSH
T15FD58D1976B8C2E4D1F6C37886A2C647F37178154B319BEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0e6a42c5ef56c2e8ee0171191daafa0b0cd5ffb78d398e792aeac780d1043dfa
MD5 927c0bc5eeeeabb5d52250eeeb04689a
SHA1 c3dee6d5b631d3bbd408d25f737692a5aaa6d19a
SHA512 f996da00aeab55502dbdacaac4e486b63c2e4ce871ad70639032307ce7f4b40ea99c7eea6e8a8b36714ae3be65c5d83085f967c5cc8c9a425aa62004fbae5d31
SSDEEP 24576:RAhGLvKFoiwtA5l7S53eAOzIg2XBOVioKGBFa0tJc:RAM+Foiq5FOcgOOM4Fa0tK
TLSH
T157459D91E7F945D4F5F3AAB899B68171EA76BCA65E31C20F2160D10F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 1355eac84b7c45d9f1df64d8fa411aa8646ddb72b03615be8485ef2762619ca1
MD5 77363e1f53e18abb4ce772cf335a6d99
SHA1 cbcae356b9730f842732c83358593954b34fac08
SHA512 d29bb46e7094d0348459383dea7154a95a974529d307980752960667e9a1b6589968159879f74aaa2611dd28343c3dd054cc501c7250d3dcea59b1ac21ea2c03
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CadtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kvl:QwuuOWJAOzIg2XBOVioKGBFa0tJc
TLSH
T19505F15676A50CF8E9A7813886978132F7F3B8412A35CB1F1764C65B5F33321AD2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 78aa1a9c16bfadfa542d72e92854a5bfd64cf419fc91a57dcd218b21fc1a91db
MD5 c6c17efb7962456451fe86c07c8600ec
SHA1 5bdb8d75a8b9a566117792ad6db5d7332293d95f
SHA512 75f41b4987cb04b6b22a7480a5772626c22753fec7bc4551bcb8bd4638fd46bb891299b4a2ddfd026150364dbc74798b7d87dd8eea7174e841071af67b592feb
SSDEEP 12288:78n1IfcdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:AnugAOzIg2XBOVioKGBFa0tJc
TLSH
T140E4126773F451F4E2E79178C9E20601D7B3B4922776C3CF166A825E0F22AD14E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c415e589117c5f5381dd4647fd3038c4e868b669e1bf1a240e24b58f04659ccc
MD5 a2b370a60dbce77294f03ecbe4ff447c
SHA1 8d404466ef08c3b61cb8fd3d3055dc626069bf1b
SHA512 0fe17fc75706bd1978ca15534a4893169545f6692a5b38a208e450b140989ea7a383c5e7eb17c71f1ddc6107ed163de75cf60ab3e15c0d6b6e0e95a22ecbea1c
SSDEEP 49152:sNldh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uw:KQRQyi36YOcP8Lvw2gAf+PN3NS
TLSH
T18B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d89e59b7fe92da783d7d9c7cc2f368dce446e4b51e4f649135e58c492bf61d82
MD5 f99a0f50ccc4c5266eca1ea952cf46d6
SHA1 b26956fb4370deeb938f4ad827cc93a0c8c819e8
SHA512 9808ad3189203e538d5f04934d42469c19d12a4888d132bf47f274266abd69232b89d8e41cae9d095acbdac3f5c2a2f1bcf1a1bf1550cad17978d53e5af73d9f
SSDEEP 49152:sNldh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UV:KQRQyi36YOcP8Lvw2gAf+PN3gS
TLSH
T1EA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ffafd273ada39ceafaf589ee9a71acbcb1f81b76dcf586b4377906f3d54948aa
MD5 cf7516a0c8e613727437c1cbc9543386
SHA1 6067652b0317ac0607c05a3c19cc2a14085dc88f
SHA512 3d1bd660cda1a01fb3362b388d5dae4d1e898ba3d227ec70b5d6034c3d43e7e7f20390b0181633ab3dcbeb478f7f34e8fb24d81682208dff70d1019471ff2de7
SSDEEP 49152:w68Qg55nhMeWu7PNU3/TOcgOOM4Fa0tK:qthbRc/6S
TLSH
T1FCB55A33B2F200A9D44DE1769F4A873196D27C718FE1E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 280e292c90e3c1b40bdbedebdc25b53bbe794abd29c7269ef01a6cac80573d8d
MD5 748d63cfa0cdaa35b203e773517680b5
SHA1 d49915c9221070397226c0d427f3d350d701707b
SHA512 323dfc351468ec73ccd192b7b38ff6f52308cb2c9865887819eb29ea644abe3faa1faa79e98902279beb75354da185f61d6dc6c76021b4e06c256072068a3721
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99K:jy5112gYy5azzVv569nLKnhZYS
TLSH
T178168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 81661d1c7c59886f9a56e41f427e83f2801966672f69048e25c54d6600a7ccee
MD5 dcd1938367c205af9f7e6c313d2bbc11
SHA1 110bbbf0ba842e4fffc7eea9bb3c354b8a239e54
SHA512 7ca02dd84037cd8f36dc021927f8ab016685fe21c53549bb693c6fca751c40183084edf90399b864f8802f3ce7d64f84ca779d80680a9652e3a767dfb0d9de04
SSDEEP 49152:ej+taZ3usBWOBr4tEGp0bqx0z+n217aau1gljOcgOOM4Fa0tK:2u6JmTxd2dqS
TLSH
T147D59E13F1DA01E8D06ED078974A9233EA62BC490B35B6EF0A9073552E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f15582eeb9826c2fb72b9351bcc8762e374e19009684909ff6421f1ad82382d7
MD5 9814c72abe63fa6cac4001473d2ff458
SHA1 33c0263114f32b16dde46f6e1eb0c9bfe72edfe8
SHA512 fa9c718a3248cf05077e893957d360a92d13c07e9b3fef4f49c095d507096ff3d086353453ce8de333b1734a4139256ab724359f40792393e0de09fb6ba55ecc
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xSOcgOOM4Fa0tK:dmifPbRmS
TLSH
T132B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2ccd8b279b0f5e739d2300a4a9afd31f04f5464080946db6cdf092295318954
MD5 3709c02ccab099898bab5dd7b0ba9d78
SHA1 f2742b264519475cf63bd3093138b9ca6609af74
SHA512 525ec539bbb6d0869afdf4336fad34f26cf31caf0510241bcfa94aeb2417115c641b610855cf66bebb5ad54e9cb27a49959691a7bd5f5a71c837cefbc8323909
SSDEEP 49152:zSuZQIY0Be2K6RVtOnks6NMHqqOcgOOM4Fa0tK:x5dKoi61hS
TLSH
T113C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3db2cfcc8a25a9d1fc80a4da20cc2cf80a8d0d1478329706c55a6dcde28b2072
MD5 f6940e9b76adc977d64c82924ce4c8e9
SHA1 a578b17f8e65ce1332e59864f078c33ba493540c
SHA512 43d5bea39b30d354ad3c38b3841725f217ddc1de6331c5df23164227d04799e980347619996b2a9896f60bc155c82f4feedf779d3cd574baf45f338001bccf93
SSDEEP 49152:UroSn8EApI0figTgiDn0AP5wVOcgOOM4Fa0tK:OX2iyphzS
TLSH
T1BFA5BE13F2D901E8D05ED078C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 4b807a5b3c824a2f3aa6bcd5312623db18abdd49428afc500e6733576edc5d15
MD5 6cf67c0013f6586c1d51fe8c3bbfbd0d
SHA1 85fde7b22c772376199976ceeaba56154a81755f
SHA512 52c082d993999821a4544286e1ca51635b5a1e4c63ad586cfaa87210438bd393a85ee916c19cabb644b6afd87bdf7795c632102e1b134542cd911a256c255d45
SSDEEP 12288:YsdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:Y4AOzIg2XBOVioKGBFa0tJc
TLSH
T12ED42373F5B683E0F6D4D0B042A7115249B7F5D22DBBCA7EAA6FD00E0A215254A47CCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 e157094ee1cac2933221ca5ac4fb8c74c8e0194ed367c4eed89dcdc31e01f1e6
MD5 ac0ea663f65616a5c00a14f0e665c755
SHA1 79f89f71a37913ae96730f1e5f24e4b07bedcca5
SHA512 d6006314ffadc8b74bf39e9588b382f3ac95bbd9307185e8298c2110437dd05ed475a3d1f2b9a9bef77814d9ac7d2a9a5ac9bba69c2ec43dd84a54caaee414f3
SSDEEP 12288:5g2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:5gxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1C0D423250F25ECACF1DD88324A692A52E379F92BCE72944D2DFCE9924C2335E4513E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 3e88aee8d264c9f377093ee692af5b26a427dcbacf62b5368e806fa345c650ac
MD5 9e10a9e39abd1cd0971f34b32e90e3b7
SHA1 e61fc32c826353980b52e3534a002f1e4138c0f4
SHA512 feada67fa3726fa2190f813b267387d4bb3595f50d54a5746e5e88bb816952ca2cc7eec358be0f53ee88672d36382a15d386a7733bcca780d363c4d6ccfefa61
SSDEEP 12288:jC2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:jCxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T19AD423250F25ECACF1DD88324A592E52E379F927CEB2944D2DFCE9924C2335E4513EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 9349186246996218fd69d701a421b49b46dc84cd33e9d84aac13617f5c78f986
MD5 7f39ab3e640d7eaa7590e3a885004e5e
SHA1 f67199ff3773677587024d98f571518f3ca2372d
SHA512 759753c26940dad9f9386faffac1317073ed1ba29222a23551439a1fdf35962cb47597082994addffbce983e1503cfc9fc015b2769aaaa48cd7f9a73cfb1dda9
SSDEEP 12288:il22tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:XxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T12BD423261F25ECE8F0EED53589651A12E3B6FC67CE32954F1EE499860D333199823F60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 61697fc979caba93e9220f27e54b06953dffbba1cfe9431919e973e2fa3dd936
MD5 c4fbb77624b5b96e301f0611af359fce
SHA1 acf5949e1f665ff43465a3d55ebb8f1eae0397d1
SHA512 993d24ea5ae8e47b0ab392a641e8d94a3bd81bf9eab299ae603a88c99f7b4f827c8018f791495044d4fd13696afe098706f5ffb8f938a6b93d2032c1371ab26a
SSDEEP 12288:SK2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:SKxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T159D423250F15ECACF1DD883249692B52E379F927CEB2944D2DECE9924C2335E4513EB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 f55b0591622f7d5300a07e68c9695b6687fad5a97634eca8e18a639e65d451dc
MD5 c928972c4fa6e8f2509c0fa0b810fc20
SHA1 6287e5788ad1a184644e8a8a020149fa4b5aeb85
SHA512 e19845950e9e327b9ba3db71251fa0cfee95c82e39759ed6f1d2469c82dbfb55d58c421202c42c3b8916d41c5c0491e734dcb53d78a73c704b910ea4652ae2d4
SSDEEP 12288:BN2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:BNxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1BAD423250F25ECACF1DD88324A592A52E379F92BCEB2944D2DFCE9824C2335E5413E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 41f197e4ede045841a393253aeb99c6c1031cd64c403e39f139ba9241601bd54
MD5 26eeb6e59cc725778dce5bfe89875b5f
SHA1 85be8cd77b2f31584a1ab1b0c28588076a27a29f
SHA512 c7ac5087f48f733eca609907df99389149fe86564cd557e54c7e0180eb9dd5170a16a0e03d7ee2f7caba9867e616e9df616ce771bb764f06e94dbcae7a3797f9
SSDEEP 12288:cB2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:cBxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T12ED423250F25ECA8F19D88324A582A52E3B9F92BCEB2944D2DFCD9C24D2335E5513E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 84dfd9ed267536ebd3ae08ed0f13284bed544852ca687ee8f30101bed5a0b7d0
MD5 9187cb07174f9af8bbd4987599803e7f
SHA1 6aee7df64620577ca1a381cb1c6074778e7b3d7c
SHA512 4f29a93a9c68e7cbab5d233526a699c82de5e59376f77fab0874b1f4ac0ea975367a5583ea231dbd2a81b52778f25bb64fbc6c1e564d3d380dbaee7542c6c066
SSDEEP 24576:HZMqz3MSdZxqOz+jLVYcyJVoA51rTKZTCLUOQh:HZMqz8WLz4VY7bTKpojy
TLSH
T1CF15F16577505CF8ECAB813EC9254916D2B2FC2A8E70C60F07E876665F333611C2AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 417ab81543af6d05a7c30f75cddf6fe17cdcc70c3416bc110b09f0b3830c837e
MD5 eb8081f616f76e8e1d77039cc2c43503
SHA1 cb37a2ab397c25095ae726603018b68e5925751e
SHA512 8dc2663ea18d213effb1f3255e86a85e6e475daae4c86ab869a23019e5ee3026d7d00ad530beaca084c3ed8b6ecc4289ee88881f25ca2df3cd6338bc3e8daebf
SSDEEP 12288:9E2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:9ExqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T159D423260F25ECA8F1DD88364A691A52D379F92BCEB2944D2DFCE9824C3335E4513E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 7bcce58497fb04ace41597da20c2ceeef44b76a9ae025babd87becb6440aaa4c
MD5 f094b916c582ff7fe5c1bdbe6ec98ddc
SHA1 b31335d60da782c9496e15e959943d1d91703f57
SHA512 73aab03e706a9d660a8608870a984f7de6c19ad83a53e7602acb00c9860543635f4808c9e4d9fbf99a8d31daeb41275aac39b872a8412a9f0afb8e7ccf38d68a
SSDEEP 12288:/n2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:/nxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1FDD423250F25ECACF19D88324A582A52E379F927CEB2944D2DFCE9868C3335E4513E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 48b342334cd3163609061e552772fa8d6fca4231ff2ddacbf810f4cb2805b584
MD5 f1041901e38a657d8939a50e4edb7fe3
SHA1 e50d892c1997feb0575ac395e1e88c3d07271123
SHA512 3c2105ee30d4b7b3aa8b9d23b0846809188ecdd50fe6dc92242c1e1c4a89ed525c79cf5aa1556e1b59622021222bf03d4e7f9efd08d1a308e45ce33daaae8daf
SSDEEP 12288:3HPz5L8k2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:/zykxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1B1F40217276178F8E16A813989621A02F376F837CF318A5F17E446B61E233959D2BF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 64ba8b7ec13e5b10edcb9b1937e7dc97f90625cbbca3668dac956ed3417985f8
MD5 35b22811e13cfc1ba00e69f5b76c89ab
SHA1 ab64253dbc9e720835ce8ba43a7363eb173a8ff7
SHA512 94c929042feacabedd2fabf19d0aee1486d02627cdc83b0edd93865498ec444e9838aecee36142fb9bb9d36896c5dc49e69168a16ba76d3a2820ec653b493520
SSDEEP 12288:xZ2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:xZxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1A3D423250F25ECACF1DD88364A692B56D379F92BCEB2944D2DECE9824C3334E4513E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 940187414685b995c0a0a83f4db7c363d0a6fce35ece1a73b9fdc4b65be2028c
MD5 ab7d02f553e7a69ccea7c8bee8ae6204
SHA1 209fd6988b8bd6c5f39f204e912368f12083f056
SHA512 67d3a4450abf49248086bdaa55b00f88702452903e4c59a9733901b7d70a24604e69bf7b538ba64903037ea2e23ac8acc0e035b35dcab5ca7f2938c962c54198
SSDEEP 12288:dm2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:dmxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T197D423250F25ECACF1DD883249692B56E379F92BCEB2944D2DECE9824C3335E4513E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 c5e809d9d68b0261afc9d67daf7191a8e299df42c97cacd7b97e39bfa581d619
MD5 55c727f0907ea3f7861b951a0776f55b
SHA1 4f9dcbb79f751bd8d7e13ca9b1b14ec9c2918102
SHA512 dfe423ddb704ca7ca1fdde43c3a6f4e1239de4ac30a40a974283f9d585f2a5cd07015482071789d73e4fa085825a65f1ab056572691c688635c27f14385c6ed2
SSDEEP 12288:aHPz5L8i2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:KzyixqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1C2F40217276178F8E16A813989651A02F376F836CF318A5F17E486B61E233919D3BF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 958d8407c90d6984145161a005bc84716d26b585ccc11c3b33014fa391b340bb
MD5 e4e24271a6072ac07c7b8169ecac8004
SHA1 2253ca3bf3d80dadaf8e1053730f4ec51186d049
SHA512 22e09b9e81c45cc403963b75adc84af5f51e350a8fdb2a3a499051fdce7fb93e7bf4980da5b2e5132e62955c93c70c2b0f24e8ae03268c9f4f95a91c7ee4fba8
SSDEEP 24576:KTWaLI3z0zEQvxqOz+jLVYcyJVoA51rTKZTCLUOQh:KT1LIjKvLz4VY7bTKpojy
TLSH
T1AF15F16573505CF8ECAB853EC9654916D2B2FC2A8E70C61F07E836664F333611C2AFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 179817e426739c0ccabb0867f5118730e3ffeb871ff981a02d76ea68568e5ae2
MD5 f26167db03c77852fac88cfd3cbc21a4
SHA1 9670677f0b718bffbac7797581b57e3595e834ea
SHA512 8a28f071e532ab197e3fe7998de3ecc10985310a92aca963e117b182aeb4dded8ee12c28557958ba292e3606ece131c26c731ebf4f2d4faabe6d1fde2576af87
SSDEEP 24576:03JdRCyOy7qZwxqOz+jLVYcyJVoA51rTKZTCLUOQh:+JdRCyOyO6Lz4VY7bTKpojy
TLSH
T10B35CF90B3E414E8F0B78A3589764511DAB6BC5A5F31CA8F03E8665A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 981f471cd202eba3d92f3b52a85fe5793cc2c9f05935966322ed65fd963dad6d
MD5 bb2c2dffee254afdcfd2ea4e8ad89581
SHA1 ad363fbb3b9c383e5767f22f95898819301b4988
SHA512 4a925a9d155a5e5479ddee22495488bafb813eee272d01656a0b9d93d8cfa4098997c7b50a9de51b056755eec01e4f4b1b38d5285e4161559ae74db40fd81822
SSDEEP 12288:1l2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:1lxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T1BDD423150F25ECACF1DD883649591B52E379F927CEB2944D2DFCE9828C2335E4513EA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 7c17ab7112cd625610e8e378e09cea51776bd7c0ceaf88527772b15fa0ff6f57
MD5 7085f600076e79ebf6498fff05ff8c0f
SHA1 e0d95c32aaaabe015650f469c5f18dbbb566d4d0
SHA512 c316528d50c9968921449754040175529eb97db9dd38372d9bf964804f30023a4c00faa9e0658499018820c38bbcb5c1d409246e0cb106195666c61eced59aab
SSDEEP 12288:tx2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:txxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T171D423250F25ECACF1DD88364A691F52E379F92BCE72944D2DECE9828C2335A5113E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 f26d93e0e037471cef3cca7d6f9b1899d67b0ecac3fad71e0c0be9fe3ad00df7
MD5 8d9efcceffe6d8dea4cdd24d6ea07466
SHA1 4abbf8834a52f7e23da31f7050c9682ff171e54c
SHA512 090a0dec808f8642d62e097f6828ca91b9f0ce60e76d2f45e1c15192a629cbf8d6879adeec8f85ef50d800eb464210dced84c7092c458ba718af4c1c4302657d
SSDEEP 12288:gv2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:gvxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T19FD423250F25ECACF1DD883649591F52E379F92BCEB2944D2DECE9828C2335E4513E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 1cdc18a5477b34fb8d9eebcf62b3baa5a72f1d00f15b0e63f29118715e00b8db
MD5 7523d2e90b892339d6fb7990b3d81cc1
SHA1 d06af15f550abc27416710308446b366252e87a3
SHA512 5d0f536aefdae0ed4c720707e489bde463d5a5f3fb17177b0fca21301265c3f69de165ce50373b334625a076243d4a751f9871d2efc1af8a98eba59feb3f4496
SSDEEP 12288:vz2tyXqZzUvph+jWdcVYkGEyJ0YSAkA51reIKxHr5VCLUNUyRLN:vzxqOz+jLVYcyJVoA51rTKZTCLUOQh
TLSH
T129D423250F25ECACF1DD88364A591B52E379F92BCEB3944D2DECE9828C2335E4513E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 9fff223c31f5dff3bfcc3bd6652e5ff30c16e2a62fc98999d49862ba83af0206
MD5 f6617e82163ccc3a7f3a011becdb311f
SHA1 ceca232d7062d16a4c4f406b725881d62f37dc13
SHA512 c360aa4cdb0ae7001c1e4b65f4e75c17376a4b1adee96046e2258ec0006660934787148e9c9a8d7ddbc92f3aa450839bc969423e96d4fb3fce6f50e2cd99c963
SSDEEP 12288:i8UfHdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:87AOzIg2XBOVioKGBFa0tJc
TLSH
T184F4012AE2A442E8D0AEA174C7564641B773BC6157F2C3CB57D5F03E0F326509DEAA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 0cfb4807107f3e9f990f4c839ab5db52f0d85d36a29cb21884be62a8cc015daf
MD5 d998477b5ea3a93feb7f6d5de2f8ba91
SHA1 a09e4f49db3d5792fb310e133bf407661a63585c
SHA512 8f6f6ba0d46ad91190b7362d668566f7528475e2e5e9333e0e28d6d3a501017e379f804a5f8ad9ab0b3291b850a4541a8c1003f49c114bd0937c9b5a1b3594a8
SSDEEP 12288:Ri7+dtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:4OAOzIg2XBOVioKGBFa0tJc
TLSH
T16BD42333E6B687A0F6F9917442AB41211A7BF5E11F76C9ABE91FD14D09306108E63CCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 08398e11e53828998648cb0ce396db2799bd4bd80c34577af6cbd7fb443a3bd7
MD5 bcaeddfb66e1513309928c0644831c5a
SHA1 b88ceb0a219c29eeb8bab654f51515e02de44177
SHA512 d4bdf7841965a4195bdabe25d245fdcf99af9d57f0de0283283b2267c7eef0a1948f9b30c1ab376100742c6346d675f7d85744291c716cd0b145f9293e9b4ee4
SSDEEP 24576:1gb6bmBIi49WNNFpg1rSvFv7bYQAOzIg2XBOVioKGBFa0tJc:1gb4mBIBhGFEOcgOOM4Fa0tK
TLSH
T12365AE1E22EC02F5E0F9D2B89DAA4417D6B378161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 998b375a375d5c943fad8e5c81b5231ab0f94d5dc151013ebf4b27e6ac748edb
MD5 e6dd40df7652ad92c76998075ce6bdbc
SHA1 87b3ca455fa128f7b8b9e5d20e9adb10099f4282
SHA512 1fc7741e172efead644a57445996be80ea6c84cb139e82af0278a543e082dbbdd61e3547e784e0ffdd0acd68234693aef42d09b1dabefbc15a70cb7a9b23274d
SSDEEP 12288:XSGMdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:iGYAOzIg2XBOVioKGBFa0tJc
TLSH
T196E4233BB1F692E4D5B9C1788176406379B2B0E01B359AFF49EAD03D4F205E0663ACC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 68ffae29e3bf41435d1c7902267c51f522f33f5d32acc4bad34b9990cb544914
MD5 c5e65b4598fea870bff90c4eec3d8c30
SHA1 3b3e3e90c6348a8ac06edf28803ec4b111f2e69a
SHA512 e009b37fe8ece7fbdf050fd9f0569205852c0a6ebf2124a9b03519ec10580b3f9b46a3a8f6f85453be395103a409eb3c7cf4e8b9ff16e4f88b1e129368d41d18
SSDEEP 12288:YVdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:YVAOzIg2XBOVioKGBFa0tJc
TLSH
T1E2D42333E17687E0F6E5D07442A7011219A3F5D22FB6CAFBA96FD00E0A215E54A77CC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7a9adf51f0485729f2f197005c979fd90a2527ba7e8c065f54acee1a9cd34aa8
MD5 95047802ff831e86b3ba2da507159e29
SHA1 6dd6fab1742ef2588a8d0bf5065ef28c0558fc43
SHA512 0190dd4cdea418ce876c6c1d00c6c38a6a295eca5c241095775007411c21760b7936a0cc82b06a8b72175cc15f1314d7ac58639713ba1ab31c58a3e7fdd7cd8f
SSDEEP 24576:LRg8u8FpJqH1VFria7/mSAOzIg2XBOVioKGBFa0tJc:lPZFPqVua7/6OcgOOM4Fa0tK
TLSH
T17C35F166B6E102F0D47BD13889864663F6B2B4211374EFDF06AC8A550F236A54B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 b41dc00835ca0a440232291e0e99bb9e89c55fcdc164311f699dd6ef64d31561
MD5 e045b34f4bef2dd174ac02bac81054ff
SHA1 a2e3ed71f534990750254bdc540272a93d2589a5
SHA512 adaddcfbaf41b26d55608d4b2c8f8c2dfd6c7784684da539570fed4cf1a80dbacf253be4e3c08ba177d1aae1749cc999e4c4273ac561c7867aa9216128b0fb5b
SSDEEP 12288:vHvUrBFrEjwaQldtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:vPUr+NQlAOzIg2XBOVioKGBFa0tJc
TLSH
T1E905F22F62E918E4F676E17C85824709E772B4621712D2DF02E1817E4F23ED8BD3EA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 792bd2d09a17c60dc0cdb977a991b40a44bdcfe72eafa1a09831d087205ebf76
MD5 cfcec8bc7431cb71b7ae4d33b446e14d
SHA1 7fafe5ee5b1fcc8b458395ad11e5ed96acaffc7e
SHA512 777d2de0a36ae055baefd6e4e14ce5326e40c03378b26696612f2b66ca3aea19d285f443efb692fd873dff1def1154c2af92a84cd043ca58792a16e95c44a782
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDOcgOOM4Fa0tK:kG05lO43b5S
TLSH
T13FD5CF6A62EC01F9D1BBD17CDAC6460BEBB23415033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 779d847511a8def3b47dd655f14bca066b0d7990225aec73b07230b7ccce69aa
MD5 7ad1dd6aa4e4fd486dab81a0df73d3d3
SHA1 f93d11989dedd68c660074e4989aa08e277cc869
SHA512 4e02905c45f6bac4c3cbf0e3cd3a1d409585bdd34a3ce3367e26c63adfb4ce627ae5454f8a95ce558c3de85676d83518818742d3e5af2ba5aadf8542c65efdea
SSDEEP 24576:kya5POZ3dpbWVM50JicR2hG0lasx2+47eidnUAOzIg2XBOVioKGBFa0tJc:5a5POZ3wJt2pasx2+mdOcgOOM4Fa0tK
TLSH
T16E65BF5EA6FC01D5D5B9D17CC583461AE5B1346253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 342cfda4df25e4afb32f84b543838b1d93769091f87f3cc54e69abf08b3a233a
MD5 044d80504e339953136d684a9626c6f9
SHA1 86d5b2f31cf6343af531ba75fd99a8e7e8dff41c
SHA512 c433c1090c0e3836cf1309bfb14f67d6fd8a1bfc7a48b26a3f0ed9a7fd58b11753068cd194ad97258b653ff40128a9f6cb62c0b39dd15966abfbdc2ffc9e1e87
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkOAOzIg2XBOVioKGBFa0tJc:zNc/zEOVHFuOcgOOM4Fa0tK
TLSH
T143858C2662E901E4F1BBE1BE89779546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 26d4d8d6e7ae7435786458c54599cd7a2ba511a2d7fe1ba3e675fda24cc36069
MD5 8c7cc2522f8e9965593ba0df5929ff92
SHA1 91e3c253674b60d0184b2e9c8514bb4313438910
SHA512 db1d8f2160e19be76d49cc34f2a9630c4bd4b91991718962a60b2d816ea95b629a99c267ade4574a8eea925ea54ec2cafbc0c945b5e5e0c73937480e7a4dfab8
SSDEEP 24576:ZJnJPbzB4S68AOzIg2XBOVioKGBFa0tJc:ZJnJv6SkOcgOOM4Fa0tK
TLSH
T11815E03DD2A810E8E4B7C2B4815A1756FF31386D2F2269C759B8D4353F12EE0A939F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 6dee0628613b438c5fe9db6c993bfdd32777e7f6a4fba513ab86eb412d233c60
MD5 51ec977bdd145ab999046d14972fb596
SHA1 7b8ce4665dcd32761fb330960e34f7263f4a8965
SHA512 21f62feab2c73592f8ae26fed0e33c327d79b4f57b6f60db74c208ac2dc1d41d5f0b8b47596b9d6b0facded46f289d192d0e15de64201585b95b5511a480e765
SSDEEP 24576:fCLHGL0MoeVtFumTijCmlKQWDkLAOzIg2XBOVioKGBFa0tJc:fCLHGeeV5ijCmlDWDkcOcgOOM4Fa0tK
TLSH
T120A56B15E7EB4184F8F3CAF5CA2694169A327C509B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 f4edb9f91d369db32bc7def974498a7af4e5484fa7f0dfe11e34cdf3687fa2b9
MD5 e04ccf7cb3236f003de0605a69b98f38
SHA1 7956e4744cda98916fde207fb906055df4e40d56
SHA512 d37f831ef0b78074889c603195c4fd74264729a19b3c0ca3a4367d8230c0cf7ad7da58ba8a558dc58951e49a96c777603023fa2ad6c0c450f47406c29bffc9fa
SSDEEP 12288:P1Hck6j5ZI7idtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:L6DI2AOzIg2XBOVioKGBFa0tJc
TLSH
T19305022E737A01F5D1BBD03D86830102D2B2B0B197625ADF4A99C57D4FA3ED8B939D81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 f4aef44bf9d277b565ce6c5a118075ca9bfc627fa0281ef12dae1db73167c589
MD5 d72d1e16bf568273745e694fd5e5107b
SHA1 419d4fb0ed5d3253780c7502c828b025cd3592f8
SHA512 d28d429b19c8391b649a55e559fd56559b17c5b4950deffd345fcf583a1649e3be0da4e07d1297aa1614f19b82d259456e30e25b4d00c883359f38be2dfb6245
SSDEEP 12288:JG6kyWdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:gtymAOzIg2XBOVioKGBFa0tJc
TLSH
T11EF41212A3A491D4F6F94178866341A14E76FC605F32C7EF55E5E22E0F317D0AD32E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 4d57125a9ba71033117b99d7243c7f8d48805cf4a59f0ee97d96e208cadc96da
MD5 e251a501a976bdbe2fc8d1a0810a577c
SHA1 a5da9fffc0a970d39156d60ed0d776a9c57a6299
SHA512 cedd3b32f3d0c440d70e053e804ec073e6502d893cf829e43610ac6ad2df25f744551118551c3a5ece2fb486bd9c2e3aa31f3ba1287b473fde7ad83e4e972064
SSDEEP 12288:+vJdtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:yZAOzIg2XBOVioKGBFa0tJc
TLSH
T1CFD42377E27683E0E6E4D1B40267025255B7F0E12F76CAFFA9EED0294A215D14A33CC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 8899479746f025a9a73dcb5db9b7204a22f70858b57fedc540ae3ff8b52083f9
MD5 97751c2ad00e408c690f7c862e1db885
SHA1 8c22fdeaac498a4816f81ea9b906d63d5bfb0991
SHA512 bf9e5dc8f8bc454f778072d853ba3f6a94eeddca3239d95a2cf3a18bd6ba91c04611df71787b04fab3fe0d9cc6e14cc78ff05cadb70e6c170e104cc99bc842c6
SSDEEP 24576:Z7gGGoTfaidZMAOzIg2XBOVioKGBFa0tJc:FguTrZXOcgOOM4Fa0tK
TLSH
T1AE558C1DA3EA06CAE2B2D275D9721493D633B4311772C6DF2448C03A4DABED8AE75F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 83f02c4b8da18cc0a2922898ed75dce95456f336b0622be30daaf3ec051962a1
MD5 e4ffd3c3fd67cef63cdf0a74cf1619ec
SHA1 e2d10e603d82eebd620902e96ccee228dcf72177
SHA512 297e709aa32d7f96bdc426ed6f30a63799439196178e59ccc6a900c1766430dd2fc09a40afb19ba841015960698ea76ca715b2e8746e6ed65dfb5ccf8f85f2a0
SSDEEP 12288:gpJcm8CN55dtAWNzIgJ2XkCuRViEYfaUDjdeXBt/jaCIctJ5Kv24:grcmRXAOzIg2XBOVioKGBFa0tJc
TLSH
T13705F11FB27E00E5E1B7C13C89824112E6B3B070276297DF46A6C37E4E279E97D35A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dc50b785244053031b9ba5a00f9ab7ae0cfe87b0a12ee9bfe3399f9f272de2b6
MD5 01c7168c68416392a33b7ec578d58888
SHA1 d1b67d06124a410eb8a1bd168862a63f5d103cf2
SHA512 92f548525902304b759b7a94281a3bd527f9bc763fdb1298ae3302d1d5e7ea478f68f203737c57d86b891e8582e61e67d6f401cc5e8b943599933d1e8e5d7b02
SSDEEP 49152:2DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3WOcgOOM4Fa0tK:X3Upow8sB6S
TLSH
T154A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3055DB0174C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-362-0x00000299A5310000-0x00000299A5376000-memory.dmp

Download

memory/236-361-0x00007FF71F700000-0x00007FF71FBD1000-memory.dmp

Download

memory/236-448-0x00007FF71F700000-0x00007FF71FBD1000-memory.dmp

Download

memory/236-364-0x00000299A5310000-0x00000299A5376000-memory.dmp

Download

memory/456-312-0x000001C773020000-0x000001C773086000-memory.dmp

Download

memory/456-311-0x00007FF7C08F0000-0x00007FF7C09A4000-memory.dmp

Download

memory/456-313-0x000001C773020000-0x000001C773086000-memory.dmp

Download

memory/456-381-0x00007FF7C08F0000-0x00007FF7C09A4000-memory.dmp

Download

memory/572-443-0x00007FF6D44E0000-0x00007FF6D4675000-memory.dmp

Download

memory/572-330-0x00007FF6D44E0000-0x00007FF6D4675000-memory.dmp

Download

memory/572-332-0x0000020567BC0000-0x0000020567C26000-memory.dmp

Download

memory/572-331-0x0000020567BC0000-0x0000020567C26000-memory.dmp

Download

memory/704-6-0x00000000026B0000-0x0000000002719000-memory.dmp

Download

memory/704-7-0x00000000026B0000-0x0000000002719000-memory.dmp

Download

memory/704-26-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/704-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/704-1-0x00000000026B0000-0x0000000002719000-memory.dmp

Download

memory/1248-254-0x0000025D27590000-0x0000025D275F6000-memory.dmp

Download

memory/1248-252-0x00007FF7FB8E0000-0x00007FF7FB9FA000-memory.dmp

Download

memory/1248-338-0x00007FF7FB8E0000-0x00007FF7FB9FA000-memory.dmp

Download

memory/1248-253-0x0000025D27590000-0x0000025D275F6000-memory.dmp

Download

memory/1256-345-0x000001D061740000-0x000001D0617A6000-memory.dmp

Download

memory/1256-347-0x00007FF6D5F20000-0x00007FF6D6241000-memory.dmp

Download

memory/1256-340-0x000001D061740000-0x000001D0617A6000-memory.dmp

Download

memory/1256-341-0x000001D061740000-0x000001D0617A6000-memory.dmp

Download

memory/1256-339-0x00007FF6D5F20000-0x00007FF6D6241000-memory.dmp

Download

memory/1304-350-0x00007FF682FE0000-0x00007FF68312A000-memory.dmp

Download

memory/1304-267-0x000001D6A8C80000-0x000001D6A8CE6000-memory.dmp

Download

memory/1304-266-0x000001D6A8C80000-0x000001D6A8CE6000-memory.dmp

Download

memory/1304-264-0x00007FF682FE0000-0x00007FF68312A000-memory.dmp

Download

memory/1684-321-0x00007FF6790A0000-0x00007FF679343000-memory.dmp

Download

memory/1684-323-0x000002D93C090000-0x000002D93C0F6000-memory.dmp

Download

memory/1684-322-0x000002D93C090000-0x000002D93C0F6000-memory.dmp

Download

memory/1684-391-0x00007FF6790A0000-0x00007FF679343000-memory.dmp

Download

memory/2308-451-0x00007FF68A220000-0x00007FF68A55F000-memory.dmp

Download

memory/2308-392-0x00007FF68A220000-0x00007FF68A55F000-memory.dmp

Download

memory/2308-393-0x0000014CCAE30000-0x0000014CCAE96000-memory.dmp

Download

memory/2308-394-0x0000014CCAE30000-0x0000014CCAE96000-memory.dmp

Download

memory/2628-48-0x000002488D2F0000-0x000002488D356000-memory.dmp

Download

memory/2628-46-0x00007FF7D40C0000-0x00007FF7D4228000-memory.dmp

Download

memory/2628-47-0x000002488D2F0000-0x000002488D356000-memory.dmp

Download

memory/2628-55-0x00007FF7D40C0000-0x00007FF7D4228000-memory.dmp

Download

memory/2628-53-0x000002488D2F0000-0x000002488D356000-memory.dmp

Download

memory/2892-302-0x000001DFC2360000-0x000001DFC23C6000-memory.dmp

Download

memory/2892-445-0x000001DFC2360000-0x000001DFC23C6000-memory.dmp

Download

memory/2892-303-0x00007FF6351A0000-0x00007FF6355B7000-memory.dmp

Download

memory/2892-446-0x00007FF6351A0000-0x00007FF6355B7000-memory.dmp

Download

memory/2892-377-0x00007FF6351A0000-0x00007FF6355B7000-memory.dmp

Download

memory/2892-304-0x000001DFC2360000-0x000001DFC23C6000-memory.dmp

Download

memory/2920-376-0x00007FF6A7400000-0x00007FF6A74AE000-memory.dmp

Download

memory/2920-293-0x00007FF6A7400000-0x00007FF6A74AE000-memory.dmp

Download

memory/2920-294-0x000001EA60260000-0x000001EA602C6000-memory.dmp

Download

memory/2920-295-0x000001EA60260000-0x000001EA602C6000-memory.dmp

Download

memory/3808-237-0x000001B803210000-0x000001B803276000-memory.dmp

Download

memory/3808-319-0x00007FF685000000-0x00007FF6850C9000-memory.dmp

Download

memory/3808-236-0x000001B803210000-0x000001B803276000-memory.dmp

Download

memory/3808-235-0x00007FF685000000-0x00007FF6850C9000-memory.dmp

Download

memory/3868-359-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3868-279-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3868-274-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3868-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4436-450-0x00007FF6DBD90000-0x00007FF6DBEBF000-memory.dmp

Download

memory/4436-382-0x00007FF6DBD90000-0x00007FF6DBEBF000-memory.dmp

Download

memory/4436-383-0x000002B450340000-0x000002B4503A6000-memory.dmp

Download

memory/4436-384-0x000002B450340000-0x000002B4503A6000-memory.dmp

Download

memory/4512-60-0x000001FC58150000-0x000001FC581B6000-memory.dmp

Download

memory/4512-58-0x000001FC57F20000-0x000001FC58028000-memory.dmp

Download

memory/4512-59-0x000001FC58150000-0x000001FC581B6000-memory.dmp

Download

memory/4724-285-0x00007FF742220000-0x00007FF742964000-memory.dmp

Download

memory/4724-287-0x0000021F98D80000-0x0000021F98DE6000-memory.dmp

Download

memory/4724-286-0x0000021F98D80000-0x0000021F98DE6000-memory.dmp

Download

memory/4724-369-0x00007FF742220000-0x00007FF742964000-memory.dmp

Download

memory/4788-30-0x000001F8B25A0000-0x000001F8B2606000-memory.dmp

Download

memory/4788-32-0x000001F8B25A0000-0x000001F8B2606000-memory.dmp

Download

memory/4788-31-0x000001F8B25A0000-0x000001F8B2606000-memory.dmp

Download

memory/4788-29-0x000001F8B23C0000-0x000001F8B24C8000-memory.dmp

Download

memory/5012-39-0x0000014EB00D0000-0x0000014EB0136000-memory.dmp

Download

memory/5012-40-0x0000014EB00D0000-0x0000014EB0136000-memory.dmp

Download

memory/5012-38-0x0000014EAEE70000-0x0000014EAEF78000-memory.dmp

Download

memory/5188-352-0x000001D3CF970000-0x000001D3CF9D6000-memory.dmp

Download

memory/5188-351-0x00007FF728F00000-0x00007FF72918B000-memory.dmp

Download

memory/5188-447-0x00007FF728F00000-0x00007FF72918B000-memory.dmp

Download

memory/5188-353-0x000001D3CF970000-0x000001D3CF9D6000-memory.dmp

Download

memory/5424-329-0x00007FF685000000-0x00007FF6850C9000-memory.dmp

Download

memory/5424-246-0x0000015BF4DB0000-0x0000015BF4E16000-memory.dmp

Download

memory/5424-244-0x00007FF685000000-0x00007FF6850C9000-memory.dmp

Download

memory/5424-245-0x0000015BF4DB0000-0x0000015BF4E16000-memory.dmp

Download

memory/5872-15-0x00007FF7DEDD0000-0x00007FF7DEEF3000-memory.dmp

Download

memory/5872-16-0x000001EBF37C0000-0x000001EBF3826000-memory.dmp

Download

memory/5872-17-0x000001EBF37C0000-0x000001EBF3826000-memory.dmp

Download

memory/5872-18-0x000001EBF37C0000-0x000001EBF3826000-memory.dmp

Download

memory/5872-65-0x00007FF7DEDD0000-0x00007FF7DEEF3000-memory.dmp

Download

memory/6112-371-0x000002392DB80000-0x000002392DBE6000-memory.dmp

Download

memory/6112-449-0x00007FF7C3160000-0x00007FF7C3667000-memory.dmp

Download

memory/6112-370-0x000002392DB80000-0x000002392DBE6000-memory.dmp

Download

memory/6112-372-0x00007FF7C3160000-0x00007FF7C3667000-memory.dmp

Download