26d2a84f1707a1c6469112b3269b8fc8cd48dacef4b33a135354c7fe88faba0c

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260712-n2ynvahs7n
SHA256 26d2a84f1707a1c6469112b3269b8fc8cd48dacef4b33a135354c7fe88faba0c
MD5 b2f098a2b20f486322d5b3e5b45d9710
SHA1 1d9970831a15f3008a9e5a359587cd7aaf016c08
SHA512 017facd5216cf911e42be555bea723bed00ac7838c8a8721005eba87e5d31f55b1bcbd24c45c76ab02bbb589d1bc784909da2e868083fea2254dbe62c790433b
SSDEEP 12288:gRwSfxL/2Dc3bDLLmt0LDQewsAjtHZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDuL:QmewsAjt4W5hXSHg/ehHeRqh9zS
TLSH
T1DC15E030FB74D436C37B1DB21B36C706646C79204FA62AC7E3B89D9E49702C26776A16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5616	alg.exe
1572	elevation_service.exe
3832	elevation_service.exe
1124	maintenanceservice.exe
4776	OSE.EXE
4612	GameInputSvc.exe
1708	GameInputSvc.exe
1352	msdtc.exe
5300	PerceptionSimulationService.exe
5180	perfhost.exe
1836	ReFsDedupSvc.exe
4616	locator.exe
4472	SensorDataService.exe
1276	snmptrap.exe
4804	ssh-agent.exe
1696	TieringEngineService.exe
1536	AgentService.exe
4304	vds.exe
5096	vssvc.exe
5204	wbengine.exe
2716	WmiApSrv.exe
796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c0d3966f209659e8.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1708	GameInputSvc.exe
1708	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3472	2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	5616	alg.exe
Token: SeDebugPrivilege	5616	alg.exe
Token: SeTakeOwnershipPrivilege	1572	elevation_service.exe
Token: SeTcbPrivilege	4612	GameInputSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	TieringEngineService.exe
Token: SeManageVolumePrivilege	1696	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1536	AgentService.exe
Token: SeBackupPrivilege	5096	vssvc.exe
Token: SeRestorePrivilege	5096	vssvc.exe
Token: SeAuditPrivilege	5096	vssvc.exe
Token: SeBackupPrivilege	5204	wbengine.exe
Token: SeRestorePrivilege	5204	wbengine.exe
Token: SeSecurityPrivilege	5204	wbengine.exe
Token: 33	796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	796	SearchIndexer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1708	4612	GameInputSvc.exe	95
PID 796 wrote to memory of 4264	796	SearchIndexer.exe	112
PID 796 wrote to memory of 832	796	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_b2f098a2b20f486322d5b3e5b45d9710_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1124

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3384

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5180

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4472

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4804

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4304

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4264
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe1183195b2c8429e620c8766701471db5858a12b3425512f5e66731fd4accee
MD5 78e4defcb8e45fb1cec9fb5b4abe2f79
SHA1 bce1671be6b873d99e64b56096e8915820ba1994
SHA512 a0a7d041501fd34a2274226d6e405a2cb0b0715b8806a03009bfc5e38ffb8af1377d38680f171047916813758c6e57d3d9e246864ff90501a9a7efef4a1a803a
SSDEEP 49152:0we632BuPkFKRrdE6oh7stBhuXjfS4LWxnp93F/el4q:53q6gjBJ5
TLSH
T1EDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 1d514851f368ce786e6e5f7e4d6040ce1ae938f34b71fd3450dc5241d94a0c84
MD5 f460355d06dd3fb054efbd288e56ca1d
SHA1 b06867eb25026b380c7cd7e0923c95277ece11fd
SHA512 c4f1178a641b78a9b8602be3530d7831419fc82da3c162d6a4558f4fae0683f1d4e4df1a0ff9c46e9851ea8876313f63e97eeed3808b25692ddb23f187c23947
SSDEEP 12288:T1XLsRre0x8VP5m2czApIZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNl8:JXY9XcczApxW5hXSHg/ehHeRqh9zS
TLSH
T12105022463E448F9ED67927DCDB28901E672785147A4E78F03F4992A0F332C96E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 53ab3d28ed5fd17412d3cddca0b8349955dd0b9daa559c8d6e5abb555f84afb9
MD5 fce8d01ff7e29470774027a4fd2d051c
SHA1 fdeb7068f3e2910665a7dfe2da8ab6cfea158807
SHA512 3735ed1facfa9031f2134b35d47d7c1428073bd1a02b9ab3f6da8e0de304f9a09394434dec314b2cda63a6fc0a92fe0cb68891f40dccc988c096e44ebe3eaf53
SSDEEP 24576:c0JeMpu0qfxOrMiXW5hXSHg/ehHeRqh9zS:cwpu0Yodm3F/el4q
TLSH
T1AF45AE55F6748735D073C0B9C5D2A68AE97130821B308ACB4296D77C2F67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 427e58608579954758400368520eca080df0d799facebbf6d66b6ec3d2a29800
MD5 9922dd71b12b24ce65670afbea7d3d39
SHA1 b2df381f481019c781cd408efa3c63570a254b35
SHA512 d372965eb29eaad2cc482f1ed9f8ca7999885cf5244023335498a99aa7130b8e4eee51f27c685369584c0344cd7d995245a0901f1d325641cd80dd60ed96d41c
SSDEEP 24576:qRrnezSC6vUyD/aqgrvW/6q8wyuJ1W5hXSHg/ehHeRqh9zS:anezSC6vUzPvuHjygE3F/el4q
TLSH
T195756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 030849601d06c9c769ceccafd1ca27926f8a8963c68a1ae251062d61f2ea6852
MD5 2ed4277eb867c1743a94afb43d6568de
SHA1 8599914888601d3465d964512afcf9be985fa969
SHA512 b3dd37d531f43ddccd0a9e9230493777eae4b4d43e4c9b2583123460f332311529b4cec4a65165820118adb8fdddfcf7cb4b1c5cd62be139f4ca63cdf297b225
SSDEEP 24576:gabDPYrluv/l+dAkW5hXSHg/ehHeRqh9zS:gaYrluXl++Z3F/el4q
TLSH
T1B4559D65F674C331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 05dfdc48b8b3aa5911103666e4e75387f9f68209ac96b6755f6b2ca7c6d7082e
MD5 2b16b9e08cddc3036df3c6c94d44e1ca
SHA1 42d9645e6f6879b1b7a776d116ec09ef4f394eef
SHA512 94569252e77b16986c003dc0a5b619ef747068787c1ef707eb80df0e306c627e80bcc77307fe2e77e8097bca55ecaf7e3bd715ef985b950dd4bbbac27f74faca
SSDEEP 12288:At3IZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:At3xW5hXSHg/ehHeRqh9zS
TLSH
T124D423C08794C825F350BEB24BF74E45E55868412DAE6ECF037EB85A4AB70C7F6851A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 31697becba38fe648cdb1e96789f74931ab1cc348a2e7e1eedf2247ab86e9b2b
MD5 f150780085f7c1d7efb5607fdd17d9df
SHA1 0ffc1a08b1c4022747d287705b5a99ba33c159b4
SHA512 166ac4e68db5dfc66d9956c760488f827b5ff756b0e0813f3e77bef3339a21d8f9a6d5c66849c7869c0e296674a6a41b49ba2a01d78fdf681ac3cf975151a724
SSDEEP 12288:XeBNUbTVO86UtuZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:XJIUtnW5hXSHg/ehHeRqh9zS
TLSH
T18315CF7BEE28ECD2C27A9DB95B918600E77274304F62A3CBD175820ECE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 283a19c8862ad53c67e8de89c781805456692d369f905aff63771c0bc4b5b007
MD5 f6e3a4b141a4341dd10ea06151fb76d5
SHA1 816e4dd13ef6392e508e258045f131c0588b639b
SHA512 1fe7497fd2c8e01acd03cb973da92d189ca0ca36927ac028635c3e7a9b7e8e62df0aa5133de16fee7f7754e1913b60430c62f66eb86d4e73ea21c224ff056a8c
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THJ:VQvGAdlCEL8c/9RNw5CA5
TLSH
T1B8367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 69fe8798183d724b3be69443688b843294298724fcc2886c1b0fd47e3f9af5e5
MD5 4e13f83463f39b872407b65f54dc7b2c
SHA1 1f058fb807f4db7c807a26383502926385d3b288
SHA512 0afadcb198e5a34b8d98fc71cf05fcc07bb735f19c6b3541dd06ebdac570300c0fb2c65ecf8a7f3ff215bc384ec4556143dff34d7e4682cb8907df0b3c66d66c
SSDEEP 12288:dowSfxL/2Dc3bDLLmt0LDQewsAjGZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu37:mmewsAj/W5hXSHg/ehHeRqh9zS
TLSH
T1F815E030FF74D436C37B1DB61B36C706646C79204FA61AC3E3A89D9E49702C26776A26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fb9efa04267e1f5fe784e659bf173f253dd8d496e5f61e674685c9af77137d58
MD5 b346305c55fa45e691a28f1c0725781a
SHA1 759c93750d566c6ca3f93c2123d84c47629e196c
SHA512 d49c885b731263114e8f65fd994cd58afd34b3f05db4d56f3142fe4e1978463f233f26dcdbcef7da8e96e2cad34e43794de1d8726bec53f37611cae190d46572
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHd:HUEtQevvqc2W1cpV2XF32
TLSH
T168474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6c43136606eefb1851a76e937c0ff672843458d51d448b552d4da0e1510381ad
MD5 e40f8a3d5d3a57e03d45bb56d8563913
SHA1 380fc1bccb74b308bbd0001910ae144a08ebdfd0
SHA512 023a467ba0596b57155d4abb9347750b807558662f42e173f70bb80ee9a0035e7f89bf4c3bfccbf904e8da0dda551340cad9ae810219eccb7a93fdd460c6eaa4
SSDEEP 49152:DlbRquA/m2yL5zMfFiV+XenmE3/zNN3F/el4q:hoq1Vjnm95
TLSH
T118D58E0976B8C1E4D1F6C77886A2C647F37178154B35ABEF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 69b685eee42147c045d78c61a22fc72a616b8f14be6d07f9248a58526422ad52
MD5 c4ab5c9d1649f6135c7f8a285664dd4e
SHA1 0a9614e93004fd506d28bcf6afcc4b25833b4641
SHA512 6adfc10555e97ebac1e2055a3adeed5d503033e507c31e2dcc356d0c462985c4ce581e702b8d2df068466eec459b07c6b83c0272afda7948f46c4b107c95266c
SSDEEP 24576:RAhGLv/FoiwtA5l7S53vW5hXSHg/ehHeRqh9zS:RAMjFoiq5u3F/el4q
TLSH
T15545AE80E7F945D4F5B3AAB899B68571EA76BCA65E31D20F1160D11F0E33E40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 8a6babcfb839b0fe8877e259a82e146c8f6efbf25e7a3c5ef4956c891157e2e5
MD5 abece026fa8434910dab1d46d3a9293c
SHA1 207c3667b9755f320f0991443468559ad14ec517
SHA512 cbbfcba32c6b3f5048869b36cedf3defc87c22bb4a8f3434d60d269f857654075290a2828541d80b5b7a71f3489e624c8f40e01671878195f0f69ed4012cc84d
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CvFZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6Ok:QwuuOWSeW5hXSHg/ehHeRqh9zS
TLSH
T12E05F18573E44CF9E56296398697C536F7F2B8022A25DB1F0360C65B5F33252BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 4f1096fba1d7877f23d0a812e7f19baa68d8abf27d3bcce2b88bb2d0a97234da
MD5 24e863994e74217adfacb1144d1f3628
SHA1 56a8483ef3793a155e9abc68b0009c269eaa1576
SHA512 c9f838bcb4244b064c45c69d5e48247410f2305349458b89b4efa2947148044307d2eadddbe865f808a3860a6fa6ddba7a2375800d71cbb8f3ced3aa9899b72f
SSDEEP 12288:BBs1IFuZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:7suFW5hXSHg/ehHeRqh9zS
TLSH
T149E4128423E494B9E2A2A679CEF24E05E77074522B7A57CF0329455A0F736C3BE39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 288a47109eea6aa17c6b74fc09c79ae4228270c26ed633ab4750163f8131feba
MD5 bdc88e5215e97795eaad33b1752e1f08
SHA1 1d0d081432584fd6c22595e534ca641c9765121c
SHA512 8d63f022b39fd75ae63a191397aa8015d974f69204c7e8ad1e6a3c6e716f67b41235151c6ff631830e2281b6c1a0796ab1f24fcfad97b5fc7d234115c9ba290e
SSDEEP 49152:0oVdZ0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UF:pQRQyi36YOcP8Lvw2gAf+PN3b5
TLSH
T1E6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a5105fdd9b2f265d65e8aebcabf210d7a87dfed4e6b844d8ce0765a7a5b2e5a8
MD5 8965616ab0bb1c6fa763aa84debbf308
SHA1 0c02b9e52143cebfd27e10fba6c764dec0271605
SHA512 055fe09266fe1da2810e88cf53fb525316bff27019620f0beb65d736ab55819a89dd4628bae1c897e20c6d3602e68be1848d712f00d386d152262c68e6fbb43f
SSDEEP 49152:0oVdZ0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UT:pQRQyi36YOcP8Lvw2gAf+PN3x5
TLSH
T10F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3d517d19677f3ffe886678e0bd479504b83b7718ce30d4ace83e68d6eef7facc
MD5 cc98e863e975377ee31d360addd87b97
SHA1 b5984c062e872096568eee74d784506ea60c3de0
SHA512 c28f1a13600f9df83a5a554725f4a5d08552f7777830c42d74e710998451b95bac2d2a07a07ae2660852cd921919ff008198861daf5fc0ebaa03c1c3a519649f
SSDEEP 24576:7wv2Xf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0tW5hXSHg/ehHeRZ:X68Qg55nhMeWu7PNU3/f3F/el4q
TLSH
T1E4B55A33B2F200A9C44DE1769F4A872196D17C758FE1E7DB8115720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6c6a9c73f6c91703447c21aee3850d0dbc841cce1cf74efdd8be5abcf2144e8
MD5 2281f09410bff16a5e382a97e7d2b506
SHA1 d557ab27146dbb28e14323e7f552dcfa8dd1199d
SHA512 b2c43d64464099c992695e51bf12aeee16dd40854e9f468c1a6452d1bd6ac8ddf04804a163e8abe0a645b2fcba09ae5fa0b7f0b570de8591da3132679121b833
SSDEEP 49152:k3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99e:xy5112gYy5azzVv569nLKnhZZ5
TLSH
T1CC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f961c720b5bb3517b5ac29b7968c7eaeb25a8fe12541bb28b25f388206889c70
MD5 38c8abce69bc634e277dc6bcf040d66a
SHA1 32fde2a614242a4cca89fdc8eab9627c2ef9e076
SHA512 cc79c9470a4d857d434af49634e48ddbb0257073cd0629fabbbb43f2b85e4fa249ee28715e8681c5018b90eaad4f767a6cfc9739c7c6d6a211b6262d0d821798
SSDEEP 49152:kr+taZ3usBWOBr4tEGp0bqx0z+n217aau1glJL3F/el4q:Mu6JmTxd2de5
TLSH
T17FD59D13F1DA01E8D06AD478974A9233FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 07f28e7902d5b29037ef3fd5d83bebe18407adb9995863883754621fa7f9e7af
MD5 ee1ec64812f5dd69524921d4b4a3266c
SHA1 526eb6b854f6c0507bc0407b6ffb99a8a370a8df
SHA512 8efaa800bd9bb6fa3fd8932958addae08c0b02f969e2c34586cee600b615e1940dbe942e857d6a5a183366931f8b0e6f4329909cf6a036d2b1016eb2f3357292
SSDEEP 49152:U1hpsNoJpF1A6UU44CwH7R4xz3F/el4q:UmifPbRf5
TLSH
T1ECB5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 68d24437737c3dcb3cce5d4d87fa14713a07cc007c495334e369dee430c2e6ba
MD5 eb7589fdadb981cb67dfd7145cf76c89
SHA1 451a4072536182f4e6a6eda2e4e3177a05cea05c
SHA512 e68f4906f6df3c21a63d8ccfa82bb8437f71f712e7dc28b55a028de4962678a407fa941a227ea1c9e9b70e8d66c92b2454195a4b7ed49f00c5734256855c71e5
SSDEEP 49152:YSuZQIY0Be2K6RVtOnks6NMHqN3F/el4q:C5dKoi61G5
TLSH
T1A2C5BF03F2E940E8E0BEE67487669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 64e5f65563364a371ae8ac34d58306fedd2868c8bf34e584b8cb24a379c0ad6c
MD5 f19331b89d12370202a97d356f32f306
SHA1 ba8f942e26df611193ce230ae1678ffbbebacef9
SHA512 ace7dbecc64a8d238c91ae607e814e8ea0f1364da76a70402f114fc6bcf663e6078e5eb91c09a06506be8f46565da47defb90728f2a95907b5d54da1bac5fe5b
SSDEEP 49152:UUKSn8EApI0figTgiDn0AP5wy3F/el4q:9X2iypha5
TLSH
T186A5BF13F2D940E8D05DD174C7568632E962BC060B39BAEF0A90B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 603KB
SHA256 7713587c6ae42ad4aa77cfd2a4876072285cc3178af6bd7c6fc2afc5323489f5
MD5 3c72ebe224a33c8ec0b96bb238380fe5
SHA1 5ce2c60e2160a86fe04fd82c6875c83f137a9cb8
SHA512 3d0e8fecb03babc496a6b7309ec802f0ec8f35ee074be89210f2094291ac784f5192f3132fd23417c81482e53df272a342bf30ea0ecdbe5ff42cd36f74852861
SSDEEP 12288:+1Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:+uW5hXSHg/ehHeRqh9zS
TLSH
T15CD423C09795C826E200BEF28BE74F49F55C74463DAE29CF136EA41A4FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 603KB
SHA256 819cdda61dd88da581ff6d434d033954d5695c770327bb000c90c449ecb00bb8
MD5 0a60750ced4c636d58a622aa74ff7482
SHA1 5b81aee50f940c6403165254349dc925015547b8
SHA512 c5315c07b211e1cfa3b1eb18cbd042776a315766b83339280db49cdbae208f12aa09e2686d978d476b3a5dfd7150cc3a5365400e0b178e9f95b22e5d03c5a36d
SSDEEP 12288:cYZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:chW5hXSHg/ehHeRqh9zS
TLSH
T187D423C09795C826E200FEF24BE74F89E55C74463DAE29CF136EA41A4FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 603KB
SHA256 54a762866c2b9e3213022afe6ec868ac07190dcc8e59f45b55d1d57636f93b46
MD5 141087736426f0439656c9e31ff6511f
SHA1 7fb9701510a9562e7a7fcbd5705889582a9041e9
SHA512 a2ff07bcaab658691588b650455533ec2c5afdc81a1048c5f0278566a6c1f8391e5de58170aca7588e2ae1b265efb3e5bb8a16ed81b4e938586cfdec1fa6a30f
SSDEEP 12288:e3Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:eIW5hXSHg/ehHeRqh9zS
TLSH
T116D423C09795C826E240BEF28BA74F49E55C74463DAF29CF136EA41A0FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 77b2e924babcec79b0a6be5e644dd104dff010b9db18c1d680e4cbfd28e0cc04
MD5 37c1a12b78201d855d4f05ab6c7e5cd2
SHA1 794421d9e52af4c0b1c37f6286dfc08536860515
SHA512 ea740949776d3a59392b65fc39151f094505212ce6df33ab57aad91c3c7385924efaccd09b4ceea5084484a772fb889957a9da63a9afd55766e286eb340acc3c
SSDEEP 12288:IlqZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:gW5hXSHg/ehHeRqh9zS
TLSH
T1CCD423C057A5C495E151FEF5CAB34E45F2B878417E7B6BCF0329580A0FB3287BA44AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 603KB
SHA256 d1978205bb89286ec9e2d982fc867b485a5cc9919bdfe58f1153e81a957c5a0f
MD5 a898f23706db1919c79e6de715954668
SHA1 3152bbe7ace7c3a7e080e0533b09cd25718de896
SHA512 467ce7cda3aab990f3a5c86c37a01289b59d64d08e495fa78f8ff8a7b724aa4630232f0371c7293b81af3d50e310d174033fc789d46d497deb0a87694e377f97
SSDEEP 12288:FzZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:FEW5hXSHg/ehHeRqh9zS
TLSH
T1ACD423C09795C826E200BEF28BA34F49F55C74463DAF69CF136EA41A4FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 603KB
SHA256 c468676b474dc47b9d7e357005761347bb336942a17958cdb4aea3fe1a702942
MD5 fec39c524a4f296cead2c1fdd43d73ea
SHA1 0ddf7d315ad3004c08552a745e998e7fd0c9a0b0
SHA512 8ed29b12df01ea4082d85008e35ce75f8fdac7a4083ec0e0705f70b825d579f961f115bac8be54478ccef727d227177197d01eecda413448e053da0dd68f3aa8
SSDEEP 12288:GfZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:GwW5hXSHg/ehHeRqh9zS
TLSH
T10CD423C09795C816E210BEF28BE74F89F55C74463DAE29CF136EA40A4FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 0208e1d5d28f5552b7d38e368a338b45dbf9a45cafa98b97d4f20bc0afa824d9
MD5 43bc5c9d743824d7deb580fbc770e6f5
SHA1 e1398f27d643b07b79b60ce63150b0074c3be446
SHA512 77d4a0446c2feda67175e8717cd0e97bac2182b11d81cb4ef718557fc1c6287542192771087306c83455db4826f800965be31ca58ad128c8ac50c607faad532e
SSDEEP 12288:AgZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:AJW5hXSHg/ehHeRqh9zS
TLSH
T107D423C09795CC16E210BEF28BE34F49E55C74463DAE29CF136EA40A4FB31C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 c07db8c6d6814453839c058b87408cbf8f5d27cec3a1287d3cb26ce00f1985aa
MD5 d9af38b4a6e2966e852b1e10cac5fc8f
SHA1 28309a625c3b1e55c887a29c279e6748647fe342
SHA512 0616b5f74b58928746aaf2d2baf40def091dbad4a355a24c11f72ea32ecf09eef138d9102a4ac49701c73c885576d0dfb63451347cf56e93a759d68df1e372a5
SSDEEP 12288:uiZwbH9zF69SCcPvyyZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSR:RZMdzFeSSrW5hXSHg/ehHeRqh9zS
TLSH
T18C150294B3904CF4EC63957EC9668D06D6B17C561A74CA0F03B8352B1F733922D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 b695c6d675ba7cba2ef2fccc87074a225cdbbf7ab09ba05daea2d4c5740b4a27
MD5 893100b9c8328e812e952669d2449cf5
SHA1 832de03f95461357acb9d802d02a7345483282a8
SHA512 ba825e75f43bf6b528ebef9b01d94e39b1fa35e74b2cca23cb14d16baad50abf5b2612a961661de650cf5c072baa0e2fd85f4de08586bdb34e9db48f42c2fc89
SSDEEP 12288:USZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:ULW5hXSHg/ehHeRqh9zS
TLSH
T11CD423C09795C826F210BEF54BA74F89E55C74463DAF29CF136EA41A0FB30C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 44e1371af2df4379b1e39a6df085b4e336e0fa9322d0e8e87ede98832c1e6d30
MD5 ebcaad9469f4f7a759757a2b2e6be600
SHA1 0f66574add2e84f0a914060f607d269bd6e98c53
SHA512 014dd598a7e617ad4c9b2212da29c95a8e9f31a8b889d929756b39f45f818a4aea83af044333531849c6d56b770f021ec8e099aa6070dc9734cd3c03a70117dd
SSDEEP 12288:uHZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:u4W5hXSHg/ehHeRqh9zS
TLSH
T16CD423C09795CC26E200BEF64BE38F49E55C74463DAE6ACF136E941A4FB30C7B6454A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 7a6da241e7f1909ee74deb2b772dc99329b11fe2b9ccd6a224f9afec9bcbeed3
MD5 720c32f19a5eeee61cbae8aa5c6cda3d
SHA1 f1173a1b15cebaf7661fb224b9171a6ec5109760
SHA512 65a85e76ca5974268a668ec3c957997facc126ff7dc78af5f7c7cf9580c9cdff36763c9c1b4a9bdbbfe016cc9a4defbec43719aaaaaae61409901c0d2e26dfe2
SSDEEP 12288:QePz5L85fDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMV:VzyXleeW81DWaZchhRrK8jVtXnQVEtzy
TLSH
T179F412437A6131FDE4638239DD911A52F7B270354B24AA6F536483B22E323A1DE3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 f15af48d8653d40c13b6eb95ccd39681cf36fb483b4091f872d9078f7bc1b6e5
MD5 d7ffd1a45d3667c4ba7b9667e94121ad
SHA1 d18002ddae0b6625eab866e5e2ce9ea95c02c52b
SHA512 b2f2d18ab770cbefe613ac2d33b3864c11aadbedd26f88b7636057c5b467b066a320b1e455f779e1fb7be70e8edaf6a6de4021c26220d5d43829316a4ed9658a
SSDEEP 12288:CZfDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:C3leeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T121D423C19C434BEEF8528B3B7EC91BD59A91520DEE4A345DB25CC28079307A3EE1B587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 c0e2f8150439f7c196966e15ef8864dedc6759b0b6c571db6ddb191881fbb30c
MD5 1f732508bda342be6ae89bc17ea7926b
SHA1 040f5466c5adb1c9e49b43978ad9a93eaa782cdf
SHA512 c79b691819f2277b86796494ca72ad97e26302666fcb8956befa8406133bc6353a24b2c0d90fcde8f4d21f79cd67bba86aedfad777b0be3d03d581208b1cd37b
SSDEEP 12288:u6fDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:uWleeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T1F3D423C19C434BEEF8528B3B7EC91BD59A91520DEE4A345DA25CC28079307A3EE1B5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 527d0c85b9a7344d39c1183eb6546676deb3d4bf28c0c6a805c21aa5f28acb52
MD5 f01cd821ff89c175e17dfde9add62d75
SHA1 472038631262134414078891a5d46b0da98756cb
SHA512 78a6f08b4c1682dc6c96024edc64efc65dba39587ccd797153e0c4a4adcc19d2a2431c36943634bb7bbef1a8604685ae640151ecee1ca0a04b2c0b1cf12a244d
SSDEEP 12288:RePz5L8UfDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMV:4zy4leeW81DWaZchhRrK8jVtXnQVEtzy
TLSH
T19FF412437A6131FDE4638239DD911A51F7B274364B24AA6F136483B22F323A1DE3BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 839010c2ec64d8ea406799a9ea438470d8cb47605c35e9266a4a403255e4bf44
MD5 4260db4953cbc2e89b11702ed8d7efb6
SHA1 25c91060599c85e7047559d1511b5bf952af347f
SHA512 b5729aa506a8175b628e9fc613d286eb16aaa591e3c60ea1a6d66f85ef967b1dab7ae1e4c88ffde53a8c0d5a7f33555886398f0ec702ffcddf884a9801640cb4
SSDEEP 24576:KTBaLl3z0z+KVleeW81DWaZchhRrK8jVtXnQVEtziW8:KTcLljKVZyhfVtget2h
TLSH
T1E3150190B7501CF8ECA3823ECD554A56D6F27C0A4B60D61F13A873625F333A15D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 e6a91ad2d8d73bb6e086aae6dd44d0025bf7337e471dae12ddcf47b8f312038a
MD5 d9ac48918ad3e80bfd5a61f47e062486
SHA1 b5eeace27c6bb389b532094f6cc19c54db3a105a
SHA512 3252680bb9d4e8cccb8724a165b632a4c9cedf380f87416c134c721ff707bef9b1f25f843df13a4cc847d097fde44e1a21c92b33a65567e226b7987dc6c301b5
SSDEEP 24576:w32drC1hy7jZBleeW81DWaZchhRrK8jVtXnQVEtziW8:62drC1hy3zZyhfVtget2h
TLSH
T1D435DF90F7E410E8F0B38A358D764511DAB67C5A5B21DE8F03A8665A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 35b0c6de7347e66148dd21a4bd79843d025627e88b0cdf236343e9883e85af9d
MD5 ba98441a6725016d3362679796ed9082
SHA1 d9113a7163586da29bf5595488583a956728c5fd
SHA512 cef2ca22ccf4e0e773a7943f7ec06cb88fbf18106294abafb486d64e524a6f22040df423ef84b2d5c0e130da6e4d4a6368182d356731b8564df9adf754f9cbd5
SSDEEP 12288:ISfDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:IuleeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T105D423C19C434BEEF8829B3B7E951BE5A692620DEE4A345D725CC2803930763EE175C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 1118d439285ec6b97882c3f3de4441ebd2c27ddeab71350c000da58375c40953
MD5 126ad9265d5d81c211c823fb9af2f7cd
SHA1 9335780085f0b9352a30668cc1abd6111887e51d
SHA512 34e606b579ec4f838a53735272851be2b8699bc45edcc0b82bb7ca9dc832ef330408a6140496015285d22551208390300fd2abbffe66c532ea5049d8acf474e5
SSDEEP 12288:qBfDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:qfleeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T1B1D423C19D424BEEF8528B3B7ED81BD5AA92630DEE4A345D735CC2802930763EE17587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 d32864437cff41e9160df788773b8132d2986faed0fa3b381c67c82cac65237b
MD5 b59ac00d26d1e35086f5bcc5dd960c0d
SHA1 4d0500f07013c4eb033b79eea6f350f683e04225
SHA512 475ca317b3f9a6fce9b4ddbce352610cd9b85e3e67f7e78d93f4fe3c77c3cc4ca125e264c122e75641cfa72e5558784bf1f0ae411100a91df606ba42787097ba
SSDEEP 12288:jffDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:j1leeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T1DCD423C19C434BAEF8429B3B7ED91BE59A91530DEE4A345D725CC28039307A3EE17587
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 beb51cc8c3d3a7bc18e470c5836a10ff99e6426433ecb6b5d2ff0d5f667c1d93
MD5 596f13bb2b5e8321916dbdf68ae247a0
SHA1 092d575dbd2fbfc3d9069b09ddae41e77aadace0
SHA512 a49ab28621658d9467e3c9b02a3f1790fe069a9c0fd5abc7b584a4c76cce184bd9d4e5b3c381b363559a5ba97890ffa29c6b5a0d0a32af986c8d69cb4bba6d2f
SSDEEP 12288:kHfDxleneQ1PEeKbHW3qXJSq10e2F73xmop6ZuK8PbufQtVpnQcpyGlrMFytzihT:kdleeW81DWaZchhRrK8jVtXnQVEtziW8
TLSH
T1E7D423C19C434BEEF8424B3B7E991BD59A92620DEE46345DA25CC28079307A3EE1B5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 7376e931070cbc6a211d29481d6bcd72f7ebd6ffb5d5e282c03e608b2703d603
MD5 af6d30395e4610563b802091c70172cb
SHA1 4fa643d54684ba59727e03b6e192d80dd9b42b77
SHA512 09fbcaf6261d94ab8467c1c66585dda8960eaa406a8adf0fb69a71b6505b5b71d88955fa2be68ef03e8027ef842b06e8b5fc56ad5ca2c26fb998b3037bcd6333
SSDEEP 12288:C4PfBZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:p6W5hXSHg/ehHeRqh9zS
TLSH
T1D3F40144D29481E8D06EA675CB964A41F3377C215AE6E3CF13D0F43E0F76282AEDA653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 38d1d38a5240b9c29386e8966b01d2d0b917037fad6a68a4436bb818cd5c2bd9
MD5 c291a0e6838661881ce3d942d3b47d2b
SHA1 b2e42cf46ec6bdf97e32fa3cf15c9e6242c6eef7
SHA512 0f761cccfee1bc127437f5c7707980e648c3eddc90ae5b939e8cb2800fb211a399ec3a5f1091e404efce385c1605868802e4957bbe78d00d22f036a58dabfa34
SSDEEP 12288:Rg70Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:6dW5hXSHg/ehHeRqh9zS
TLSH
T113D423C08399CC16F270BEF14AAB8E14B51C74512FADA9CF232EA44A0A735C7FE5556C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ed461ba1c1992fc7818df1f12748a574d2db34c572cbd8727eb1ca853f4a9e99
MD5 2d7049fd0c0accf2c8d8f9931fb839c3
SHA1 cf180f21d9d9d6fe67a44604e58badc8913f5b54
SHA512 2ce33cbdbffb4531d5e0e498f47d03538084ec2abc333e8f120e084c47d3a9a45bb4635b2fa73a16e1436b3f5cd51f7e7954f630f628fa882ea40989c975ecfb
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bYEW5hXSHg/ehHeRqh9zS:ygb4mBIBhGFQ3F/el4q
TLSH
T1CA65AE1E22EC02F5E1F5E2B8CDAA4417D6B278161732D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 d653b5d039c4fec69ef201ca36a63b48461f3d668d950d6257b8c5bdbea7012a
MD5 d73ce6e0568bcb2ab1d0fcb0070b6bb1
SHA1 6ddef71da8a3ef9f257c85ea7984a2bf035a53b9
SHA512 8a4fe46fa4440a343cd6fe1408f69537ef4267adfc6f566b30904abbee7c18c6bc3ee9e54a9cd6c8cdd85468832021612106e059a9a515594cc5bfac645683f4
SSDEEP 12288:XBGvZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:xGgW5hXSHg/ehHeRqh9zS
TLSH
T1ADE4239462E5D464D131FBB549B38E56B4B430502F292AEF02E9E43A8F725C3B739C58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 1b394b7ef80f15cfa53c674af5148c5deb2215049dbaa062436396217103113b
MD5 98f7a8cad8149790c75075b3d191f0ca
SHA1 a637df3e54d12e361394c8c383d432378b11e706
SHA512 6006ecca06b3a7e32d3f23b4419df4bbbfa6441ef052607d6f042bd5976e8a60d6d3df899516aaef869642ff1151c3292a06d3c7bcb311e6f257736853a6f10b
SSDEEP 12288:T2Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:TPW5hXSHg/ehHeRqh9zS
TLSH
T1D4D423C09395CC16E250BEF547A38F05B54C74112FAE2ECF136EA41A0BB71C7BA795A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f9e7a47db3d52f9eb3fcdf8ac4c573bd55d7016e247ab6a2cefc2299d8388af2
MD5 1e14a213eb52f304749eb195ae27f5b4
SHA1 4add5e491d1533fd215b99381065127617a3e640
SHA512 c480723631cb7948b60ccb309dfe80641fa3ff21dc136f1f19d31c90b0988cd90b431bfac997c7742338b99720215929f7c9a594b661e580995b2f9a17a42302
SSDEEP 24576:dOK8E8FpJqH1wQria7/mEKW5hXSHg/ehHeRqh9zS:Q5LFPqVoa7/lv3F/el4q
TLSH
T1DA35F161A7E101F1D077E1388A834A63F6B1B4251364EFDF07AC8A551F23AD65B7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 c2a3945fccf1272e637593bd931bd1d5e6bb63f226e01db6cb82c6ba5724697f
MD5 2b636125d10c1d2c7b0e8ea333ce7e08
SHA1 275e5b3ffa85e69f1da22294db4ccb1e868789a6
SHA512 e9600bbc5a6fd329b09e8af5b8e68e4d7a688711703adaa146c3a7e26571dc30ada04a0d65082006b31845c556acc76c9ecd45c79e165ac0fe904f36a95ad5fa
SSDEEP 12288:gHvUrBFrEjwaQuZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zs4:gPUr+NQnW5hXSHg/ehHeRqh9zS
TLSH
T1C805F15E22E81CE5E676F17D8A828709F771B4621712A2CF02E1817E4F639D9BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 4f3a47ee5a77f43686dea36b4a58db969d5a913d18d9bf65897c750e125f0d2a
MD5 854828e491e874611a34f80678c14514
SHA1 4d7c7114860124fab958be2821baad4a9dd5e263
SHA512 587f2464d225a70696386c0073596bd74b5a4a656276f0d88cfe9a88592c3870a787e4181ac22891a0b7e45ecb484c0c2ed55430d083b82ff144afeda4d98992
SSDEEP 49152:WBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjW3F/el4q:5G05lO43bG5
TLSH
T18FD5C06A62EC01F9D1BBD17CCAC64A0BEBB23415033556CF02A486A91F27FF5A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 9ea2e8b52085105f1e416a3c7cdc375d9073e9b58e4974fc937970db240e98f6
MD5 16fd690700ce74c324e01ddc025e1274
SHA1 585c61c5be34608049c086b5912e04dcd45dbbc2
SHA512 f345130e15eb30e7f1623c1946e9a777b9be75ff93e67698b7b1de088a40fb4e19770a3c59f12e3b16005f8db93af890b3385647f2bb19dc6ca15b6b173dae7d
SSDEEP 24576:hla5POZ3dpbWVM50JicR2hG0lasx2+47eidnMW5hXSHg/ehHeRqh9zS:La5POZ3wJt2pasx2+mX3F/el4q
TLSH
T18A65AF5DA6F801D5E175D17DC5838A1AF5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dc248c5c7b6c3bacd718ef62399ab916a3ca2ccfa9faaa65278e7533beb30e87
MD5 332df34f18e61b57e2dba3c745e6b284
SHA1 8225f3ed638b805c9ee8ac57597ddf0b4d155edd
SHA512 729e002e07f1d6590975e68d18b300b62d451f3d3a175e7b5d6c29abbe3e0554b8914e93152d49df80a7a86b8d7cca5cae86e93403a02e4571cdefcb6e07ae60
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkuW5hXSHg/ehHeRqh9zS:INc/zEOVHFC3F/el4q
TLSH
T1D5858C1623E901E4F1BBE1BE89779946FA71786517348ACF0291811F1E73BE46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 8ca2f0b6fbb5d6f25a891c2962e1796cb04d3c2b027f5ab056266158deec4eaa
MD5 aec17450a7180606d14c68b1a1237887
SHA1 54e36be9f13b8148d9d556d3c6909c1f741660b1
SHA512 99adaea8bcd884df9b6967bcab5455738686e33b8ff0e86f5779c02293f0ff2e65ba05f8c8155a2b3b96c767e71d541989abc3f0d2b1402317ba0aa6aa02650f
SSDEEP 12288:2QHPJnJP6szeCs6Rl28dFZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNl8:BJnJPbzB4SeW5hXSHg/ehHeRqh9zS
TLSH
T12315E07CD2A810E8E4B3D2B4815A1B5AFF31346D2F2669CB15B4D4353F12ED0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 548c0f3dcf4224dd61a66a2385e89821338100c8765e9b0eea83d90f32a7912d
MD5 8a98e3d14bc489447f55e1c900322289
SHA1 09e86dbc3234c5889cde21d2904e1c16ce76e4f9
SHA512 24949985876fdcc58d30b51ebdfa7b450a4a0f7fdf2980d9e056ffaa5158d68974cfa21fb5e6d1e69f2fbfbb1482d2faf4c3d1e1dc248235b871544b7b0efa78
SSDEEP 24576:hCLHGL0MoeVtFumTijCmlKQWDkUW5hXSHg/ehHeRqh9zS:hCLHGeeV5ijCmlDWDkp3F/el4q
TLSH
T154A56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 08a0f57ab6eca85eb2f4f5232299e54e1e9d81766bf09f9eb8d73936cdc175e2
MD5 ba4c7e7ba860f3c4d4e5c672174710c6
SHA1 552420d9d7134166e3628ab81157e816b1189a1b
SHA512 ce42bd3ac16121fc045c96b5ed0e48b4fa36a75ad23946daf96ca7e712151bed626598685b4f778513ba94b6986a699dac4d8bd8bb3ccb5f866389f46848e586
SSDEEP 12288:XxHEk/j5ZI73Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:b/DIcW5hXSHg/ehHeRqh9zS
TLSH
T1D905025C637A40B5D167E07E86930501E2B1B0719B666ADF07A8C47E4FB3EC9B93CE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 87ceeec94fa188339cfada606143b69cb46b191f38368ecd8564eaacf2c75ea2
MD5 468bf929bfb9ae054176865e678d9273
SHA1 d183c789668aad62c6e794faef845c46b5afa215
SHA512 59d9f65261b85eb75ff58db2d92c0bcce000aef02873242fcfc3b7b9865cb41ccc0bf3aec8714a361c15e3db546d6e69775e66f2ed122bf1edf1c424295e219d
SSDEEP 12288:NG6kyCZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0tybW5hXSHg/ehHeRqh9zS
TLSH
T148F412405394D495F2716AB88BB38694EA38BC206F2667DF12A1E53E1F337C6BD30B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 49b99ecd3c5b3188c9cdca15900324f9f671aea1c84321824b81a4e0455732e5
MD5 f7088e2500757059497374bb93b58a58
SHA1 0c9740388bb8000691f6c394a6b957c401296e33
SHA512 1f5d0adabd2c186a2f29d861e77be862e5535ed72a8e18110d867a3e11d873dd0ea75cabc13b3460619c5d2f9abf2570f8fd37c9dda2ba196a4b36692abbb8e5
SSDEEP 12288:duXZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:0oW5hXSHg/ehHeRqh9zS
TLSH
T1F4D423C083A5C829E110FEF546A74F45E15870612FAF29DF13A9E83A4FB31C3BA75958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 54cd5fd4ecb7d77b65837039c72ee90258f7c88ae0ed2a7f43cf2261e7c9faa2
MD5 95cb2ab6738ad20ab6078f991a72b676
SHA1 6ec2802aa9a60bc9032521a318aaad9da2c47797
SHA512 de6f15454cdb6f6878aeccbe55cb0a58e35d502cfe4f2bf9548b6e919ae04a0595f18cfeb27651f5787a3544da35f443110a88c33a88e1b465088f64aef9f45e
SSDEEP 12288:nlgl/ZyFDK3tT5Tr7aVLIH9lH3ciZe0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu37:nlglsoTfaidZwW5hXSHg/ehHeRqh9zS
TLSH
T10A558C1D63EA09CAE2B2D675D9721493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 fc03c3a7c56c75d1fff0cf5be24eb8ba65480dd02545e256b00e5cb3acaea85c
MD5 abe97e60e127936b30d384320660312a
SHA1 af794e015364eccbea73af3801220a8d72fec375
SHA512 2d62fb8967741f368632f7731b963c8fba081824d3b678a337b5bc68033ffa8c4233653e8f596ee7ed14b2fa70ebd51e09e98377a8936d1439231293ac0acb95
SSDEEP 12288:RpJcm8CN3Ze0IvIZPXhonJ85VSc8OdSlgVIMIhkgsDu3iZ6ODNlnRSh9zsTzo:RrcmRIW5hXSHg/ehHeRqh9zS
TLSH
T18405F14EB3AE40A5E1B3D27C89824605F6B37030276267CF02A5C77E4E675DA7E38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 95e99ea453aad83028cb0fd9e663612e0e44d5418b5d6c4d20f28294fc04332d
MD5 43bf5f9bb531ba4b99d7dc1b84d56dc9
SHA1 03dfca8d706619ead9f0d5a17b803fb93f7025c9
SHA512 ed39e6b086cc38d54c9a518a721e5c73ec7eab2af380738e35037043b2ebaadd2a2e3f54f758e0abca96aaae0cc3a7d2cd0895ef6677b72a9c03cdef05a13bed
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3m3F/el4q:93Upow8sBy5
TLSH
T122A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-452-0x00007FF7B5E20000-0x00007FF7B615F000-memory.dmp

Download

memory/796-394-0x0000021699760000-0x00000216997C6000-memory.dmp

Download

memory/796-395-0x0000021699760000-0x00000216997C6000-memory.dmp

Download

memory/796-393-0x00007FF7B5E20000-0x00007FF7B615F000-memory.dmp

Download

memory/1124-47-0x0000029337EE0000-0x0000029337F46000-memory.dmp

Download

memory/1124-48-0x0000029337EE0000-0x0000029337F46000-memory.dmp

Download

memory/1124-53-0x0000029337EE0000-0x0000029337F46000-memory.dmp

Download

memory/1124-46-0x00007FF7C0C60000-0x00007FF7C0DC8000-memory.dmp

Download

memory/1124-55-0x00007FF7C0C60000-0x00007FF7C0DC8000-memory.dmp

Download

memory/1276-312-0x00007FF688DD0000-0x00007FF688E84000-memory.dmp

Download

memory/1276-314-0x0000024FF6140000-0x0000024FF61A6000-memory.dmp

Download

memory/1276-313-0x0000024FF6140000-0x0000024FF61A6000-memory.dmp

Download

memory/1276-389-0x00007FF688DD0000-0x00007FF688E84000-memory.dmp

Download

memory/1352-255-0x000002ED05710000-0x000002ED05776000-memory.dmp

Download

memory/1352-254-0x000002ED05710000-0x000002ED05776000-memory.dmp

Download

memory/1352-340-0x00007FF678D40000-0x00007FF678E5A000-memory.dmp

Download

memory/1352-253-0x00007FF678D40000-0x00007FF678E5A000-memory.dmp

Download

memory/1536-350-0x00007FF706870000-0x00007FF706B91000-memory.dmp

Download

memory/1536-342-0x000001B4B51F0000-0x000001B4B5256000-memory.dmp

Download

memory/1536-341-0x000001B4B51F0000-0x000001B4B5256000-memory.dmp

Download

memory/1536-346-0x00007FF706870000-0x00007FF706B91000-memory.dmp

Download

memory/1536-347-0x000001B4B51F0000-0x000001B4B5256000-memory.dmp

Download

memory/1572-30-0x000001EBE6C50000-0x000001EBE6CB6000-memory.dmp

Download

memory/1572-31-0x000001EBE6C50000-0x000001EBE6CB6000-memory.dmp

Download

memory/1572-28-0x000001EBE6CD0000-0x000001EBE6E18000-memory.dmp

Download

memory/1572-29-0x000001EBE6C50000-0x000001EBE6CB6000-memory.dmp

Download

memory/1696-333-0x000001D1AA010000-0x000001D1AA076000-memory.dmp

Download

memory/1696-444-0x00007FF6376E0000-0x00007FF637875000-memory.dmp

Download

memory/1696-335-0x000001D1AA010000-0x000001D1AA076000-memory.dmp

Download

memory/1696-332-0x00007FF6376E0000-0x00007FF637875000-memory.dmp

Download

memory/1708-331-0x00007FF626E20000-0x00007FF626EE9000-memory.dmp

Download

memory/1708-247-0x0000026D52080000-0x0000026D520E6000-memory.dmp

Download

memory/1708-245-0x00007FF626E20000-0x00007FF626EE9000-memory.dmp

Download

memory/1708-246-0x0000026D52080000-0x0000026D520E6000-memory.dmp

Download

memory/1836-376-0x00007FF76A980000-0x00007FF76B0C4000-memory.dmp

Download

memory/1836-287-0x0000024C7B5A0000-0x0000024C7B606000-memory.dmp

Download

memory/1836-286-0x00007FF76A980000-0x00007FF76B0C4000-memory.dmp

Download

memory/1836-288-0x0000024C7B5A0000-0x0000024C7B606000-memory.dmp

Download

memory/2716-451-0x00007FF62A190000-0x00007FF62A2BF000-memory.dmp

Download

memory/2716-382-0x00007FF62A190000-0x00007FF62A2BF000-memory.dmp

Download

memory/2716-383-0x000001EA9B4A0000-0x000001EA9B506000-memory.dmp

Download

memory/2716-384-0x000001EA9B4A0000-0x000001EA9B506000-memory.dmp

Download

memory/3472-6-0x0000000002AC0000-0x0000000002B29000-memory.dmp

Download

memory/3472-25-0x00000000002A0000-0x0000000000447000-memory.dmp

Download

memory/3472-0-0x00000000002A0000-0x0000000000447000-memory.dmp

Download

memory/3472-1-0x0000000002AC0000-0x0000000002B29000-memory.dmp

Download

memory/3832-40-0x000001A238D40000-0x000001A238DA6000-memory.dmp

Download

memory/3832-37-0x000001A238AD0000-0x000001A238C18000-memory.dmp

Download

memory/3832-39-0x000001A238D40000-0x000001A238DA6000-memory.dmp

Download

memory/3832-38-0x000001A238D40000-0x000001A238DA6000-memory.dmp

Download

memory/4304-355-0x000001EDEED10000-0x000001EDEED76000-memory.dmp

Download

memory/4304-353-0x00007FF6B8480000-0x00007FF6B870B000-memory.dmp

Download

memory/4304-354-0x000001EDEED10000-0x000001EDEED76000-memory.dmp

Download

memory/4304-448-0x00007FF6B8480000-0x00007FF6B870B000-memory.dmp

Download

memory/4472-447-0x00007FF6E5FB0000-0x00007FF6E63C7000-memory.dmp

Download

memory/4472-305-0x00000276B0F30000-0x00000276B0F96000-memory.dmp

Download

memory/4472-304-0x00007FF6E5FB0000-0x00007FF6E63C7000-memory.dmp

Download

memory/4472-381-0x00007FF6E5FB0000-0x00007FF6E63C7000-memory.dmp

Download

memory/4472-445-0x00000276B0F30000-0x00000276B0F96000-memory.dmp

Download

memory/4472-303-0x00000276B0F30000-0x00000276B0F96000-memory.dmp

Download

memory/4612-238-0x000001E5291C0000-0x000001E529226000-memory.dmp

Download

memory/4612-237-0x000001E5291C0000-0x000001E529226000-memory.dmp

Download

memory/4612-322-0x00007FF626E20000-0x00007FF626EE9000-memory.dmp

Download

memory/4612-236-0x00007FF626E20000-0x00007FF626EE9000-memory.dmp

Download

memory/4616-295-0x00000238AEF00000-0x00000238AEF66000-memory.dmp

Download

memory/4616-296-0x00000238AEF00000-0x00000238AEF66000-memory.dmp

Download

memory/4616-377-0x00007FF67A110000-0x00007FF67A1BE000-memory.dmp

Download

memory/4616-294-0x00007FF67A110000-0x00007FF67A1BE000-memory.dmp

Download

memory/4776-58-0x000001D58E720000-0x000001D58E868000-memory.dmp

Download

memory/4776-60-0x000001D58E9D0000-0x000001D58EA36000-memory.dmp

Download

memory/4776-59-0x000001D58E9D0000-0x000001D58EA36000-memory.dmp

Download

memory/4804-392-0x00007FF64C520000-0x00007FF64C7C3000-memory.dmp

Download

memory/4804-323-0x00007FF64C520000-0x00007FF64C7C3000-memory.dmp

Download

memory/4804-324-0x0000023CB6000000-0x0000023CB6066000-memory.dmp

Download

memory/4804-325-0x0000023CB6000000-0x0000023CB6066000-memory.dmp

Download

memory/5096-367-0x00007FF6D2550000-0x00007FF6D2A21000-memory.dmp

Download

memory/5096-449-0x00007FF6D2550000-0x00007FF6D2A21000-memory.dmp

Download

memory/5096-362-0x00000233A0200000-0x00000233A0266000-memory.dmp

Download

memory/5096-363-0x00000233A0200000-0x00000233A0266000-memory.dmp

Download

memory/5180-280-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5180-275-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/5180-361-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5180-274-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5204-370-0x00007FF713DE0000-0x00007FF7142E7000-memory.dmp

Download

memory/5204-371-0x0000017DC0AB0000-0x0000017DC0B16000-memory.dmp

Download

memory/5204-372-0x0000017DC0AB0000-0x0000017DC0B16000-memory.dmp

Download

memory/5204-450-0x00007FF713DE0000-0x00007FF7142E7000-memory.dmp

Download

memory/5300-267-0x000001C22EB10000-0x000001C22EB76000-memory.dmp

Download

memory/5300-265-0x00007FF63F3F0000-0x00007FF63F53A000-memory.dmp

Download

memory/5300-352-0x00007FF63F3F0000-0x00007FF63F53A000-memory.dmp

Download

memory/5300-268-0x000001C22EB10000-0x000001C22EB76000-memory.dmp

Download

memory/5616-14-0x00007FF7824C0000-0x00007FF7825E3000-memory.dmp

Download

memory/5616-15-0x00000193B9F40000-0x00000193B9FA6000-memory.dmp

Download

memory/5616-17-0x00000193B9F40000-0x00000193B9FA6000-memory.dmp

Download

memory/5616-16-0x00000193B9F40000-0x00000193B9FA6000-memory.dmp

Download

memory/5616-69-0x00007FF7824C0000-0x00007FF7825E3000-memory.dmp

Download