84c59a67ea582ecb363a744da4be5a5c637960654e0253b4751d0090184f989f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260720-c5dbjacy5j
SHA256 84c59a67ea582ecb363a744da4be5a5c637960654e0253b4751d0090184f989f
MD5 b74d790cfff1c20eedaa26d8e3ba4357
SHA1 bf3211304eb3f0758c4b8ad2fd74e9b09a07cd47
SHA512 1641f445187614a3854c618228a90c289943b13f1c8459c88c75ce1bc8e36a9a3f4e33f008ac9382dba28cef7c0fce7bf85526adfdbe0e33e4ee12e97a4367d0
SSDEEP 12288:PBwSfxL/2Dc3bDLLmt0LDQewsAjjWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkK:pmewsAjjWLEkgXWHiYKbfZB1v3adCMW
TLSH
T17315E031FA74E036C7BB0DB61B36C716283C79604B512AC7E3B88D9E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2680	alg.exe
5232	elevation_service.exe
448	elevation_service.exe
1572	maintenanceservice.exe
4292	OSE.EXE
5404	GameInputSvc.exe
4716	GameInputSvc.exe
2464	msdtc.exe
5484	PerceptionSimulationService.exe
3164	perfhost.exe
3396	ReFsDedupSvc.exe
5400	locator.exe
2800	SensorDataService.exe
4772	snmptrap.exe
4640	ssh-agent.exe
4836	TieringEngineService.exe
3556	AgentService.exe
4688	vds.exe
4880	vssvc.exe
4580	wbengine.exe
1312	WmiApSrv.exe
4104	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3c86089a5387db0e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	GameInputSvc.exe
4716	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4444	2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	2680	alg.exe
Token: SeDebugPrivilege	2680	alg.exe
Token: SeTakeOwnershipPrivilege	5232	elevation_service.exe
Token: SeTcbPrivilege	5404	GameInputSvc.exe
Token: SeBackupPrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3396	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3396	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	TieringEngineService.exe
Token: SeManageVolumePrivilege	4836	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3556	AgentService.exe
Token: SeBackupPrivilege	4880	vssvc.exe
Token: SeRestorePrivilege	4880	vssvc.exe
Token: SeAuditPrivilege	4880	vssvc.exe
Token: SeBackupPrivilege	4580	wbengine.exe
Token: SeRestorePrivilege	4580	wbengine.exe
Token: SeSecurityPrivilege	4580	wbengine.exe
Token: 33	4104	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4104	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4104	SearchIndexer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 4716	5404	GameInputSvc.exe	96
PID 4104 wrote to memory of 5892	4104	SearchIndexer.exe	113
PID 4104 wrote to memory of 3480	4104	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b74d790cfff1c20eedaa26d8e3ba4357_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:448

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1572

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4292

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2800

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4772

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3556

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4880

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1312

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e71b4d7c3b9dd65b681e62cec1d4e19d076ec3edb17e1e8e7336bcfaa3cc67a6
MD5 e40b34e02c24e9cd297cc9f0705dba0f
SHA1 7dc279e279f8a3db0ade9507a5fba49c5c6f161d
SHA512 92bc7ffef02b08984a8485866152d11c17af688a7df056a0b8e0d5d5975ffdb799fd202693e5fe7e7d478fd130cede93376d0d2b2389ccde553d584da1dab5a4
SSDEEP 49152:Vqn632BuPkFKRrdE6oh7stBhuXjfS4LWxnmcfT1S1:B3q6gjBJcfT1Q
TLSH
T1F5D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 5ecf7bd726f5d2f7ad6b5c69b816ff0120fbf71b59c615f11bfb45d7bcb603c6
MD5 d9b9317cd456634a13df1fceaba59496
SHA1 62916349e24263e953b8094d2ef1c18a209131e5
SHA512 176b339ea266c7862e6e7e308aa91c3ef3467b0b1bc60dff34d59713e4b68e7170abd79c8be29bbbb4c8ebdb69e666096340b453a3bcca24883e9149ccb23955
SSDEEP 24576:lXYNaDczAtWLEkgXWHiYKbfZB1v3adCMW:LDc1cfT1S1
TLSH
T15805F12973D409F9EDA3C17DC972C512EB3278954760E79F03A488661F237885E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e79048606d64b58cdbfcec5c727668f2dfc27e51845207abbe1f8da403808714
MD5 1d49c0cabe16cfb6263b506a416de2d3
SHA1 5a8214b3377f7eccbcdbf0f57b38ff88f2a8627b
SHA512 b64c5fd8e45291fc46a64d0aa034b9ba7d013671ece9ea02c37438c83c29288e9ab0d06e0c63707fdcbbe9426b38502af6756f1b47a21e19c0989a897fb8b7de
SSDEEP 24576:l0Ne3jY0donOrMTWLEkgXWHiYKbfZB1v3adCMW:lHjY0WOHcfT1S1
TLSH
T1E4359E16F6748335D073C0B9C5D2A68AED7130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4fb4e17dcb5da5e9f5e9fccd1b97f67c7536ac0c2c19672cb0988c9c2481d76b
MD5 dfbf0cc40b2778ac0d4db7423664bfa9
SHA1 02ed3d4ef84e744336b463768a5dd3c22ac7510a
SHA512 1d8c6503931cffd79be5678d0cde2d98317f0c889e16858c51f86516438914b60603ea922ce0db04e934c9d06ce7a703a0ca6b1d6cba20ccdc65603ccf1a9f71
SSDEEP 24576:NIycezSC6v/yD/aqgrvW/6q8wyucWLEkgXWHiYKbfZB1v3adCMW:3cezSC6v/zPvuHjyqcfT1S1
TLSH
T1A1756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 717c3158c1ffaa7940d869b7229ec999d78ffd5f4a05f5d68684e2248ebbedb3
MD5 d0a261dacc05e8073e267725648bfa76
SHA1 6b9cc63e8ce438ef514ddf3cca3451a83b8f2b0e
SHA512 a184cc2325f866d0f3f2fccc7f1d1c1280b7aced64b3182a259b25453536febc2395665aeb60c079eaa246fcfcc124e6a76c4b86802c96ea6d2aa8672442574d
SSDEEP 24576:7AbDPbx80Hpl+desWLEkgXWHiYKbfZB1v3adCMW:7ALx80Jl+U9cfT1S1
TLSH
T1F4559E66F5748335D073C0BAC5D2AA9AEE3234424B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 06b8dc84a90ee48db1e9c35cee30f4ce5997294510bbf647a1306fa03347ebe4
MD5 721e31c9110bf57c3c2ef9adb055bdd2
SHA1 9b01eda9d49f77ad97121dfe1bc3667bac9da543
SHA512 666b38b4fdede21e3a4837ae775f3833b31bef38c6a144cc4a8a3c0f54dcfb147de6559496381ba1bee3355f1f58554024e763541768dea6200995e5c3274fdf
SSDEEP 12288:QwVWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QwVWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1A7D423137654269DEBC1E47A5233C9933F7438D48B00796E8B72688339B4A0BEEC7087
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 a58602ae25dd5c56a5f6dc7eb205fbf3f76e9773df8c99686fd65b59c1ddc733
MD5 63e8d270e12f3049d23d74456bcde3b6
SHA1 054d5e533c2309c51a7940ea6a8df05830424bd6
SHA512 9b0c2c54725fd5127754adcec7de953d548ccf0bf99866749b8bc324768c0b0f779f1fab6542830e82f71d49a8ca5e3ebbb7e558fbfd2b510a07f2e170f53d9f
SSDEEP 12288:0eBNUbTVO86UDWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:0JIUDWLEkgXWHiYKbfZB1v3adCMW
TLSH
T10315DF3BEE28FCD2C2BA9DB85761C640A77274704F11A3CBD175820E9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 c2a11cb4af5bbcad8af7b37da7974302150d8590c6f436f1f24c31cbf66001a2
MD5 a415a62d068a6074ea79e66127b6288e
SHA1 cab8f595ac4740a0f7ca5c5fb27c394456dbf462
SHA512 fe81b08e537c730b7c7a5ed30a480ebb545c2ec2fcd74e80e9df05b7e980cb174a76b9b25697262a500b0e9f3def6b2969b3c06c16c4eafb4d567fb1960e199b
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THV:DQvGAdlCEL8c/NRNw5CwcfT1Q
TLSH
T14F367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 a9043a6e5b2bdc95dbb7899152dd52c1fbd947028f88323e89f9350be6ebf4c1
MD5 ee87aeec2bb2627d5cd5f102ee17c4e5
SHA1 98243e4580b3b86f97d0e96dfb3ccc8e48b9d493
SHA512 35be1ae2d0bb3ed554b892fc569f491bd89e627458c0357d33e403082aa3a4a456151a7029f5294cb8bc27aa7138a39c17438e8bb0e7a8e336e8ac5507208493
SSDEEP 12288:JIwSfxL/2Dc3bDLLmt0LDQewsAjHWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkK:emewsAjHWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1D815E031FA74E036C7BB0DB61B36C716283C79604B512AC7E3B88D9E59702D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ceb83cd44027288c885d1702f99b6124156e82d4ff431b73e0b65f76d59a0c9c
MD5 476ba303c5e261cf23b30f1e02bb2402
SHA1 ae92f292c75101595ad0bd31e2d9aa55b908d3a8
SHA512 5f48ccdebd6d9eaaffba47aa2fc2d28bfa1793ae4350cb2c27e169a7dc51cad25b17066e51a0a61897a6efea19a490e715da0cd6f7d4e16eb64e7f563753b63b
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJH8T1:FUEtQevvqc2W1cpV2X132
TLSH
T1A3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 281faf41ce123582d1162b2f8236cc870a9a0360e87b30bf846f2e70ef488956
MD5 2969ee09eb971e54a3a677d75725a6d3
SHA1 fb73598e1ecb0113ba1a807c109ae953fac53cb9
SHA512 c32a7bdd57095894660194ef15407f9f208c4178b80b30674bf76abc57924348d86831a14a86a7d43d4fd8a66ab36066bd840f002e92aa738676acff9ecd39f0
SSDEEP 49152:erbRquA/m2yL5zMfFiV+XenmE3/zncfT1S1:0oq1VjnmscfT1Q
TLSH
T150D58D1976B882E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f526e1cfff01b15297976fe23f84f8b0a0c9791bc49ae01a211e8cc215ebad94
MD5 f8a852e168e9e40aab31545e4847080a
SHA1 37f1d53ed994ea678b7cb18b84243b9514a9498e
SHA512 4b557306aa883d3174e9a7fa5599f38d1d049f4d4c8bdd3c839f049537b5d132e3185cb517a81bf569c38934aaf5ea82a4f915b2337d0c5c5cf5fe39133a498d
SSDEEP 24576:BAhGLvXFoiwtA5l7S53TWLEkgXWHiYKbfZB1v3adCMW:BAMTFoiq5ScfT1S1
TLSH
T1B9459D81E7F955D4F5F3AAB899B68171EA76BCAA5E30D20F1160C11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 4b3f5331bd7e903df9018a1f4697a752dcfaf23e742308e7cbd17f24e07151b5
MD5 06f58179d2b40fc35b693a4aa8a58e08
SHA1 384f100c304ef5840f51f286fa7e91edfc1707a0
SHA512 a668142063b98135e19a9377734ad6c0bfcb9a8072de48555390878eff8485f7e28da2945d8100755cfc9a1e2ea2b820b15c5a779f43086fb5c9cb9d7a34ea19
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CEWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6I:Owu+OWHWLEkgXWHiYKbfZB1v3adCMW
TLSH
T15F05F10676A41CF9E9A391398667C536F7B278512B20DB1F0770C65B2F37321AE2E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 3250cf38bd4867a1afa76d7bf85063f79ff047f47f5a093a88850a190f843d2a
MD5 27dedbe57b6a41038ee561569fc85166
SHA1 b61422ae80b3eda9b1de991bbff9c599572f13d9
SHA512 fdedc7084bd6b3e070144e7976460beb5f4f19fa5fcf06821c534703f2491f66dd1e650ee5af36f8ac2c8204c3688dc657ef4756afc5097a28a522af610a7a84
SSDEEP 12288:6rC1I9CWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:CCuAWLEkgXWHiYKbfZB1v3adCMW
TLSH
T122E4121633E431F9E2D3D17DCAB28A46E77134A6572153CF067140A62F62BC66E3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ae60b3c9eaaedb22bdc90236f8779b9ae1680898cd58a378233dae218a4ab636
MD5 6d381a85ffca1af2f353f8ca2011d7b6
SHA1 6fe9447d448869d78940329e157e190e46ddc553
SHA512 7223ec2babe446ab8faa4562786d821b9e075ea26e2ad6e604a89be9419ac6faf8b3b5aafd47ad36aac4da3302001d9206b9d61b813b41569a295fa0c934c99c
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UI:mQRQyi36YOcP8Lvw2gAf+PN3gcfT1Q
TLSH
T10C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 83e1ee9864470f93b7c9c73465f932ac7ced3ebe32f639104ac7a3e423ccb7c4
MD5 72e6a7cccc1fd6dc4652c6bc3ab3b639
SHA1 377dab802124f9ef80c83079b6bf61d70f5d6a44
SHA512 5dce46d872df81f72450e83b10493dbe468e863ae0f3d86ad6c7a21521db25f24006e7693f5e7a7a2322ea25ae725b931414ab149c4fb6b5b156791f768a8d7c
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UM:mQRQyi36YOcP8Lvw2gAf+PN3kcfT1Q
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba209dc79b8da697abe2be0a93ab467689c33d1a68ea396cb199aecde7fb1f58
MD5 174d772a70382a94478dfbadcde2c582
SHA1 67ba66de490786a647463255a233558b01c5d2e7
SHA512 7f925e2ed2267730ed59302572a3ba57343037c35787462dc0c74fef210e3d6057820bc5e26bea368b73034f5e31270a519268eab93cd522643f7ca58ee4e3f6
SSDEEP 24576:mwvy8f6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0+WLEkgXWHiYKbfX:T68Qg55nhMeWu7PNU3/GcfT1S1
TLSH
T16CB54933B2F600A9C44DE1769F4A872196E17C758FE0E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e27de2243a267f8882cc57aea0cdd8073ac41c482a1057b507968155b304c559
MD5 1538c3439bf2a15bd3d1777042f7f48e
SHA1 4de2dea75cc93bfc519d7d9b64a27db627887628
SHA512 f78263edf993c5053a80115eda7dca8aabd6eae824b6943fadc4737cc69b81624bdf96848385ded77dbe9067f3fe17ae20be68de3bc17ca245af49bf022b6c5f
SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99M:yy5112gYy5azzVv569nLKnhZxcfT1Q
TLSH
T19F167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b846f90ab6115f83dfedac91559cde3b87c6c6325c37c488b0944a6afd59a024
MD5 e6127cc33782be94e0e1f2293596e0b9
SHA1 724e49cf7e831b877a2c79fb097c3c15a4a296e4
SHA512 6e7541830adcbd037f49a6a2f5333921552be2dedfc69f6b898c906c58d4e7a3e5a475ee27aa976472433dfb89cc25de13e2eb3160997014599bf6d8f890660f
SSDEEP 49152:7G+taZ3usBWOBr4tEGp0bqx0z+n217aau1glYcfT1S1:6u6JmTxd2dYcfT1Q
TLSH
T1CED59D13F1DA01E8D05ED478974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b4e7fc5f1de88a20138430fed92b65451760f64dfe03cbd6c45b8aa0720b097
MD5 2f26af4d11a76b8f63d99a3c06e40e3e
SHA1 5cc7837f34d0885b2a0b17571577d6bf334bd12f
SHA512 d66554c454e214ac278147c3d36730a02d876d28262b24a2e99ff9993443e71d5104c7a560c8def2fe050d9baa0d3042f9d84ce4b66028f9bb983e10c3de9db9
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xZn/LY2ooXACgSQng4:dmifPbRy7ACgNn
TLSH
T1F4B5BE13F2D900E8D06DD17887569232EA72BC460B35B6DF0690B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 06ffe497599f9c485222d376ea475ab45004fe19db7cbb016acd81826979b9d5
MD5 8001b5993507e87b35c036338e7f4d6c
SHA1 6e50a6e6581c70ffca6994f8dbc1b6117cf61adb
SHA512 458823b4b56cff144cd08351a779cb6367418d55d2c24c01784a051cd35809baab7f3f4b18fc3065f464a9215fb8a32b8eb65b98472f60b605b041de3d9d08de
SSDEEP 49152:aSuZQIY0Be2K6RVtOnks6NMHqFn/LY2ooXACgSQng4:E5dKoi6157ACgNn
TLSH
T127C5BE03F2E940E8E0BED67487669232EA72BC464B34A6DF065072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b326e676bc0ab8cae0d1ad97adfafb9fcbdd011eefeaa82cda4880eb20b2df6e
MD5 109acdd6971c2b701ca80836c232d648
SHA1 c749352f6d56da8e7426a6596ce0043c1482e75a
SHA512 9f7b11d3eff62c5a727f90db39c8e384f5e5baf1b6d6f0b316b346a5484f288f61a4b0c448c334ef0d83bee2196aa72f52dd66fd83e515a6bb918892fcd6f013
SSDEEP 49152:xW3Sn8EApI0figTgiDn0AP5wqn/LY2ooXACgSQng4:TX2iyphN7ACgNn
TLSH
T14DA5BE13F2D900E8D06ED178C7568632E962BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 e517c425bb1bc286776d076e897773fc48f0ba3b5ad5ef10841e5005ed6cdefc
MD5 cb826fdef92c6fdcb9cf652fb58b183e
SHA1 cfc0dd7ffa673a1dbd0cba2482ee77300277de80
SHA512 c64c07d80aed1bb403f15394776cfd7bb0e5cce2186ee10b40cc0dc4492a0b665c9e71507c3760bd32a60043e6a5c6da34437312e46461bf6692a3bcadf98cba
SSDEEP 12288:z21n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:zWn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T173D4238F329D0CC1C23046B751FB76C996F2D60BF8561064C2BA5369BE91E0E769A7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 31e1bd5cc765d0ab6a745b69c127988a0fea20cb07d7ff32d726d2c4d346771a
MD5 5a9322e92f698893d02dceb4906dd126
SHA1 5d126118d638e5192ede96937bd8e25a023f9064
SHA512 87b915bdefe25493d90b23046fb16099f26cdcd38354f976d100537a7a3c2e0aa17d01513add0740784652f792538c0a8f48955d636d3d549f30a5118f36cb1c
SSDEEP 12288:VQ1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:V0n/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1A3D4238F329D0CC1C23046B751FBB6C985F1D70BF8561064C2BA9369BE91E0E769A7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 e62bf9da23d59e07b45ab47ea1110ed65f5744b0c9e0c18eb46c36cfd459194a
MD5 e0f363b29885c40f761a9075518f988e
SHA1 4c6efa7d904d2373c0ab01646a50ae059986cb87
SHA512 7b58c179936ab7d59b8b11295f82b674b0dea4f52deb470f22c19e3a26b01843c4a82c5a79e3ec1b83b5a5cd3597fb1d3086f409bb7ea92bc2a453eac5269e47
SSDEEP 12288:bo1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:bcn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T187D4238F369C0CC0C23046B351FB76C996F1D60FB8560069C2BA5369BE91E0E379A7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 f91b30cae939cf8d153747463830800dd6e6be8b6129f70dd9207779f880d73f
MD5 4ebe64fc83f96c038655cd65fcc2f515
SHA1 f587d091f2fb51314e16696e9a6ef9635ef87831
SHA512 e0b3040c194d6d421322c6ad63dcec99614866bdc10d85a2c8feb0afe359fdaf5d144905da415085abf8136386abec1255f33943ebb55147aa7d27fc1645169d
SSDEEP 12288:Al+1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:ln/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T104D4234B339D08C0D53182B6C1FBA685D2F1F91BB536126FC37107AA1EA1B0D7A69BD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 305a0e8142b20e256eb393663bf27666d75474eab0fc33999866dcd2407a090e
MD5 d33f5ee36b25c0110288d5656260da58
SHA1 f32a261b6312a354fc08c6fec2d1a4c0f7b98e14
SHA512 845ae42663681a875b06090d7281689043a453794629184eab60d71c34fcda6f862f5d2da24bc36cfef7824f260846d5ae2cfeb085128b4c5c0eadc8cf783b0d
SSDEEP 12288:al1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:a/n/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1D0D4238F319D0CC1C33046B751FB76C996F2D70FB85A0064C2BA53696E92E0E779A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 f7648c9378b53d6e2d630ffd5e51093fc5f1a3d3ebd885a180c7786e21829857
MD5 1128481c486158b0294b8e419ec6a7d9
SHA1 c1e83da8c4bed37e5b196ba0a89d584815155a63
SHA512 cabadeeeee7eef23640bf80214d16c865570a24aa1073dacfb0e4233ffb3e0ba2224d9d79aba6ce09c320ebea0ab730c399c7c3e83d452761a62e361da6486db
SSDEEP 12288:ZI1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:Z8n/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1F7D4238F329C0CC1C33046B351FB76C996B1D71FB8561068C2BA5369BF91E0E769A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 92761b191a527229cb19fdf129c25a878d59c1bbb009daee883b19451105b232
MD5 7a6cd8c1d3d0309727112b8b284fe55f
SHA1 febb055f073581756ff28975ad773d11ca1705ba
SHA512 b7bda4f4f2f61995fa6893e293b074ca05b7ca18ae7ac559f5f9a089da258aa7cd1e64ddf074756b4c816be45f5d0844b17b96c2f692e2d79c609fbd07010176
SSDEEP 12288:GnF1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:Gfn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1BED4234F328C0CC0C23046B751FB76C986F1D70BF8561165C2BA53A9BF92E1E769A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 d5f73382d2dd522745863e4e4578e4b2991d00eca45a29f3a779e2d125ea5406
MD5 94af7342b1af3213ae97b879ba9273ef
SHA1 496de6907e5854ee074203295d6ba14b4277f34a
SHA512 41a55dce1fa45f9a52fd78c9092a8cf1cab67f61167633c168a2763d23907cf7155f44671a8e21d8055c513fa5bbfb4f3812bb389ae7ea916107f92405526692
SSDEEP 24576:BZMjzFdS+Rn/L1S2oo3HACgSQmAnF8l023wWAwLg:BZMjzb1n/LY2ooXACgSQng4
TLSH
T12515019973900CF4DC73823EC9A69906D6B2BC1A1A70C61F43B4366B5F337611D2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 c7120732fd1ecec6b48962739090c52a28cb1da1f3a7db9225d662c76970b3f6
MD5 f60dad5160e85a5a8e6c86eaafe95b49
SHA1 6bc6a68c4d4aeb4c14ea1af6013db6dc9803d6b5
SHA512 528d6a45932f621f9ae83f4e53197f27868f9dbafb3b866a973d93b9fab061d681ac3579a80520e35be68c11ff047d01cb964840222aa322d62d47abc722bedd
SSDEEP 12288:7Jb1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:thn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T14AD4238F319D0CC0C23046B751FBB6C996B1D70FB8561065C2BA5369AE92E0E379A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 f3f9f1e75b6d5c1fcd4103519926ebc1c21f0babc364a2932b6b773743edb6b0
MD5 83a0f575ac2895e5be8fc1d2e22010fe
SHA1 45d2d1ac1d30e4ca96158fdef445f5ff783c445f
SHA512 f5f2a1e2f764d119e5e7c5b586e9f2053355cc8c5e882fa6ce7cb2c37a124b16228738b06a2dff9ec85da7e8ba655ee3e703ae837283621532d0aa8f4bfba2c2
SSDEEP 12288:nPn1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:P1n/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1AED4234F319D0CC0C23046B751FBB6C996B1D70FB8561164C2BA53697F91E0E379A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 489a614a481fba3eb355f64769fbfa0716f60b97996b0066c8e242814375515b
MD5 510b76a82468bbbf23bb8334e508b02f
SHA1 39b8e94b3d44540812a53a42972bcd46aa77c9be
SHA512 d7d82e84ab027bd088a0613e1e75dae68d72620319f610581fcffd4d581690b1edd0617d36cd1ceda9b874d55eb2a031125fcf5d317178c92529cdf5290a844e
SSDEEP 12288:xCPz5LlE1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lz:YzrAn/L1S2oo3HACgSQmAnF8l023wWAz
TLSH
T154F4124B33A520F8D1368235C4F61A46F7B2B83757244A6F43B4477A2F236556E3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 9abaa4c432d8681ff1ae7166b592435b024545633dba2b4342817b0e5a84444e
MD5 228d5ed9d744f596c78eff71ab3a759a
SHA1 1d8ca874c5d85922f7104082a05b561a47f3ffda
SHA512 bdf9d7c9dd4f0f505f96ce2721ae190895268f674429e6c22a7eef03774b85fe847eafc1b3a00b4318ecb3af887933e65587b3a429b8772784ec733a3e9232d4
SSDEEP 12288:l/R1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:Bzn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1C4D4238F319D0CC0D23046B751FB76C986F2D70FB85A1065C2BA5369BE52E0E369A7D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 e542bcfa17b55f6ed20f9307cfd7dfdb077d82ef1cc2957b97b8e21daa2c82b1
MD5 f020ff476486302362609e382c246110
SHA1 df87d8ffcf93870282729f95962a9927fa1e7a98
SHA512 90daa21ed647ecc6afc196643d2a0446f415918283ed22b53d6dd1fa4e7c4ad5e813b26f210fa8a604c440241e342f622f2e4eb555fbb6a9e8ec184e875823a2
SSDEEP 12288:SCUr1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:Jan/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T138D4238F319D0CC0D23046B751FF76C986B1D60FB85A1064C2BA5369BE92E0F379A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 2f8c4168f5ee9452f8ed05872fd15246c9bb8af362ef0bcd6f0927636d3ab3b0
MD5 6b0aec95324d8966e6f51cec8827676e
SHA1 4ec27ed0d484e08e7466ee58a89466d9abaaef32
SHA512 c497fbe107c981927b304feec713bbb2ad328e9c00e70875e90da6845a242ee0667d777d8cc3aab65418d2c55ab5a6c82dec9e1b1d8ada27ec261c7a430ebf92
SSDEEP 12288:UCPz5LlN1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lz:xzrXn/L1S2oo3HACgSQmAnF8l023wWAz
TLSH
T1C4F4124773A520F8D1368239C4F61A46F7B2B83757204A6F43B4477A2F236556E3EBA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 e6ab943863c08334026086fccbdd71a547db09809f2e02b5ec7c038d64fc1311
MD5 b56435f599b53318768bda1ddedc950f
SHA1 59047dae5f084f4e3bd1495cbec8b942a4e5ae29
SHA512 a800b464b4e5f609a4060736bf9f46fa2ab98fdebba75454ad92f466757ab9227ef9798dee445507e5baee71db5ab47dbd9b69fbeda7ce4b94a71881e157a122
SSDEEP 24576:cTEaLj3z0zjSn/L1S2oo3HACgSQmAnF8l023wWAwLg:cTzLjjRn/LY2ooXACgSQng4
TLSH
T1BC150199B3900CF8DD37813EC9A69906D2B2BC1B0670C61F43B4366A5F333611D2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 f5f387f37d120e828356fa9ec3ee498898a616399b87bf684d31a49e5463a7e2
MD5 4ae650d76549931acb2beed9528857ac
SHA1 57c347d0b53e4e98e23d7beb549a597bc55eefb4
SHA512 2ddb5a40edecdab10c408b5ca24e09cab60c568bf46a2bc78aeae91c497cf1523f05c5230220b915995e85f24d439ca02ac97ab6e6688319f7c99811c4733312
SSDEEP 24576:P3vdcCHKy7hKun/L1S2oo3HACgSQmAnF8l023wWAwLg:fvdcCHKylTn/LY2ooXACgSQng4
TLSH
T1E535DF91F3E814E4F1738A3589B65511DAB6BC5A1B31CE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 75885e7e0aa348f6e0a0f7c5c5916a29a2d98b635dd895313705658cc5a1efbc
MD5 5933fb067fb7f0a7c5cccb93d38d0ed3
SHA1 17fcd4ac429cce999986f08d680aa0b055ff15cd
SHA512 ea07ad57b1f73b651e6a6b0031965a356ce43b6e2f86270cacec0e40e89af5fac08820034edcd49f526fad079b3b2ddd0a7b3bb3b6bee79213da3622bb4c082f
SSDEEP 12288:Np1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:Nbn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T10ED4238F319D0CC0C33046B751FF76C996B1D60BB8561065C2BA5369AF92E0E379A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 fb9e95f79bd1405fa1a22321e5dcde11efad1977d30285fc5a06c77c2bdd321e
MD5 bef918d5c6f2b804c2bf6a47ea6c2ae8
SHA1 7fc740f3d1ec33d0dea13775d8a8077acd3223f1
SHA512 adeaad09fc02695bb62e051906a20051d3f2ffcd6bb30d73ce33b32e1bbfdcfc782a523cff12a2b9778245c2384104d4e019d3ff03356701aeb0e193b0ed7f32
SSDEEP 12288:IipR1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:IKn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T1E6D4338F329C0CC0C33046B751FFB6C986B1D70BB85A0165C3BA53696E91E0E769A7C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 18dd80b16cd17983d01338f8357e29008b72c2bbf3d8cf424f9a55f95cc3d00b
MD5 d8309c64b71b1adde6ec529942a0a36b
SHA1 473ec131f07f195b95e448fc4781a2d211a0c172
SHA512 2c921c719c3dc6e90e57556f6ba8867ea7893a9389ecaeb27af351f177c430786eae72880bcad0eef2272ff8de2def86f71ed9b035514e5ac2738dc0e04483d4
SSDEEP 12288:gNNg1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:0mn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T14FD4238B329D0CC0D33046B751FB76C996F1D60FB8561068C2BA93697F81E0E379A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 847ec55d8afab6c461133b123351a4448b18ca0d9735fa5d76d0150df4ddb7e7
MD5 5e96d1af835ebfc6a5929e1971c7887d
SHA1 9c3b8949a6dba063875ea5ad497d4ce522782132
SHA512 202c200129daff4721054aac2badf1284ac41550589328f78ccb6b180b99bdf7c3d8876590e623b66cde15acd04935f5af9cc635ee3a094229184fee17c4df37
SSDEEP 12288:5Jvg1n/Wg6nTY7+lQopO3HTUC8yoS6Tmdmn1HRifl0QbZ3vVINj6mjdd1+Lgil:fsn/L1S2oo3HACgSQmAnF8l023wWAwLg
TLSH
T14ED4238F329D0CC0D33046B751FB76C986F1D60BB8561068C2BA93697E91E0E779A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 8a3d7abe20dbb853c64e79db8b216f34b7d0c0c53bab10fd662f2db1018d2177
MD5 c788ffe9750875592415a224e7173494
SHA1 e228a50841fc857c0dd92864be478d0bc4f34689
SHA512 782575c855f66f79aee269fdf8ab5fe9b0d722a2702cff74834cfd653e899151577f9257fcfd921da8779d12624961e6430dad04eacba5b88219941f21e7e224
SSDEEP 12288:uN5sfDWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:dDWLEkgXWHiYKbfZB1v3adCMW
TLSH
T18FF4011AE29412E8C1AEA179C7228A41B7333CA587E0E3CF57D0F43E1F756519EDA643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 d5a3b485aa84a5c476e00e124b11b3bd4bf9af3b9e8a586f54a262b2238af759
MD5 1b393b7355d285e63cfb30b01d5eee56
SHA1 84c3a345cac49f2cc4e7e7860cb09ce662245783
SHA512 4b21bcd3d973a85d930b7e6a348b51308829b91f224fc99045195d68e94cfca0bab58378c334a8e1c1c91c8283d5d2282f3299a9bb51accb66b32fdfe65d01a8
SSDEEP 12288:Bu77WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:Y7WLEkgXWHiYKbfZB1v3adCMW
TLSH
T160D4232377591A5DFAE0E5795237C5223B3D30E88F00A0DFDB2650823AB4F469ED618B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7a686457c34ab9ea650da236f7a02cfa3684de6c54363760aab0206d0f3a857b
MD5 faa2cd478e10bbc7944703b667120588
SHA1 3eb592b9ac638f6f0baeb367f6654ff4699b706a
SHA512 e3c145d6bda0e546382400b1c87c2c92c2bf64849692ed2a1595f4341956e201711805dbe13d1a6eefc4e4d34952447a4530f403858a0e203477ca9af525bb7f
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYHQWLEkgXWHiYKbfZB1v3adCMW:Dgb4mBIBhGF6cfT1S1
TLSH
T12765AE1E22EC02F5E0F5E2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 a5a1fdc9f4d519b111568d1cf9e9a63d623e33f2dba5c9f0e8e82acb3b342ab5
MD5 14739684345822e161394eb0dd707b8c
SHA1 cb923eaffb27ea5721dafce482ded68736e0bd8d
SHA512 b25f4c3ddbf6eec01a77fd7e530216d9bf3fffe5a16fcd0afab98b9a53fb12ef70dec4adda42949b4083254c7583c8ce6fc4a1b43f5d85f20ce05eca1cf601c1
SSDEEP 12288:R9GIWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jGIWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1BBE4232A31B6369CC9B1D67D8132C5537A7030E08B0075FF4AF190766FA4ED57A7AC8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 dbed87b2e57804c13b69a147751e8720b109539b11f7d1f19e8b6ab83f6cc513
MD5 8ad4b551bb7bf88769f655fb4296da24
SHA1 4cf407691be2ceb9d720581a243f846a02e742d4
SHA512 9b9c72a45fc5e3029442c5f99ea5c3b448f2b35f3ad87b0232427bfe68fa6c6f9e2fc7170c2dee0a2be4e991300553939366a1e5d27c1c3db686e9d931bc8751
SSDEEP 12288:P8WOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:P8WLEkgXWHiYKbfZB1v3adCMW
TLSH
T1F8D4232231552B9DDBD0E57A5233C9523B7830E5CB0075EF8A7250532694FDBAEBA0CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0f96ac2e94f52b560a7c6878895291d64d3cb4a495c7c0f1a5ee3bda8ee72f8e
MD5 929cef450241a158c694b16d130ad2e6
SHA1 4587d18a6a23d3d17bd9674bf91bd6dc36ea8dce
SHA512 f08e0d87625e759d27de1c903d71969c6494b4b20fcdc95e5f4de6ab89c48f267aa3305b673cea4671dae6bb6854cc0abdcfe90ae643f984a192f20e4fb173a7
SSDEEP 24576:itZ8i8FKJqH1Mzria7/m9WLEkgXWHiYKbfZB1v3adCMW:qeFFmqVra7/3cfT1S1
TLSH
T11D35F12577E102F4D4B7D1388A528663F6B2B4250364EBDF07A88A521F23BD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 1d6e35c02146e2d9b9afaaf10d745d460fff5ded5c86d85cbd6307df3a0c490b
MD5 3f4622fe0f8328a95497f491a7aa940f
SHA1 dbcd4f96d29fda6b8f9e5f662bdcde29354375c9
SHA512 2fc022035486348bff26d9b458f9078701b5e8c07a1f246979912cc43523cc0d707a2fdbdc7d56b58973504a7785936596427d0e547d77bc7dabc9fd6ba7fae7
SSDEEP 12288:oHvUrBFrEjwaQcWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:oPUr+NQcWLEkgXWHiYKbfZB1v3adCMW
TLSH
T13605F12F22AD18E9E676E17D86528619F77174620701E2CF02E1807E1F67ED8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 3939f920301ca672a474ba6b3c2fb974082d338a9f6b0482797d840a1f179fb8
MD5 858d78a374458c57a0631388740c3fbb
SHA1 abb76ccf5bb1a125d30dc0a4c868212c29f4c6ee
SHA512 d3a175a6f96ed73deca7771e64d8ebe835df04a24376529062808a3866a609624c0d0ac7eb482601bd10d27b6dd5191dfad84e0bc752c124dadd3696d73dc082
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjncfT1S1:pG05lO43bScfT1Q
TLSH
T1E4D5C06E62EC11F9D1BBD17CDAC6860BEBB23415032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 f8105ea5c58856b61705a9656a530b01674e61d96da63fcbe0bd5a8bb85bd643
MD5 483eb0135ff2e4df041157d397a5f9d1
SHA1 81478170c2fa3acd0e0b66f40a26aabbb825daf8
SHA512 41db928ec367465b5edd413a00ce5fbaefa4663d63e38e235aa45a921c0ec1cff81172d834b20ab1777a1e650979daf15ae9dcd15bfb8f23d9ad0cd4acf3d9eb
SSDEEP 24576:0Da5POZ3dpbWVM50JicR2hG0lasx2+47eidnMWLEkgXWHiYKbfZB1v3adCMW:ga5POZ3wJt2pasx2+mfcfT1S1
TLSH
T18665BF5EA6FC01D5D5B9D17DC583861AF5B1342253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 61faad4203dbf1821eed903219ef3f40d174077c0bf6f4adb3af67184348d61c
MD5 9c482e1722148ed6266773ff04609022
SHA1 5fab419ec4969ac411afc2ea1cf5ecda5aab9720
SHA512 b05cacf5bd2ae1cdf50c095510fffe93f0677a1051fc8a1d480112c88d1376a6d3670e8c60083505e26bbb99c5179a6b30b7235f9dc73d3a117c0ad27883ddaa
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7Fk/XWLEkgXWHiYKbfZB1v3adCMW:8Nc/zEOVHFomcfT1S1
TLSH
T1DB858C2623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 60362a9419479aa8455efe4cf138892decc080132c271be2820e3dc7c8e47191
MD5 ce1e64a49af6b3d0b8e7954f1152efe0
SHA1 8eea639b960e352458afc55312c1fddf80483403
SHA512 cf3f254c753e5ced9d81c2ed0d2cd37ea71f62281cd56356619ff71407aa45396c2e8a66e032ce3bf0d5f3ab8ab7efa98826eab93443f2adbd4a8777ef55c4dd
SSDEEP 24576:4JnJPbzB4S4WLEkgXWHiYKbfZB1v3adCMW:4JnJv6SZcfT1S1
TLSH
T12C15D03DD2A810E8E4B7C2B4811A1A5AFF31346D2F1169CB19B4D4353F52FE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 47fec52b5b77469e30eba5f1cce154e9c5c7b35d6a9625eba60da93901a5a10d
MD5 181a2d25f9f11e1f7fb4ad8ee6bf5746
SHA1 823d1ac008eab85e769bb7afc23402cba9ead96a
SHA512 308c3f76c9a5d947e2e6f4287391c31a032864c892369c431202f8243bd198f0e72ec989fc03510f5c32eb5339a6f4e1cd9f3019b3aea4b7adb8316dad31121a
SSDEEP 24576:wCLHGL0MoeVtFumTijCmlKQWDkgWLEkgXWHiYKbfZB1v3adCMW:wCLHGeeV5ijCmlDWDkhcfT1S1
TLSH
T1E4A56B05A7EB5184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 12a0575ae0b2daa10246a53f54c314c1e1a8e5b1f54963eb7cb16d1a5dba9650
MD5 5f4cdb0914848d775c0888d3a5f8e753
SHA1 47492cbe3324118920b56f0f99be179af4174867
SHA512 0bf06cab3748e6eedc262bbb0c99d1e92fea6773a3991190bec74d45f6ec0669d4329d86a7a65389fcb5d1a28691387d800caf762bf3f4f5bc2cd5d1f2029461
SSDEEP 12288:Q1HKk6j5ZI77iWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:y6DIKWLEkgXWHiYKbfZB1v3adCMW
TLSH
T1F5F4011D337A11F9D1A7D03E82534502E6B270B1C71169DF4BA4C4BA5FA3EC8B93DA82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 904cb1471f046091a7943f62418fd74bb9cb405cbe2154ba360ad6d07e108b43
MD5 e48ca41c28d555a4baec72f29a115301
SHA1 28e07bc683fffab2a400c2fe4a052f1af85c0878
SHA512 9685d51f99fa03fa025e212b74fb32d69e5fda1d1f0819e44d928e8c6249f572508b5fd744e2dc8e64eb86fe74717aa662edd85b7250a6070d7b2c3d1d8497ce
SSDEEP 12288:qG6kydAWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:jtyKWLEkgXWHiYKbfZB1v3adCMW
TLSH
T182F41201639821D8EAF5D2788633C1A1AF347C608B00A2EF56A1E43F2F75BD5AD72757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 51b8370cab8e4a91185066985cd8ef977655649bb82f34b1ed676c2f6e80bf02
MD5 d79d00c3f7d5c8906f94b0615580aa78
SHA1 52f6399c2595ab182dc4001fe8a5b9a89d304e8b
SHA512 b2052610620a3346b76c746b7fe9be4f13a3e1a106dbf26b3cadb3810ab6aeb40b4607dded4f2199cf134db4469e28094391353f355fda4932b96c31d6a441ac
SSDEEP 12288:OwAWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9AWLEkgXWHiYKbfZB1v3adCMW
TLSH
T12AD4232A7265369CDAC0E5794233C552777830F48F0075FF4AB294732BA4BC66EB6487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 34d176771022cc3fd29ec22c0a9a32083f2bce745c6d1338b39c751a72badb4f
MD5 614968be0ed0a5766217d1e0e2895d3d
SHA1 c4223967c6d95a3b94ebd57c0c3382eab5f6b617
SHA512 ca58c6888567ae1b9f6769ec83b44088033441529fa4934018baa68347c5234feb67e397f574ee9513204737249f66f0b76fd0741c16ca946aa539d20f5ddfb2
SSDEEP 24576:fhg59oTfaidZIiWLEkgXWHiYKbfZB1v3adCMW:pgYTrZscfT1S1
TLSH
T17D559C1D73EA05CAE2B2D239D9325493D633B4315772D6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 e4df924429fc4574c254759052e9ec58b24c74e2598ae47e34aee68d04717b49
MD5 462ed25e3efafc51fdbd167a567bc9bb
SHA1 1bffe8bdcbd24822bdedbb7d9cfc4723321b455a
SHA512 fcf3d29c1a90e6bc43ad633d2c80eb983bd3e39d15a3d5107bc7f732af6783e60bde5a90d3ba2672bfae67f694683a4e146ff04b2e4d7b32a568ac97e6866348
SSDEEP 12288:QpJcm8CNKWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QrcmRKWLEkgXWHiYKbfZB1v3adCMW
TLSH
T18705F11EB2AE00E9E1B3D13C89528546F7B33070570167DF42A1C67E1E67AEA7E39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8f1d7cf6bd4870a15169e1cecb96e1475299c890182fc7daef286e3271425364
MD5 43a3bdc9c33dc4f5e0797264516197a6
SHA1 11407a709926edea9d775835711a3c1480c7d15d
SHA512 db8d9f68e757c6c67948a46fb6b18b9248581218e00947a1b49d46cb0949681d8a9e2079dfb6d9ad0415a30819b75db50ea49ed53f83db9fbc87757f59bea87b
SSDEEP 49152:MDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3ScfT1S1:J3Upow8sBHcfT1Q
TLSH
T19AA58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C478BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-38-0x00000261D5180000-0x00000261D5241000-memory.dmp

Download

memory/448-40-0x00000261D5370000-0x00000261D53D6000-memory.dmp

Download

memory/448-41-0x00000261D5370000-0x00000261D53D6000-memory.dmp

Download

memory/448-39-0x00000261D5370000-0x00000261D53D6000-memory.dmp

Download

memory/1312-382-0x00007FF6CEB10000-0x00007FF6CEC3E000-memory.dmp

Download

memory/1312-381-0x00000261CFEF0000-0x00000261CFF56000-memory.dmp

Download

memory/1312-453-0x00007FF6CEB10000-0x00007FF6CEC3E000-memory.dmp

Download

memory/1312-383-0x00000261CFEF0000-0x00000261CFF56000-memory.dmp

Download

memory/1572-57-0x0000024239FE0000-0x000002423A046000-memory.dmp

Download

memory/1572-59-0x00007FF61EE70000-0x00007FF61EFD7000-memory.dmp

Download

memory/1572-48-0x0000024239FE0000-0x000002423A046000-memory.dmp

Download

memory/1572-49-0x0000024239FE0000-0x000002423A046000-memory.dmp

Download

memory/1572-47-0x00007FF61EE70000-0x00007FF61EFD7000-memory.dmp

Download

memory/2464-250-0x0000017FF7BB0000-0x0000017FF7C16000-memory.dmp

Download

memory/2464-249-0x0000017FF7BB0000-0x0000017FF7C16000-memory.dmp

Download

memory/2464-248-0x00007FF782630000-0x00007FF782749000-memory.dmp

Download

memory/2464-340-0x00007FF782630000-0x00007FF782749000-memory.dmp

Download

memory/2680-15-0x00007FF777AF0000-0x00007FF777C12000-memory.dmp

Download

memory/2680-66-0x00007FF777AF0000-0x00007FF777C12000-memory.dmp

Download

memory/2680-20-0x0000028CF2F20000-0x0000028CF2F86000-memory.dmp

Download

memory/2680-17-0x0000028CF2F20000-0x0000028CF2F86000-memory.dmp

Download

memory/2680-16-0x0000028CF2F20000-0x0000028CF2F86000-memory.dmp

Download

memory/2800-391-0x00007FF69A3D0000-0x00007FF69A7E6000-memory.dmp

Download

memory/2800-303-0x0000020FF5D30000-0x0000020FF5D96000-memory.dmp

Download

memory/2800-446-0x0000020FF6740000-0x0000020FF69E3000-memory.dmp

Download

memory/2800-442-0x0000020FF6740000-0x0000020FF69E3000-memory.dmp

Download

memory/2800-445-0x0000020FF5D30000-0x0000020FF5D96000-memory.dmp

Download

memory/2800-305-0x0000020FF5D30000-0x0000020FF5D96000-memory.dmp

Download

memory/2800-304-0x00007FF69A3D0000-0x00007FF69A7E6000-memory.dmp

Download

memory/2800-447-0x00007FF69A3D0000-0x00007FF69A7E6000-memory.dmp

Download

memory/3164-275-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/3164-280-0x0000000000900000-0x0000000000969000-memory.dmp

Download

memory/3164-361-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3164-274-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3396-286-0x00007FF796940000-0x00007FF797083000-memory.dmp

Download

memory/3396-288-0x000002570F570000-0x000002570F5D6000-memory.dmp

Download

memory/3396-287-0x000002570F570000-0x000002570F5D6000-memory.dmp

Download

memory/3396-376-0x00007FF796940000-0x00007FF797083000-memory.dmp

Download

memory/3556-341-0x00007FF627BA0000-0x00007FF627EC0000-memory.dmp

Download

memory/3556-342-0x000002D11BEF0000-0x000002D11BF56000-memory.dmp

Download

memory/3556-349-0x00007FF627BA0000-0x00007FF627EC0000-memory.dmp

Download

memory/3556-347-0x000002D11BEF0000-0x000002D11BF56000-memory.dmp

Download

memory/3556-343-0x000002D11BEF0000-0x000002D11BF56000-memory.dmp

Download

memory/4104-392-0x00007FF698300000-0x00007FF69863E000-memory.dmp

Download

memory/4104-390-0x000001CE89560000-0x000001CE895C6000-memory.dmp

Download

memory/4104-393-0x000001CE89560000-0x000001CE895C6000-memory.dmp

Download

memory/4104-454-0x00007FF698300000-0x00007FF69863E000-memory.dmp

Download

memory/4292-56-0x000001BC204C0000-0x000001BC20581000-memory.dmp

Download

memory/4292-61-0x000001BC20700000-0x000001BC20766000-memory.dmp

Download

memory/4292-60-0x000001BC20700000-0x000001BC20766000-memory.dmp

Download

memory/4444-26-0x0000000000090000-0x0000000000236000-memory.dmp

Download

memory/4444-0-0x0000000000090000-0x0000000000236000-memory.dmp

Download

memory/4444-1-0x0000000002B70000-0x0000000002BD9000-memory.dmp

Download

memory/4444-7-0x0000000002B70000-0x0000000002BD9000-memory.dmp

Download

memory/4444-6-0x0000000002B70000-0x0000000002BD9000-memory.dmp

Download

memory/4580-372-0x000001E61D230000-0x000001E61D296000-memory.dmp

Download

memory/4580-452-0x00007FF7200B0000-0x00007FF7205B6000-memory.dmp

Download

memory/4580-371-0x000001E61D230000-0x000001E61D296000-memory.dmp

Download

memory/4580-370-0x00007FF7200B0000-0x00007FF7205B6000-memory.dmp

Download

memory/4640-325-0x000001D974EF0000-0x000001D974F56000-memory.dmp

Download

memory/4640-448-0x00007FF6AF000000-0x00007FF6AF2A2000-memory.dmp

Download

memory/4640-324-0x000001D974EF0000-0x000001D974F56000-memory.dmp

Download

memory/4640-323-0x00007FF6AF000000-0x00007FF6AF2A2000-memory.dmp

Download

memory/4688-355-0x0000027E3AAD0000-0x0000027E3AB36000-memory.dmp

Download

memory/4688-353-0x0000027E3AAD0000-0x0000027E3AB36000-memory.dmp

Download

memory/4688-354-0x00007FF6C0370000-0x00007FF6C05FA000-memory.dmp

Download

memory/4688-450-0x00007FF6C0370000-0x00007FF6C05FA000-memory.dmp

Download

memory/4716-263-0x000001EBF5A40000-0x000001EBF5AA6000-memory.dmp

Download

memory/4716-262-0x000001EBF5A40000-0x000001EBF5AA6000-memory.dmp

Download

memory/4716-245-0x00007FF65C010000-0x00007FF65C0D8000-memory.dmp

Download

memory/4716-331-0x00007FF65C010000-0x00007FF65C0D8000-memory.dmp

Download

memory/4772-315-0x0000020EC5FE0000-0x0000020EC6046000-memory.dmp

Download

memory/4772-313-0x00007FF63BF80000-0x00007FF63C033000-memory.dmp

Download

memory/4772-443-0x00007FF63BF80000-0x00007FF63C033000-memory.dmp

Download

memory/4772-314-0x0000020EC5FE0000-0x0000020EC6046000-memory.dmp

Download

memory/4836-333-0x0000026BB1730000-0x0000026BB1796000-memory.dmp

Download

memory/4836-332-0x00007FF612420000-0x00007FF6125B4000-memory.dmp

Download

memory/4836-334-0x0000026BB1730000-0x0000026BB1796000-memory.dmp

Download

memory/4836-449-0x00007FF612420000-0x00007FF6125B4000-memory.dmp

Download

memory/4880-362-0x00000218616F0000-0x0000021861756000-memory.dmp

Download

memory/4880-451-0x00007FF6CB600000-0x00007FF6CBAD0000-memory.dmp

Download

memory/4880-363-0x00000218616F0000-0x0000021861756000-memory.dmp

Download

memory/4880-367-0x00007FF6CB600000-0x00007FF6CBAD0000-memory.dmp

Download

memory/5232-30-0x0000020649840000-0x00000206498A6000-memory.dmp

Download

memory/5232-32-0x0000020649840000-0x00000206498A6000-memory.dmp

Download

memory/5232-31-0x0000020649840000-0x00000206498A6000-memory.dmp

Download

memory/5232-29-0x0000020649650000-0x0000020649711000-memory.dmp

Download

memory/5400-380-0x00007FF76C0E0000-0x00007FF76C18D000-memory.dmp

Download

memory/5400-296-0x000001B744AB0000-0x000001B744B16000-memory.dmp

Download

memory/5400-295-0x000001B744AB0000-0x000001B744B16000-memory.dmp

Download

memory/5400-294-0x00007FF76C0E0000-0x00007FF76C18D000-memory.dmp

Download

memory/5404-238-0x0000022CC8CC0000-0x0000022CC8D26000-memory.dmp

Download

memory/5404-322-0x00007FF65C010000-0x00007FF65C0D8000-memory.dmp

Download

memory/5404-237-0x0000022CC8CC0000-0x0000022CC8D26000-memory.dmp

Download

memory/5404-236-0x00007FF65C010000-0x00007FF65C0D8000-memory.dmp

Download

memory/5484-268-0x0000025C310A0000-0x0000025C31106000-memory.dmp

Download

memory/5484-264-0x0000025C310A0000-0x0000025C31106000-memory.dmp

Download

memory/5484-352-0x00007FF651470000-0x00007FF6515B9000-memory.dmp

Download

memory/5484-260-0x00007FF651470000-0x00007FF6515B9000-memory.dmp

Download