39dd10a1ac006c43dc1d8d57822cae95f3be7a2e2dc435dae6e380a5d83980dd

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260720-c7d1vacy9n
SHA256 39dd10a1ac006c43dc1d8d57822cae95f3be7a2e2dc435dae6e380a5d83980dd
MD5 aa952a25cfd0f611f0b15ab5c6168a21
SHA1 d22bf29af13c0162426ebebb5f0f781b1b849537
SHA512 9fb4f94ae19367472da56af1e88424d8340e7371c8067bb73e73bf8bb2c25b8e3d8babd38907ebee9bdb2650a7b63dfa97991a2e4d577b031d7860b715f4eaaa
SSDEEP 24576:OmewsAj5t/px5fIW7guzjGB7HtTlK7/g:dljr/LpIgpzjGB7N5K7/g
TLSH
T13515E031FE75E032C77F0DB61B25C71A143C7A204B611AC7E3E85E9D5A242D22376A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2152	alg.exe
5300	elevation_service.exe
4100	elevation_service.exe
6084	maintenanceservice.exe
5176	OSE.EXE
2460	GameInputSvc.exe
5148	GameInputSvc.exe
4720	msdtc.exe
3704	PerceptionSimulationService.exe
4776	perfhost.exe
4116	ReFsDedupSvc.exe
4844	locator.exe
4932	SensorDataService.exe
4480	snmptrap.exe
2984	ssh-agent.exe
1152	TieringEngineService.exe
5852	AgentService.exe
2240	vds.exe
2856	vssvc.exe
800	wbengine.exe
708	WmiApSrv.exe
1984	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\84744d0d238bf42.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5148	GameInputSvc.exe
5148	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6080	2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	2152	alg.exe
Token: SeDebugPrivilege	2152	alg.exe
Token: SeTakeOwnershipPrivilege	5300	elevation_service.exe
Token: SeTcbPrivilege	2460	GameInputSvc.exe
Token: SeBackupPrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1152	TieringEngineService.exe
Token: SeManageVolumePrivilege	1152	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5852	AgentService.exe
Token: SeBackupPrivilege	2856	vssvc.exe
Token: SeRestorePrivilege	2856	vssvc.exe
Token: SeAuditPrivilege	2856	vssvc.exe
Token: SeBackupPrivilege	800	wbengine.exe
Token: SeRestorePrivilege	800	wbengine.exe
Token: SeSecurityPrivilege	800	wbengine.exe
Token: 33	1984	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1984	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1984	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 5148	2460	GameInputSvc.exe	96
PID 1984 wrote to memory of 5020	1984	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_aa952a25cfd0f611f0b15ab5c6168a21_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6080

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:6084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5148

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3704

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4932

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4480

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4487bcf8acad4f093317828629ce8f4a0125decabd824b3fea6d61f270b5dc0a
MD5 cc9c12c34423eb4de1bcd5b072ad8782
SHA1 00085c98b24479cc82275bb15b6f47aa1dbb66d8
SHA512 b6a180734c1faa2627e0df4fc92042ed7ae535db035f2c7ca09072f352af6127b36a32b7cd5bf2a17e52828a9840f406434ba3f557d21e285c8f0ded95c8d05b
SSDEEP 49152:Yb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnVL/LpIgpzjGB7N5K7/g:y3q6gjByvxzj1/
TLSH
T133D59C03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 2a35f15d9bc32b832a2ae7d8414cc72351603938475c993854b61dd83902b06c
MD5 921b1a2e2a1b11aefc1028edd58384de
SHA1 94e0890fa11f156a8a3cf0a385ae491b874a091c
SHA512 312e001ff4de3a7a90a360fcc345b4fa1ccb87aeedb1698c34621fdff525a2c9219f4ed6a418ccb1f8300f917fff5f345646a19b10d0bbf0457d53f3921fd750
SSDEEP 24576:AXYPEtczA4t/px5fIW7guzjGB7HtTlK7/g:Atch/LpIgpzjGB7N5K7/g
TLSH
T1BD050128B7D505F9DD6BC23DC9A18505E63378454760EB9F03F89A691F233881E3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 391c99e45c35cd633d7329ad41b9ae3f1861479f48c544983ff487f6c4a24734
MD5 54e036cd6f7cad5635696562de2357b1
SHA1 03deee63b5844e22c70cb7058faeb151521329be
SHA512 cbec3deb293b56a3685f5cfdd07703901abec03055a438530829691539b6d8b4f717d331338ee19aeb7049aa8ece9182eda1dcaa66a3eb649dad5231c149d80a
SSDEEP 24576:r0NebuS0gmxOrMYt/px5fIW7guzjGB7HtTlK7/g:rLuS0voF/LpIgpzjGB7N5K7/g
TLSH
T1D735AE56F6748331D073C0BAC5D2A68EE97130865B308ACB0296D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f6ab43b424fc1132669a81973688ea98383d2a61ab303df46f9c924c4410ca41
MD5 a0fe3fb907ff35c8b6afe3f5a2875583
SHA1 7643023846776aa04e290a15ded21e61e61459dc
SHA512 1638046baacca76bc2ce9997b8639ab189ea40a4db9c24cfc4e66fe0858d558300939bc2f4fcadd44d608465f91cf58bb9ab543cfebff9662066904133c7903a
SSDEEP 49152:6/ezSC6vUzPvuHjyu/LpIgpzjGB7N5K7/g:uezSC6v2XuHvxzj1/
TLSH
T1B0756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 da521d17862ce934893f02bd4fb41bc75da5030b649fb439a2db8e41defa9eb2
MD5 31267ca193b24a293bc3a53dfd22bfd0
SHA1 585ea50999a4d9fb956825ef4ea5459df35344db
SHA512 e57b3d07d9c789dfe5a09c8d563f5b1d35f36316701e86d16d25204982b852d4214fe903405f5ff074b61ff79bf37f073b69df28599006c02c2f6af68f37b233
SSDEEP 24576:7AbNPV4R9v/l+dZt/px5fIW7guzjGB7HtTlK7/g:7An4R9Xl+Z/LpIgpzjGB7N5K7/g
TLSH
T1D6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C2F677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 76236de829c71205458705736542eb158028b9072b8f5dff6f4fa89afc20957c
MD5 0fcbcdb10382e4391bbca8e9328db582
SHA1 381026705283fa4ad9e325d9286854a936218676
SHA512 3f17daafeb59dc1247da330dcaf7d54251d4e4531a33e6e19d1fe53809312015b04615cc9e948174f232afc6c7c60294c669132ed2864209e76fd3d31040c316
SSDEEP 12288:Qk3kUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:Qk+t/px5fIW7guzjGB7HtTlK7/g
TLSH
T1CED423DDE94A1211CB2CDF7F4B94585C14303E0657648E9F2EB87EA81F2E10D41AABF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 3f5aaa1ec7fd0a1bc2f613afdbbd87f3acc62a4c7f055926b50fcdb4a2bc1333
MD5 a2bb9c8ea8b7eb049c81fee4497ed4f7
SHA1 822db9e3ff6135020b228049b566b7105c591624
SHA512 587429a76d1cea7a451d89a391c862e16fecf97481bcc98e1caea2e312dfcdede3561593f9accd09990b2f485cf4896d25fa03c88429481f6040a76dbd575f8a
SSDEEP 12288:SeBNUbTVO86U3UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:SJIUXt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1F915DF7BEE28FCE2C27E8DB95B918600977278304B61A3CBD174830D9E135E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 295c5ec086e0cba9d13623649c98ffc6f4062a1671c1c9cc6b3338f9fcf72a0e
MD5 2393ea8867f97beb78ea5783e6cdc801
SHA1 fd4f290740ef59e846d084f241311f2946780928
SHA512 ad04d889754357101e77d9bbd73423d26d67758d9c2be1aa48b0069cab9868d058b073e4137dccfa3916013159f40fdd2adc8a67835fd7b5f67090adcec3c097
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5JYNRV3THN:XQvGAdlCEL8c/bRNM5CXxzj1/
TLSH
T163367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 3c6dc2d509f1f6aab06e270e726011b8517a3ccc01fec9f63985d3ecfac4ff26
MD5 b0ed0e40d91cf49c475902aeb80dfb0b
SHA1 159a759d327764e241a2c808f34e915008c24996
SHA512 84ae4bebb14bafece9b74917144b2f67c86e24d104b1ace5a16771a7de2c55ef210c1f39cca4fccf270e31eb2d7b3dec4bbf29ecb3bd96ba592e06a4d29fa348
SSDEEP 24576:SmewsAjyt/px5fIW7guzjGB7HtTlK7/g:Zlji/LpIgpzjGB7N5K7/g
TLSH
T1DC15E031FE75E032C77F0DB61B25C71A143C7A204B611AC7E3E85E9D5A242D22376A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a160c4d5ecc091fce94726a43766d9fa4b212a898cc7d3a9c8274dc2892e51b9
MD5 1cee36fcb7cc345c4a3ec3a65d36fbc4
SHA1 1755ba14a66be7a9a8660adbcb8edb83e23105f5
SHA512 95bdf93d3f0a35490c1ab56bbc82ef1b3a5d2f97560d390c49201461d88eea4d86ae042206f3361138ed874478021bd934ff0229c0a1d98fc870e6056a1ca25b
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrfdPlbuJHVxzj1:xUEtQevvqc2W1cpV2Xr12d
TLSH
T1CF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0fcb750ea1f9492188d59771bb0c328d4e8a246162f30ca4866bdf2b41290d2e
MD5 f133e6e16d3b493f74063a541b8ddb22
SHA1 425110413ba35e78ad92a527528a4770533abb31
SHA512 5bc53d3e33ba7f108405bfffca5d8974c7f1da0ea110df1b3bdfc891667fc0fb2f220789fe9b636b2ee0bf36a82b56d799073aaace49eff9bb442ce9429aacc2
SSDEEP 49152:e+bRquA/m2yL5zMfFiV+XenmE3/zz/LpIgpzjGB7N5K7/g:Loq1VjnmExzj1/
TLSH
T1DED58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 33b55cc685c4bec8409edfccb1b31c74b6f0422f37ac50a4872f0eff5b86d10f
MD5 3ab1e326f3902819940f71da5366f7a8
SHA1 2aa97b7cd40ec5cc868a36c093b27730a067ab98
SHA512 918b0eb51d5573091687b39a13c9ed277933c58c1aa30b6c64eb11f05a121e72d51f1cf29156a7d7957db6b0c5eb517f7adb0418f60671480922d29b8c7a866c
SSDEEP 24576:BAhGLv1FoiwtA5l7S53/st/px5fIW7guzjGB7HtTlK7/g:BAM5Foiq5I/LpIgpzjGB7N5K7/g
TLSH
T12F45AE80EBF951D4F5B3AB7899B69570EA76BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 a7312fbc30e67fb8074cc1e53040de1c5a4fbdcdb11d342691e3772528952764
MD5 299e57edfd658d09864ab075814b7b02
SHA1 4247c4eb66d0c3baf0fc8438a5108598c6cf7902
SHA512 f5f667199c2bf8f4e0ea3110506a1626c78c4e5b3c511d509d37c048e4ede91edc2000334097556f9b709fcf26a2ca6d7ad0138bf3013415353748d38250a631
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CvUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGpV:Owu+OWat/px5fIW7guzjGB7HtTlK7/g
TLSH
T1D705014976D40CF9DA67863D8697C536F7B2B8022B21CB1F1770C65A2F273216D2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 41921fc1a18ed236992a5c23c295d3851cea835ccfc790466cafd6b5ed00e841
MD5 fe4eacd128f49e097a4bcf26058dfa9f
SHA1 edc444f764967287628e2401eea4759aba31e383
SHA512 6160bb1cdee19b0c9b5bf4eff34b84e22bf802aa8b03de3af30ac83593265ab62c3f3df5fa0b5ea2885ba602aa45f9d220f6aff428b6c391c01b60292f3be68c
SSDEEP 12288:6rF1I9HUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:CFu1t/px5fIW7guzjGB7HtTlK7/g
TLSH
T166E4129D76C821F5C366DA3ECAE05A49D3713457273183CF1A780AA82F276C91E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d06ca4d8f9e7054af14ed2070fe35c324b24fb6069487ca868720877f4ead903
MD5 9135c7e1c8e9bd37c0452f44d0150c6a
SHA1 cc34ca342afd46782bc14c458bba5dbc0eedf15a
SHA512 5df8990e897d582bef6fdc6daac412d465b88af0eca8e04363a0a032ee0c2a06ba5fedc50cc3f4582a99cb952afdcffb1425d8f726cdacdb2e299170b1aca719
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UH:+QRQyi36YOcP8Lvw2gAf+PN3sxzj1/
TLSH
T1EB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3ca80caf78cccaf556e1d51fe4402e8172d7f60f9bf5ce02bee38955e93d7261
MD5 75e54b5cab5e2076255e10eb82dcc16d
SHA1 e0858c2da9451397e1114bec72a8b90fb265a8db
SHA512 7d84a2fbf856084874929d2dd9dd4ef6158adbed2d7c95df264dbf42ffdba4a79934bda1ab17d9be631b05dfb468abf0aec43eb53b36bcc654b0ad60b43139e2
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UO:+QRQyi36YOcP8Lvw2gAf+PN3hxzj1/
TLSH
T122667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6465c06e5da33c92e4ca47a86d939af4bd4e751154c1a03c5b05ebc9b3a7cc21
MD5 2c5f9b56f619d41ee3a05b60324dd7d9
SHA1 bf086cedc1138e457ff04cfc45e0cb18a50294d3
SHA512 ec7232cbc9241aa221dea22c9dcf0f5b711ab1daccf54354ce2ea97c2ea106935032b1cf4f5330883961dacdf26fbe451bcc380495444260bf5f268c8559f2f7
SSDEEP 49152:W68Qg55nhMeWu7PNU3/1/LpIgpzjGB7N5K7/g:0thbRc/9xzj1/
TLSH
T1D3B55A33B2F600A9C44DE1769F4A872196E17C758FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a78d326f88cd6472533b9086dbaf31fb5f88db922f3e64ffff65e27a0380f436
MD5 545ccffc44aea6aa9548dbd794533960
SHA1 7ac28ad1e95de65229141ba43cea16fb3c8f34af
SHA512 95eaa04291fade5858365795619d4095246f2d46211e39e0a4ca9e4ced09d7caebb8142dd1377a28810629e045cc483ff62d1ccd05da9b66ecafc1823c71d62e
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99T:ny5112gYy5azzVv569nLKnhZRxzj1/
TLSH
T12F168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2d0cc7f19c55ac3a61f7eb384b4d5497a601ae73e0cf31587ef550107e3c5021
MD5 4cf9899f4e2b66b30a3ef1ca72e47d86
SHA1 2d716f3ae6f7e7110b3f0264ffaf6ceaa4e678f6
SHA512 207086b005f76a50365dc478806c0a7f73139f37957f1b6f4804e7ea0cc1a0ef484599a26d956471118cbb7a6315dd2b74808843d0d46914a58ee3c5dfa7d64a
SSDEEP 49152:SB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glC/LpIgpzjGB7N5K7/g:gu6JmTxd2dyxzj1/
TLSH
T1BCD59D13F1DA01E8D06ED579874A9233EA62BC490B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b96f9129758380d3c65ae5df9b9ff2f3731f5e51ab0b860b00aa989c806a7f65
MD5 29f5bdc400a4b4a3a72404efb9bbd73d
SHA1 59e4a66909aa905c716b207b8b344c8a81ff72a4
SHA512 902ca3eb55956a2ad9c7d501d7707b7a0acc3fecd2e4d523ec8564bd5ff0550c0c1157bc8d77df6e346f3223f21ed09d7265117e45707141bfad2730ec5da247
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4x2/LpIgpzjGB7N5K7/g:EmifPbRrxzj1/
TLSH
T1ABB5BE13F2D901E8D06DD17887569232EA72BC460B34B6DF0A90B7961F7BAE45B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 710ebc787d0bfaf2f9b170c61eb7e5e34d6864041f7e5980d9b1037ce616214c
MD5 ff0251a53bc7a75fc381b6b1ef4f7395
SHA1 6cd06965e5df2d82cef8b308bfb004f1d4f6ffba
SHA512 2c450dbaf4199d306e86da8eee99c92dbe02a4007980d102dacbfc49d368d2e65b132d495cea743c32e046485c9396cc53b281a151e80c66a533a4e3e5e0bb0f
SSDEEP 49152:uSuZQIY0Be2K6RVtOnks6NMHqa/LpIgpzjGB7N5K7/g:g5dKoi61qxzj1/
TLSH
T148C5BF03F2E941E8E0BED67887659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7ee225bd24366bf40b0548ca5a8f128a8cd19cb56cf7acb0ab8b472d0a46edc3
MD5 0da253baa8f3364739de64cecfdd94a8
SHA1 d703fe90d5c02f70cea37e61f505181fb6ba249a
SHA512 d44f424e3757a7f2a0a8378bf1c3ad9a74214e15ff1a24742f16fb19ec7a46a711f041086bb833ae72f8b91409c5a77e1e0059ee9e56526b14d0a7f36faef473
SSDEEP 49152:xhtSn8EApI0figTgiDn0AP5wL/LpIgpzjGB7N5K7/g:gX2iyphCxzj1/
TLSH
T18EA5BE13F2D901E8D05ED179C7468632E962BC060B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 eb0756a513e9c7e6b54f6451168d64bd5579620cf2c2cbeb81f5b21367dd114f
MD5 aac1ea0d4bcaf4af6649635b0b61f269
SHA1 ea1676104178f7bd5807364ec47b254e1cd67792
SHA512 c3d5b770f7bb0eca1967a399500dc5f86d8c57a8fcdbff17e6c4ccc4061ad008c22e5071e53f524ca1f99cfc7f186bca4659b7d28d300cc558e8f0acc70d6170
SSDEEP 12288:p6FUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:p6Rt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1B8D4239DE88B5215C718DF7F4B90598C5430370B67258A9F3FBC2E682F5A10D11AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 734951a0a53ee4cc57b588d4464f852a47dae59a9be02f06e79e7c4e4b02256b
MD5 3938645365855886e3d0fdbf70d40446
SHA1 08ab54b80493c66cf4dcd92a25b8cde00ed33e37
SHA512 200df7916bdb823589becc7df141abf5ca99faa2d3199a159c14daf51dac239d4b879dd9a6468d57c1435562fb0648e0cdfcdd468281c0a84bf48b8dfd132a35
SSDEEP 12288:jmUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:jUt/px5fIW7guzjGB7HtTlK7/g
TLSH
T186D4239DF88B5211C718DE7F4B54598C5430370B67258A9F3FBC2E682F4A11D12AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 7807d87765b7e5be01ece35ebc367659d14b128affbdd5986b0b4d3237dfa070
MD5 a56c724bfb4e07228e0f2be41f920387
SHA1 96462d2631b58d7c0840f01c69b14cdf0aff2356
SHA512 57830ede2bb39dd2dc85ad1d7ddbd27f6944d48b43c367898e41a00333996a6e73e59dbd568a737fbc6552a2cfa6a8d075286cdefa96ba79a4b3ab4d975df30c
SSDEEP 12288:tLbUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:tLDt/px5fIW7guzjGB7HtTlK7/g
TLSH
T186D4239CFD4B5211C718DE7F4B54598C5430360BB7658A9F3FBC2D682F4A10D12AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 fe2caa9d8d8b728eed8fc6cf9fa68632e272e4eb890bc85a68853837fb0e6be4
MD5 cba94de0fd6d4b7fc8d7e14c7d3add6c
SHA1 57703a6608f05c08d40fa2bdfc0dfad7f8c8cca9
SHA512 f42edef6027301c2f2944526e5118a83d3278f66a0a350a12e47e0567f31c41e0a79fee68b2dccebb12f600138fcd60216c2a8cc2283ad34338f85cef90a9337
SSDEEP 12288:5leUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:gt/px5fIW7guzjGB7HtTlK7/g
TLSH
T19DD4239DFA8A0291CB29DF7FCB60554C90703A46A7318B9F2F681D681F6620C1579FF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 b19e054b1fff2b62ec5664546210ac90913505d455f543723c6683494496bb5c
MD5 1c6e9e412e74cdcdba08da83ad5d484e
SHA1 0e92a8ddd7a7625786dd626b6468d268ec2f1b67
SHA512 fa9adcea39205705b88167032fd326c1fc8adcb3fd9c25bfa63c7f224d9fc88b89e526e511b1cfe1217d022c8917c84fb3b6ae29243349cd29218e264c968ad4
SSDEEP 12288:s0wUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:s0Ct/px5fIW7guzjGB7HtTlK7/g
TLSH
T1EAD4239DFD8B5211C718DE7F4B50598C5430370B77658A9F3ABC2A682F4A10D12AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 7e28ff32fca143cc29a41b595e03726f6e55d1e34892b0d7a11a266c1255739a
MD5 5cf6474336a979b60ccb7a3893171a43
SHA1 fd34e2d00c6cb8b9ab3722617addd62fb883a703
SHA512 73aaf7eb0ea00e70e7b4bcc068aa75a9b240ecfceb4bcb493df1236df8b7b779eaefa5e10a77dc64ad40a1c1ccf7cb0818bc075c9cee09fba75cfc823e80242d
SSDEEP 12288:vJUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:vtt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1F3D423DCFC8A5321C718DE7F4B50598C5430370B77258A9F3EAC2D682F5A11D16AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 69f707643570cd481b18d575512d59689d63317b40e3f88b0b5d6a28a738a6ef
MD5 9e0339dfb1a2478233f937234dd9f6a6
SHA1 b842e2789b5e8b66a131380d05e889528bcd5845
SHA512 b9742d618f3b85d93fc861eece491901aa01b85aee8e81ce59999f09eb02894be944f5c29853c7a24e5d7ae76ca0262230901925fb12e471b6fd7c7f2913d1bc
SSDEEP 12288:GNtUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:gZt/px5fIW7guzjGB7HtTlK7/g
TLSH
T191D4239CFC8B1311C718DE7F4B50599C5430370BB7258A9F3EAC2D682F5A11D11AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 e5f3edd77bd796568cff9aa1717578d3e79be4148125c267429ea944fbdbbdc9
MD5 4be2f9f932e2afd40880b1870c24fee5
SHA1 4520f18f17e35630a5aa5d4e942e4d3b66308edd
SHA512 1c12c78dc87b8c80872a0d7962f0dff85f79ebb4af37b04bd97a67ca2541cd08b5e6dcdd6cac82785ae449bdb078c270409050348c89c2525e3ab63be3802a47
SSDEEP 24576:BZMWzFVSu3t/px5fIW7guzjGB7HtTlK7/g:BZMWzfp/LpIgpzjGB7N5K7/g
TLSH
T152150199B39018F4DD67863ECA558909D1B27C1A0B70CA1F17F8366A1F333611D2EFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 4c6a37fe64375776af37e4c4a1f35812b133a27fb4ea8078a0910f2bedbe0324
MD5 9e45e40408e18c83de339ceb2dc1bed2
SHA1 56212adae68d6c98080bd45e8894c4d64fef5ca0
SHA512 99f6f47c9bf4c935ea7ca9d6f4e4c4ef762840b25ede21188dd1fc62ac3b4e4ddb21921e794a1203b911c70fa52122335834671f0e3ed695af21023d80cb428f
SSDEEP 12288:7fO2UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:TOEt/px5fIW7guzjGB7HtTlK7/g
TLSH
T148D4239DF88B5211C718DE7F4794598C5430370B77258A9F3EBD2E682F4A10D12AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 e2866084706f05b91308e7ac2a02bd36e058d0b0481a31760e9acc621b8af0e7
MD5 8ffbf239cf8f6b2cd5ee9e77b459cb25
SHA1 e9fc2450c79c70a89719e8252f040eef5cabe14b
SHA512 56a098ee58e96dd61c1eb46f729f7fb3b8c462b4c863572afae2c40440fa0a4e45981cd9e4ee99dc19a5e0bbf92a5a4cb94cf51ad4e052f18a0e099cb2449cfe
SSDEEP 12288:nx9UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:xJt/px5fIW7guzjGB7HtTlK7/g
TLSH
T12AD4239DF88B4211C718DE7F4B94598C5430370B77258A9F3FBD6E682F4A10D11AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 15e2fc509d700f9617a7a4d9f9760ae68283fcb671da6efde903dcba2eb265b4
MD5 56dab93fcc52b27d3dc7eff09fe7afa7
SHA1 afdbc5c35d3ce21ab060b6c87a1dc66570dc2d6a
SHA512 72910635692ebaad05980e3224c96ac451881d09dc6890eae595351c64266dcb82c80957d0ac5aa62cd8353b30360a78e67cae541215f923818353b8b44a4477
SSDEEP 12288:lMPDVLnbUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:6DFDt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1FEF4124BB69631F9C236D63E89A11905F371783617208FAF17A40B792F272545E3EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 490288be21a1c9b04f01d518a8d395d07e66722d89610ad9e9f89c588407a243
MD5 a45945052f28f1c05fadecd0443bfff2
SHA1 550a121f4a9975869ea1af506f9a67350e6e84be
SHA512 8a77ee023c5c6ecd7beabbfcc96621acc6610930f705efd7ea2e5369b0a43b3fc0d68f0d3a6b56c30e1d7318de4e8fbef33df5cdfa76ada888e6a18df8305c24
SSDEEP 12288:lJOUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:P8t/px5fIW7guzjGB7HtTlK7/g
TLSH
T1B6D423DDF88B5211C718DE7F4750598C54303B0BA7658A9F3EAC2E682F4A10D11AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 436826f5b9261aabac6604c05ca849cd37bf556c592cf2a252368d1ed6caad73
MD5 5e15dad059dd8d34db1b8ee9d0ff19da
SHA1 c32b74b4541c09a07e8ee66d45d43506d1c914a0
SHA512 1f61f0bb07fa5b7c07284aefd9b988403f58d29eb50346dd3eab3ccc6a67a6c101f7cc936639b0133a9ec2f31939409702c1caef20befdcb95bb03a123a0791d
SSDEEP 12288:S46UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:rQt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1C7D423DDF84B5221C718DE7F4B90598C5430370B77658A9F3EBD2D682F4A10D12AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 51bfd155e66ca70bf9d0637c01fd45125fdc0466369af355c07ead775c9ddf09
MD5 6a0e097ef80123a920c07805b5e8560a
SHA1 5a33c88eef8c31d57ba7677da3454577c0edba67
SHA512 3a53a8278b1a6b937eff8845df994284c814bd6c83a4637a074e02be74ac33565207eb45e47e8a8795544c15fb2c3675d1aba7ea21c1f02b25775d184b94c5d4
SSDEEP 12288:EMPDVLnGNUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:zDFEt/px5fIW7guzjGB7HtTlK7/g
TLSH
T102F4024BB69631F9C23AD63E89A11905F371783617208F6F17A40B792F272545E3EBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 edc41657632d630bdd68a09bc74c4f667507a9dbf5e02137e1538fb61deb4c05
MD5 e4c4689870ce32ecd3e430742fb9efce
SHA1 05d79e2a7ddf00d80111d5cc44e242646ae7a9f7
SHA512 dfec7a51a9fb2689d4c984a6e8f91049a8ecf1bb17692c5dabdb972d9366d96caa2d02877e7cadcde50ddcbdd49121da04b86e963199c1e053a4a7e90d98ee83
SSDEEP 24576:cTJaLl3z0z3Ct/px5fIW7guzjGB7HtTlK7/g:cTULljT/LpIgpzjGB7N5K7/g
TLSH
T111150198B39018F8DD67863FC955890AD1B27C1A0770CA1F17F83A6A5F333511D2EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 b2ee2c102502507f254ee9c3010cf1197c809991735a76d5b94fb711f030485b
MD5 865bf15e162b495c22b572e6bd868a5e
SHA1 3e916f721f02b83a01cadb46f1ddae144ff25300
SHA512 2be345bcd9d1d0158b420c04e0e576d2fa097d2fb819f9819a33c4946d42cfbf991213b61aa662d01179de36e22656e1f9073f3f0ec9b9554e47d25475cd2eb5
SSDEEP 24576:P3DdkCHKy76KPt/px5fIW7guzjGB7HtTlK7/g:fDdkCHKyui/LpIgpzjGB7N5K7/g
TLSH
T19435CF94F3E410E8F1B7DA3989765511DAB67C5A1B31CE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 2608dd491d435fd823014ea38d46bcefc8e233e9532ad81c856007a7b8a1dee8
MD5 bf103f01ec692ed4dd16ea00bf43a919
SHA1 3c6285b4153679f7e5c3a1d5fc82feaeb354a3e4
SHA512 f28e6f4d68e47a2c8f9627d9f982419802d6bf99f41c63af6f5893ecb4d6fc805042207bed476bb860928af8a98084004d52aca4f0a33cd1383f11b1adf0f441
SSDEEP 12288:rjUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:rLt/px5fIW7guzjGB7HtTlK7/g
TLSH
T144D423DCF84B5211C718DE7F4B50598C5430370BBB258A9F3EAD2D682F4A11D12AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 a44f6903a399265c62cabb626c93368f59767cf4294bf6117e3390c5d2368350
MD5 e742cf012941ad5f42c19442b518d955
SHA1 271bfa3108d91f755ccf63b101076f832e99fd7f
SHA512 f46f523f3adb2b93d0004184ccb3117ba715a454880e5f11427b9423c912860821ad80b0f4297dc06cf7f03095fd4e4141409bea796ee0777a2d239f2b51cdcc
SSDEEP 12288:pxRUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:px1t/px5fIW7guzjGB7HtTlK7/g
TLSH
T130D423DDFC8A1221C718DE7F4B94598C1430370B67258B9F3FAC2D682F5A11D15AAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 1df848231218812d4095e04db2dabec2ee761fe738feb6c2c152f62ef7fceba1
MD5 c9f133939687aa674a86287ef9b4e1af
SHA1 e2bb798afb73d7325f996b5d1cea2ff545f12b06
SHA512 22322617ece2a0474a267e017b6b2d5cbb71605677cb6ea35064d66b6509868d3cb70eaa3d4827f7145406f3773b5257c069866dee0f4327ad4fdb65de626583
SSDEEP 12288:gPvUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:Wvt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1E2D4239DF88B1211C718DF7F4790598C5430374B77658A9F3EAD2E682F4A10D12AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 398569571821a255aba129067c34632f6e48c5d0cc9d8bc43fec713b59e1221d
MD5 5e9c7e6bce72259b6fc00a7de76fd274
SHA1 4dbc37459a020c9c49e88be87a2a9c045f109c39
SHA512 6003c06ae248dc8dea2bdfa3c0c79fb798e57fec0183075942ce8a30df0c0c5eca411c2be38b66f94484cb66fbd89a74cb1565890ced185d910d8a6743eb1a2d
SSDEEP 12288:5DaUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:dwt/px5fIW7guzjGB7HtTlK7/g
TLSH
T167D4239DF88B1215C718DE7F4790598C5430370B77658A9F3EBD2D682F4A10D12AAAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 b1e091788205a0a8ea205d3932fd4057e35f449188bb5ff94dafb6063a3b5dfe
MD5 3f3e10db99dae967bcf5468d8a74b458
SHA1 e9ffa5f7db68a09d65e34509dd5373780732b975
SHA512 51c3647c376188eb94480765e24cd56b833d38c18252cc1dc3e92263e0f48e8596ed2cba3ca4afc9f7a302a7682b7dddb89af1e8f07402854a4f3b45fae5706d
SSDEEP 12288:6PsfOWUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:Rvt/px5fIW7guzjGB7HtTlK7/g
TLSH
T110F4F149E28802E8C12EA67ACB554A44B3333C2597E1D3CF26D0F93D1F3A2545DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 7156725b8c73df538bd714c95440c9f2a776bc3f04adcc80540abf0cf567f660
MD5 063220ac26259cd4cc421a6bf05974cb
SHA1 39d9a91eaed80e7cbb4fa09610bf9c3a06021a34
SHA512 9a0b6da7d2876c9f69916331708e1ae6157219f7460c0b62e6443cf991ffaf5c82237d2ab679696431820d52df1630baa9594340d0439b6c04b5230e4b8a6149
SSDEEP 12288:Bp70UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:P+t/px5fIW7guzjGB7HtTlK7/g
TLSH
T104D4239DEA8E5211CB3CDF7F475454182035360A5B14CADF3E6C2AA82F2A14C49B6BFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5306cb66367ced6547757b85d1579766f0c8f01c34a7911c4adbd60413f82687
MD5 d08fdfeb22d6927f71bae2b4b620a2f3
SHA1 dfc2ec67d58ad786ca1005dc5a89e498157fe56c
SHA512 9c7d9a0967d66fa1a0167a6974e0ce77e8c9367d0f81ff7c53f499e5f27ed2363fce213c1504fdf8a483a956801aee03791eb38a3af0787b1c0c8ab21341543f
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYYt/px5fIW7guzjGB7HtTlK7/g:7gb4mBIBhGFj/LpIgpzjGB7N5K7/g
TLSH
T11465AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 964891be14377859fdd263e710a6ae8d9902e45cad968903dce8158b85eefa61
MD5 b6e273176efcf4a0e93e7dca443bd4f3
SHA1 99f741666a2a5d9ae5d3239926a8125d12c40231
SHA512 b6b7d32305996b34e9fa54bdbdc0f09561705525aea2f0b5f89f635ab5776c98a1aaf9bcd349f2cfa6c74cd6037a63060d21412067842cf07ef990b5584bc09e
SSDEEP 12288:KsGVUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:PGBt/px5fIW7guzjGB7HtTlK7/g
TLSH
T125E423ACB8DA3154CB3DCF3F4A60545A7470321167245AFF0DE8A9785F1A1D8223EEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 9f34ea5ca24ccf30e941478690abd309fb4b22f03497b0c6b203bd168480a521
MD5 d742c894fa8e72870477413be0de0353
SHA1 0f667e43a6e08afd6c5337154c50c5f6f9b1a054
SHA512 b32e8f0387a92d4b70789d48f0bb9b683a92073902e878fa649f63eeaf9855c58a821ae87ff299efca1eddb4858c7554e238c6f0cec3b980dad822cd3d40271f
SSDEEP 12288:5JUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:5tt/px5fIW7guzjGB7HtTlK7/g
TLSH
T1A9D423DCF94A5211CB28DF7F475058581030370667658BDF3DAC2A681F4E1DD16BAAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 45d84ba869b3d6ac5dd8c5984efd8df7cdaacc587136d7a82ef1cb67b325ebae
MD5 47029fce8b7db9398f682109a0294a39
SHA1 7c3ee86d41f01acb092aaec55955ca790cbd528a
SHA512 90af4f7904156a916e139bee51856e2b44877d89e38ed528270db6511c4904273bff7223bd9c5741a7f65de79b9ed9edb9ee80d6191648614142a708afd52454
SSDEEP 24576:it18u8FpJqH1ezria7/mit/px5fIW7guzjGB7HtTlK7/g:qKZFPqVZa7/9/LpIgpzjGB7N5K7/g
TLSH
T1C435F169B6E102F0C47BD1388A824667F6B2B4151364EFDF0BAC8B551F236D50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 683f07edbe1c8a72a76b290c3477464dcd99bd563e54e00b687675ecd1d58459
MD5 862be281d0d2ef4888f74465870826de
SHA1 b377e827402d735c8f9673292ed63de7540c686d
SHA512 39682841b4c6bb4759ba19c45e95916ce3e56c218e7e9d8828b767a0268ff0b81f72ce8de62d23b2744307ab5dd3cffc2be4dc7d9fd9b36433fb1fb5a233d5ce
SSDEEP 24576:zPUr+NQFt/px5fIW7guzjGB7HtTlK7/g:zJQP/LpIgpzjGB7N5K7/g
TLSH
T17A05F12F669D18E5E67AE17D8A81860DF77174521712D2CF02E0817E1F27AD8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 046f83207652575cc44e8c023d03c9935794c253d4b7a449326271920c11b3fc
MD5 84e2aff3678e8e85891c8bf9a00ba204
SHA1 d9d6af6c56f412cd244341993351e98cc6dfb77e
SHA512 ef3157db012aebcf8dedbba3807253f29b3d2b26eed6685c97460c4d778ecdd1d939a37c4ea117cfb2449279e6885a554a59747853c3a911b5d0a8d7261e29fa
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj//LpIgpzjGB7N5K7I:JG05lO43bWxzj1/
TLSH
T1E1D5BF6E62EC11F9D1BBD17CCAC64A0BEBB23415032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 21ac558226b15c67ea8c85810333b105dbeba2ccb059f597e330aa272dc522e6
MD5 e5bc470b59fe029fdb593856f19bf14f
SHA1 5787bbe909fd8c53b4364acc44353c23531b45b3
SHA512 fa14d5d77897d83105ebfbd7af0c4537956d6426789a7268b09869089627b635a479854e66ecf5d73c6517a7b5ad6c86de49cc4aef53ffc833623d5cf35f5aa2
SSDEEP 24576:0Wa5POZ3dpbWVM50JicR2hG0lasx2+47eidn7PTi8oyUUMQQmQkfXD:Na5POZ3wJt2pasx2+mlyUMQX7P
TLSH
T16D65AE5EA6F801D5E179D17DC583461AF5B2346253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6efc90f12af513d15f591bd48cc5c0babe08013570547515f74b5cf503927bec
MD5 745771842eed177852810e5b00b1946d
SHA1 5f51177cd266001910d77977d916210afb20bc65
SHA512 65394ed4034a56b183f2de13d668e0b0661a5466a822733488df00762250c11d97833520033ea3d5b30d5688f008a79ce0de095eb3f91444979a9ee8fe51e538
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkUt/px5fIW7guzjGB7HtTlK7/g:ENc/zEOVHFz/LpIgpzjGB7N5K7/g
TLSH
T17D858B1A22E901E4E5BBE1BE89779546FA71786513308ACF0291851F1F73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 bdc86fc251458db4d7f0f4643dae44a9146a89ed1d3b9902b0d7bded5a3492af
MD5 1ccebafabcc4d3564c53bff5c7752bac
SHA1 5fe497a3737ab3d9b75c74136f7641698a833e40
SHA512 da26b787b2da462e6428121355f166de4aff8e320a82f2b473cbaea7cd85d3d39c97b32a47c6d38ef481ffa6f6e780d04da24522e161ec733805913057511424
SSDEEP 24576:QJnJPbzB4S8t/px5fIW7guzjGB7HtTlK7/g:QJnJv6Sg/LpIgpzjGB7N5K7/g
TLSH
T1EF15E13DD29810E8D4B7C2B4825A1B59FE31386D2F2169CB19B8D5343F12FD0AA79F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f8f20b9c0fe74344d6bdc30296a10771e6e08626575c229346feb614b7dd8e04
MD5 26dc5d691f4f40cf3c9bcdad69892aac
SHA1 534e3864552819c4da5b7ad48ade8070d54b33ae
SHA512 3bf74976121269e32de20daf0af93bdf6492df87ef7cff94795b66859e7a208f2cec8ba903972ea99075f77ad33c5d9e3327fc3cac59436c8088c23efd683313
SSDEEP 49152:VCLHGeeV5ijCmlDWDko/LpIgpzjGB7N5K7/g:MGxzj1/
TLSH
T1C7A56C05E7EB4184E8F3CAF5CA2294169A327C549B34F7EF4E80C96A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 275dffd82901609994114999b58e2312bcfac20c19cc3a179dd907b371584a20
MD5 c70508ae60419bee6a64af72ee252816
SHA1 6a6a5685043e0b522bd6950ce00b0ebf54b0166c
SHA512 016b7910f88a3a6154b21880dfe3231ce7c4b9039b0aa0785fa4f5e06870b7cdc3722010692a283923ab7b1b74d646136856088887e2e03559b5d9bfbcdaea3f
SSDEEP 12288:S1Hck6j5ZI76UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:O6DI8t/px5fIW7guzjGB7HtTlK7/g
TLSH
T1BAF4015C73AA11B5C16BD03E86820505D1B2B17197225ADF0BE8C9BD5FA3ECCB93DE90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 7ad6483daf02db90c35e4e4dd9a96b0c1de12caf25d2aed0f45e7b9812ca0ab2
MD5 ee87ca47373f7d903294d68002a784a4
SHA1 c04fe96a5687e17eb1ac2de95c7e15ef691127d6
SHA512 a17b80b311862a363732d026bdc65b30b94b82dde16f95540ae52f6cc9c5974a32644da7c65e470ca571d64e7514841c021ce1f7cdb1260ba276c6551d2d4e4c
SSDEEP 12288:5G6kyiUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:wtyYt/px5fIW7guzjGB7HtTlK7/g
TLSH
T114F4234CA3882194DB798B3E8B61419459307C116B2187DF29E0FB3D2F3B7C86975F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 a315c8b421b15d97baf12edd6e1eb710461438187b961036aa9641236923592b
MD5 34655a340c5ead16f487d72c3cb51412
SHA1 723ba3d4f55f22bcbdf1410c15b983887ed2585d
SHA512 468dba449aa224e4b98f35d83d3f17d1663644245bef5eccde90d8b91ef48e84b7c7674ffd84d50bb5357f2c9e12fbd35b55f450b006e72388a6d316a94841cc
SSDEEP 12288:/00UXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:M+t/px5fIW7guzjGB7HtTlK7/g
TLSH
T17CD423DCF94A2211CB28DF7F47505948103036266B258AEF3DE86E785F1A1CD167AFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 4558dd9c014a895742d4306bcb2f0fc7647db6c93c8ba0eb1d5a328ba8eac7f6
MD5 0a152ab2ec97700977275e2f661f9a48
SHA1 0f97921f0f417bce3f970436db3abd2036d387ec
SHA512 5b9be1faa3411ffb8afb8da20c75f05b70d257ef4fa601d78482738c91f202f4871673724b0982b01f761a64e8cfd806b3b5c48528a2900d2413d17d60687c06
SSDEEP 24576:oSgHLoTfaidZTt/px5fIW7guzjGB7HtTlK7/g:Tg8TrZR/LpIgpzjGB7N5K7/g
TLSH
T133559D1DB7EA05CAE2B2D639D9621493D633B4315772C6CF2448C0394DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 17b6c2d4c1cdbd12cc84c10a9a748aafb7ecbe050b101e9b7821df9f0f2369b4
MD5 4a6eb4a95e1d0ba7bfd5052ffe69bb45
SHA1 7550c9f677053e7fc88e96d16e70c2699a27be65
SHA512 4dcd96869c8a2575ce20c36340b0c8dae543d7e78cc5ef80e28d7ddfa858e11607029c2b68f8707526db07a235f564d1d7c95ca84e068edd0c6a7d38f1f84f9e
SSDEEP 12288:hpJcm8CNYUXUBtJACRpxOPafIW7guzPMiFEBwMvSktTQADKGph2rsligt:hrcmRqt/px5fIW7guzjGB7HtTlK7/g
TLSH
T17505F14EB6AE00A5D27BC23C89814549E6B37031272257DF06A4CB7D4F1BAED7D39B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 cc2a8921285de80dfb7559d757c6f90014f2f942cf9316401fb4bdd9d8ea0068
MD5 4bc03d3187cc443f96028196777b3146
SHA1 85521500d944203f0252483aff68cd07b70639b5
SHA512 52faf6a1b54f37da8baa91f7fb3d381e81bc5202c482a30df06016889a9c9e8acd690dee66c4dc0ad05880a2120387463567eccf0556bd2db80321c720d1ef3e
SSDEEP 49152:hDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3J/LpIgpzjGB7N5K7/g:S3Upow8sBUxzj1/
TLSH
T115A58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-384-0x0000020158D20000-0x0000020158D86000-memory.dmp

Download

memory/708-383-0x0000020158D20000-0x0000020158D86000-memory.dmp

Download

memory/708-382-0x00007FF65DD80000-0x00007FF65DEAE000-memory.dmp

Download

memory/708-452-0x00007FF65DD80000-0x00007FF65DEAE000-memory.dmp

Download

memory/800-451-0x00007FF6938D0000-0x00007FF693DD6000-memory.dmp

Download

memory/800-372-0x00000289CC1A0000-0x00000289CC206000-memory.dmp

Download

memory/800-370-0x00000289CC1A0000-0x00000289CC206000-memory.dmp

Download

memory/800-376-0x00007FF6938D0000-0x00007FF693DD6000-memory.dmp

Download

memory/1152-334-0x000002A3A80D0000-0x000002A3A8136000-memory.dmp

Download

memory/1152-445-0x00007FF7134A0000-0x00007FF713634000-memory.dmp

Download

memory/1152-333-0x000002A3A80D0000-0x000002A3A8136000-memory.dmp

Download

memory/1152-332-0x00007FF7134A0000-0x00007FF713634000-memory.dmp

Download

memory/1984-394-0x00000261A64F0000-0x00000261A6556000-memory.dmp

Download

memory/1984-395-0x00000261A64F0000-0x00000261A6556000-memory.dmp

Download

memory/1984-393-0x00007FF7847C0000-0x00007FF784AFE000-memory.dmp

Download

memory/2152-16-0x0000026526D30000-0x0000026526D96000-memory.dmp

Download

memory/2152-17-0x0000026526D30000-0x0000026526D96000-memory.dmp

Download

memory/2152-18-0x0000026526D30000-0x0000026526D96000-memory.dmp

Download

memory/2152-65-0x00007FF720D30000-0x00007FF720E52000-memory.dmp

Download

memory/2152-15-0x00007FF720D30000-0x00007FF720E52000-memory.dmp

Download

memory/2240-449-0x00007FF61C620000-0x00007FF61C8AA000-memory.dmp

Download

memory/2240-353-0x00007FF61C620000-0x00007FF61C8AA000-memory.dmp

Download

memory/2240-355-0x0000021918980000-0x00000219189E6000-memory.dmp

Download

memory/2240-354-0x0000021918980000-0x00000219189E6000-memory.dmp

Download

memory/2460-236-0x00007FF68EDB0000-0x00007FF68EE78000-memory.dmp

Download

memory/2460-238-0x000001760FDC0000-0x000001760FE26000-memory.dmp

Download

memory/2460-322-0x00007FF68EDB0000-0x00007FF68EE78000-memory.dmp

Download

memory/2460-237-0x000001760FDC0000-0x000001760FE26000-memory.dmp

Download

memory/2856-363-0x00000189EE250000-0x00000189EE2B6000-memory.dmp

Download

memory/2856-367-0x00007FF66BF60000-0x00007FF66C430000-memory.dmp

Download

memory/2856-450-0x00007FF66BF60000-0x00007FF66C430000-memory.dmp

Download

memory/2856-362-0x00000189EE250000-0x00000189EE2B6000-memory.dmp

Download

memory/2984-323-0x00007FF7FF380000-0x00007FF7FF622000-memory.dmp

Download

memory/2984-325-0x000001F94A070000-0x000001F94A0D6000-memory.dmp

Download

memory/2984-392-0x00007FF7FF380000-0x00007FF7FF622000-memory.dmp

Download

memory/2984-324-0x000001F94A070000-0x000001F94A0D6000-memory.dmp

Download

memory/3704-352-0x00007FF770180000-0x00007FF7702C9000-memory.dmp

Download

memory/3704-265-0x00007FF770180000-0x00007FF7702C9000-memory.dmp

Download

memory/3704-267-0x0000022A6CE60000-0x0000022A6CEC6000-memory.dmp

Download

memory/3704-268-0x0000022A6CE60000-0x0000022A6CEC6000-memory.dmp

Download

memory/4100-40-0x000001C7CB1A0000-0x000001C7CB206000-memory.dmp

Download

memory/4100-39-0x000001C7CB1A0000-0x000001C7CB206000-memory.dmp

Download

memory/4100-38-0x000001C7CB000000-0x000001C7CB0C1000-memory.dmp

Download

memory/4100-41-0x000001C7CB1A0000-0x000001C7CB206000-memory.dmp

Download

memory/4116-371-0x00007FF76C3C0000-0x00007FF76CB03000-memory.dmp

Download

memory/4116-298-0x00007FF76C3C0000-0x00007FF76CB03000-memory.dmp

Download

memory/4116-287-0x00000219954D0000-0x0000021995536000-memory.dmp

Download

memory/4116-286-0x00000219954D0000-0x0000021995536000-memory.dmp

Download

memory/4480-389-0x00007FF78D7C0000-0x00007FF78D873000-memory.dmp

Download

memory/4480-313-0x00007FF78D7C0000-0x00007FF78D873000-memory.dmp

Download

memory/4480-314-0x000001587FAB0000-0x000001587FB16000-memory.dmp

Download

memory/4480-315-0x000001587FAB0000-0x000001587FB16000-memory.dmp

Download

memory/4720-249-0x0000028259080000-0x00000282590E6000-memory.dmp

Download

memory/4720-248-0x00007FF68BAB0000-0x00007FF68BBC9000-memory.dmp

Download

memory/4720-250-0x0000028259080000-0x00000282590E6000-memory.dmp

Download

memory/4720-340-0x00007FF68BAB0000-0x00007FF68BBC9000-memory.dmp

Download

memory/4776-361-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4776-280-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/4776-274-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4776-275-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/4844-299-0x00007FF6105D0000-0x00007FF61067D000-memory.dmp

Download

memory/4844-377-0x00007FF6105D0000-0x00007FF61067D000-memory.dmp

Download

memory/4844-294-0x000001F1E17D0000-0x000001F1E1836000-memory.dmp

Download

memory/4844-293-0x000001F1E17D0000-0x000001F1E1836000-memory.dmp

Download

memory/4932-446-0x000001F04F0B0000-0x000001F04F116000-memory.dmp

Download

memory/4932-305-0x000001F04F0B0000-0x000001F04F116000-memory.dmp

Download

memory/4932-303-0x000001F04F0B0000-0x000001F04F116000-memory.dmp

Download

memory/4932-304-0x00007FF61AC60000-0x00007FF61B076000-memory.dmp

Download

memory/4932-381-0x00007FF61AC60000-0x00007FF61B076000-memory.dmp

Download

memory/4932-448-0x00007FF61AC60000-0x00007FF61B076000-memory.dmp

Download

memory/5148-254-0x00000257ECE40000-0x00000257ECEA6000-memory.dmp

Download

memory/5148-245-0x00007FF68EDB0000-0x00007FF68EE78000-memory.dmp

Download

memory/5148-256-0x00000257ECE40000-0x00000257ECEA6000-memory.dmp

Download

memory/5148-331-0x00007FF68EDB0000-0x00007FF68EE78000-memory.dmp

Download

memory/5176-60-0x0000023832EA0000-0x0000023832F06000-memory.dmp

Download

memory/5176-59-0x0000023832C60000-0x0000023832D21000-memory.dmp

Download

memory/5176-61-0x0000023832EA0000-0x0000023832F06000-memory.dmp

Download

memory/5300-29-0x000002AEC3700000-0x000002AEC37C1000-memory.dmp

Download

memory/5300-31-0x000002AEC38F0000-0x000002AEC3956000-memory.dmp

Download

memory/5300-30-0x000002AEC38F0000-0x000002AEC3956000-memory.dmp

Download

memory/5300-32-0x000002AEC38F0000-0x000002AEC3956000-memory.dmp

Download

memory/5852-347-0x00000293343E0000-0x0000029334446000-memory.dmp

Download

memory/5852-349-0x00007FF625380000-0x00007FF6256A0000-memory.dmp

Download

memory/5852-342-0x00000293343E0000-0x0000029334446000-memory.dmp

Download

memory/5852-341-0x00007FF625380000-0x00007FF6256A0000-memory.dmp

Download

memory/5852-343-0x00000293343E0000-0x0000029334446000-memory.dmp

Download

memory/6080-0-0x0000000000E80000-0x0000000001026000-memory.dmp

Download

memory/6080-26-0x0000000000E80000-0x0000000001026000-memory.dmp

Download

memory/6080-6-0x0000000001160000-0x00000000011C9000-memory.dmp

Download

memory/6080-7-0x0000000001160000-0x00000000011C9000-memory.dmp

Download

memory/6080-1-0x0000000001160000-0x00000000011C9000-memory.dmp

Download

memory/6084-56-0x00007FF66AE90000-0x00007FF66AFF7000-memory.dmp

Download

memory/6084-47-0x00007FF66AE90000-0x00007FF66AFF7000-memory.dmp

Download

memory/6084-49-0x000001BC80AA0000-0x000001BC80B06000-memory.dmp

Download

memory/6084-48-0x000001BC80AA0000-0x000001BC80B06000-memory.dmp

Download

memory/6084-54-0x000001BC80AA0000-0x000001BC80B06000-memory.dmp

Download