4b3a27c2dd998e32ef02ca62015e6dfbad0e71c104de2efbc77abab55c6ba6f5

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260731-c8zzpshr4y
SHA256 4b3a27c2dd998e32ef02ca62015e6dfbad0e71c104de2efbc77abab55c6ba6f5
MD5 9cfbbd5a7d662389752edd87ef3406ae
SHA1 84bd3cc22b10b5e49d6e9972c1e098e7201a4fba
SHA512 712c9aede3242312b1b39cf2a46031e66faf8da8f3478641f8993a32afab921978a1694ba472651c49b3a4c11d9b666dc64b387d44d3dc7db36930b128b591ba
SSDEEP 49152:bDD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL4joWmg6lKnQrSiU:fD0FZs/U73MQ+fCi6AeeA8uxV1XNq6lA
TLSH
T11CB5BF33F590907AC93313715E9D636C72A9BB710B36428722E55F2D3EB05C36A297A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6060	alg.exe
2864	GameInputSvc.exe
2156	GameInputSvc.exe
1688	elevation_service.exe
3388	elevation_service.exe
4612	maintenanceservice.exe
4388	msdtc.exe
4608	OSE.EXE
2312	PerceptionSimulationService.exe
1140	perfhost.exe
6072	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1fe45a2e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	GameInputSvc.exe
2156	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	2864	GameInputSvc.exe
Token: SeBackupPrivilege	6072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6072	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6072	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6072	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6060	alg.exe
Token: SeDebugPrivilege	6060	alg.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
4108	2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2156	2864	GameInputSvc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_9cfbbd5a7d662389752edd87ef3406ae_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4108

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6060

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4388

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 479c625c95b1f66a0a7fca73ae658d277c06d69f2e1fa0bfb4a77fc8382208c9
MD5 68b1f1ab8aa9cabd6f0b2cc7bbfd27cb
SHA1 874a00575c15a68abe31c09f3dc67e8dbe5042ec
SHA512 56c6ce78ba01e4950ee1579739867c16c9a05b768c77d886ddf17666b1a15e7a2a89cc70abc6b53383e380552676b99d72db81976a93586134b4ca5a2fbcfcdb
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxncoWmg6lKnQrSiU:Y3q6gjBuq6ltrSiU
TLSH
T19BD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 2bfb14318bd29f2d030d2d9b9ac375158849055472a82f4b3ab7b582692e6de7
MD5 6db8dfb5111f7d37c22265481c2c25ce
SHA1 5911334d3675fb180a3e652e6a0f3556f8587313
SHA512 67e7a0718424065e563c50178160c75b934998b4ddb16d10ded4110b6946ff2333f85dd5e4e95e2a3cc2330010ee7b37abaefac4c8f0edeb4bdc5165bd6f49ac
SSDEEP 24576:oXY8JtczAxSh2K+nWhLSv6Pk/eKn9I7DrSiU:AtcmoWmg6lKnQrSiU
TLSH
T15005F128639408F9ED67C17DCCA28512E673B8514360E78B43A4CA6A5F333D95E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 30b18b2fbc0851b061b33b15ef440a370d8d51ab46f0db1399a8236e522fd412
MD5 8fdb78cc8ff641b77ba96f0d77a26b4c
SHA1 a43f79f6e62c6ff40bee12648f7d2d7f60fa3026
SHA512 3917848aa3b630cf7add0950999f760e08d75f0c7a906dfff05504e1694bc80aaf147a28ea6e4f9b1cdc8f55b643c5134f6c4f6a5b950b4fd9b49745e997cff8
SSDEEP 24576:x03eEEK0FTxOrMxSh2K+nWhLSv6Pk/eKn9I7DrSiU:xaEK0Vo+oWmg6lKnQrSiU
TLSH
T195459E26F6748735D073C0B9C5D2A69AE971308217308ACB4286D77C7F677E68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f22649325cec97c952c8726b0b7c158511a200908b832d6f41895858e4b0cecc
MD5 96377f2ec7ae9b9c60b0d103a187456b
SHA1 0b6f8a2735e4f0e465cbe1ee37e1057eebbd422a
SHA512 0c43198ed9626879f746debb99234236e3e53aa9925e9f0bf4766cb09b1d4972ce5a556a7a0d15f5088e806156883119027cf8077b3cc692b179fd5235453304
SSDEEP 24576:rLM/ezSC6vUyD/aqgrvW/6q8wyuaSh2K+nWhLSv6Pk/eKn9I7DrSiU:M/ezSC6vUzPvuHjyzoWmg6lKnQrSiU
TLSH
T1C4756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 726b87ba8fb4a0b3539dfee86317ad35c5116b6d05ae9e5410671acf6fc7109a
MD5 8506182752f0f5e93f716875df9cc3f4
SHA1 72f7b4e6e728373030a9603f9a52169919b0cc66
SHA512 0893bc6d2c48c98d332a7dcd7ed424747634b0aec0039c43800d7b3a0589b00911e305cba6840d8436806f799bf99bb36bd8fa6801c21f9b6459ce68ab0f76ee
SSDEEP 24576:0AbEPsNsCv/l+dySh2K+nWhLSv6Pk/eKn9I7DrSiU:0AvNsCXl+woWmg6lKnQrSiU
TLSH
T16F559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 661fb3b34170527a5f48c6218b506cc87303320bb6d117fec2c021642d9874db
MD5 c7d454516055189b85d82ffc7a6a849a
SHA1 ac0ec6cfcd2096ae50873c3ef94b297b356867d7
SHA512 0642df9d748e74b486ee6b098ae8aa52aef985b7af8c0a098a1996d8c8861a80debb7bc9464f0284f1e3eaa06bfd6bd7cfabe4cdd818c0687985b7156e9a2df4
SSDEEP 12288:+q1MAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:+qqSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T1AAD4236503185C95D7A6D9BF98551F2306E0CC2122808B4DCF19DFAEBEB82FBDD9E190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 4ba6df0702ec3937ba1df9c289ece4786bbbe92725c4882b3fbcf474f1c339df
MD5 9ed3b6083559b2f58c04950f167adf79
SHA1 6ed60124a5fd2641689648762b15c0b65d4f0d6b
SHA512 c52ba301b979287d312d6b0c6059c538f854eb297b2b6e3a58063a0e57b7c30cb49ff4e98ebdabdb9e8adde53978b4b53938e691a5f9770c4d5a08cb374aedf4
SSDEEP 12288:qeBNUbTVO86UBAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUr:qJIUBSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T10F15D03BAE28FCD2C27E9DB95A51870097B278304B5293CBD165C30EDE235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 425a30fa447e9b83f4f471ab9045116bd90cd3f81ec777e03a23347b021e3082
MD5 2a3947d00eb55288c725b43011f2f3ac
SHA1 c9a01f0700685d93781b70e615ed0f14a7e213dd
SHA512 e66db9ca6debefc7271624e7a180345576a254d7e3b85575d7278fb4c4a01dd92bd419daa4c53a0628a44470ac4400cf22b1b11c717b24978b8cb12fe6d6df0a
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5JFNRV3THP:5QvGAdlCEL8c/WRNJ5Cfq6ltrSiU
TLSH
T15C367D656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 f3d0fdf067278d2acbb1b3420b1a2ff9cbc8ffc58ddaf4fbf2b43a871612c126
MD5 cfb7040cb0baf4a9c6e42d45b6aad5c8
SHA1 ef1960b42cd3eb6587ed224f8390a16ede392a64
SHA512 fa1c12ee2ce20dd2fd094c951f813bcae8e51f576de37a2d7f86db5856959b5aa243c751fadaccd44df73a871ba11199bd1ea41eaaf9d6222535b9758a2b4d10
SSDEEP 24576:tmewsAj2Sh2K+nWhLSv6Pk/eKn9I7DrSiU:Ilj2oWmg6lKnQrSiU
TLSH
T12F15F131FF74E436C3BF0DB61B26C716147CA9200B511AC3E3A88E9E59742D2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9dcc4ccbc396f3f2b84b101a7739265fcd05862c3be4b24e56d01d3fa25c6572
MD5 08ec581694abf9381df00ababc7b0176
SHA1 ab250edc1158c62541bf7d6872c3c8aba6a3ff1a
SHA512 b5e98947ca99fb1f0a93867a7ee22f455c6cdedaaf07eb9876a7f1fcf923a91c9be34a2c71788126eceebe10d5afa6c7a8316178a8456a7e2e0a5b687f736fb0
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrRdPlbuJHN63O:DUEtQevvqc2W1cpV2Xr72Ae
TLSH
T10C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d66b46ee3ff2761be8afdb451e98efa01246c60f2d0a28f74413162bd327d997
MD5 5efdbdaa5db600a29c721a45f10046d6
SHA1 eb85b83f7fc7e3b372e11eb96e4c59ec557c6530
SHA512 bae4663472ae596438d11f8f3f9babfc676da9ded963976ee99380c69a546ef4e433a6a299cac838a4fb382eb76939fad91e274ba329887d0a752848720aeebe
SSDEEP 49152:szbRquA/m2yL5zMfFiV+XenmE3/zYoWmg6lKnQrSiU:6oq1Vjnmeq6ltrSiU
TLSH
T17ED58D0976B8C1E4D1F6C77886A2CA47F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e36879178358c4fd5153f6e4a856cd02cb268c6623c6a264257acf93bdacf20d
MD5 1358a3472a7ab974a516aca870c0ed44
SHA1 d5b8f821eeb68c91eec6d2e3cf4af7c3ab784b8f
SHA512 c562009787f410359de8ebfda0699d4ceddfc53e8d8ba8b72bdfe4447307f3b28e4a041b02450bdda3279d4cec939f7418a4d24ba81f4976f6cc1c68df4ebadd
SSDEEP 24576:bAhGLvOFoiwtA5l7S53gSh2K+nWhLSv6Pk/eKn9I7DrSiU:bAMiFoiq5QoWmg6lKnQrSiU
TLSH
T1A445AE80E7F955D4F5F3AAB899B68571EA72BCA65E31C20F1150C21F1E33A909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 cf37ed839cce2bbef42fc6a1313c91c5f0152efa4fea8a692d3c9b2e144bcc57
MD5 00afde9ac7e5a9fd4718864614f4d728
SHA1 33edefb23ec65fca4f576b1d1fbc8528038a00e3
SHA512 f9eebed30d95ba743c4edd34bb462bf09b4a98f8cd6d9f4aca53a37e5c36a2218f86504f45156aa02ee6b4d11151a21547d36e32efc6195540d4a3946f63abc2
SSDEEP 24576:UwusOWdSh2K+nWhLSv6Pk/eKn9I7DrSi:UwfOkoWmg6lKnQrSi
TLSH
T17B05F14523A80CF9EAA79639C5578532E7F2BC122621CB1F4760C75B6F37362AD2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 8e8d71abd4ceb7f574ea14234d630f2bacab63d7ec4bc2b957e8876d273f799d
MD5 60db3eea49a41e1730d55fced6169637
SHA1 89186d516b796b4926271d359cbbacb51a49ede5
SHA512 2cac9d50abf514618fa4f0a314b8f67aef013e5ad89209f444851b2fcb5dfb156aa9c1000320a072540b1e327cbc1fa4448f347bb5c317e45eeacb813163057d
SSDEEP 12288:E/11ImHAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:M1uQSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T10DE4125913A864F9D2A3D67ECCA11B1293B1B822237143CF8A14CB6A6F717D79D3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 99b98355f891de7e76711546050c063a7d421a6b20a9db2d9780fb85f3e8838c
MD5 0e84c22d9590081c6ae82581904020e1
SHA1 7aca3a866bd8f14e249d71de2767a2029f1de895
SHA512 94f7fc30433ccb64b90d3f698246def2050674e7bea405b8e8339a1f61ee546ad1b9be983b4bc5ee18fb274fc50c5ba4814654e6603cbe3fadae3490219fe077
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UB:DQRQyi36YOcP8Lvw2gAf+PN3t41Hg6Rm
TLSH
T1F9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a9fdbcd3a597d9a607a0c61cb10a5b82ec1d4faa7e27fffdcb6a708e0359e632
MD5 32f7b10bece9c03c1e88b2f28274958a
SHA1 f086f76cc5c4e7aa25d23f088d9fc600fe39bafd
SHA512 a79d5312288f303ff649984664ec4d6df578e8c05f90cfda86091b23832ac8dd73f3e83b1af6cfc13fe2f85790c6c9e1cefdb5da8fa7bac53d720ad7fdd8839f
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UQ:DQRQyi36YOcP8Lvw2gAf+PN3E41Hg6Rm
TLSH
T188667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 283f3d4a3ee995a78529e817d2f5a63cae8345e64ca9a94a917a6a22647c08ab
MD5 91605774094219869b6c6810fada8058
SHA1 52ceb9e309ec43cdd92cd783f87d918697d08d52
SHA512 f09d4f8c66298b53b9e48564b56ca2e77c9a132c1c8fde8a8d0bf594637f0d6b5145ac16501d7f20bad8a4f1c420b0f75c102b54ad5119aa48f94ece4c59ea53
SSDEEP 49152:J68Qg55nhMeWu7PNU3/JoWmg6lKnQrSiU:XthbRc/Sq6ltrSiU
TLSH
T11AB54933B2F600A9C44DE1769F4A873196D17C718FE0E3DB8515721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d23ab9d4f73b0988dc094a7c59e85ef180b2a318ae0b12160268073127b5af4a
MD5 d91918eaed9d96f38021b2a2b4546c22
SHA1 e496a9c523d00126ab11ad72680d2018d5928cf5
SHA512 ef615fc4f6d6c98bde5a6c6546d3c958c5eac517a0aa2007b4d2d4a14c70e0a9379b91f5f86f3ebc84f6e0d631075beb694948e3eab127bc35841ebe1eb2c423
SSDEEP 98304:ky5112gYy5azzVv569nLKnhZGq6ltrSiU:lLIHAWh563O
TLSH
T10D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffe69a165d6a72813d45b513b8d18f806425576c1db94ebe311003b78d9a02fc
MD5 7e94fa4b05a709ef15b89676760d9729
SHA1 aa4afe28bbbda21c86a0981c70085b38fd5ca062
SHA512 2d1abfcaec283c9058936684ddd0babd0edb56d0a003bd77b7e701b80d0afae018f6d07bf0a0e9e0c3c4f4f535c2f769b9c983465d49d10e689656f466d20c70
SSDEEP 49152:1B+taZ3usBWOBr4tEGp0bqx0z+n217aau1glnoWmg6lKnQrSiU:7u6JmTxd2doq6ltrSiU
TLSH
T1D0D59E13F1DA01E8D06ED479974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0c7579f0ecea078b771fc705a6a946a1ff674df35efe7615630742d99584e794
MD5 2ac42d0b807f0d038ef1af6978cf298e
SHA1 5eee59a7c92b53349374592b711c8f96f223ca00
SHA512 4f6e6f4a6f1f7289f1247c79946637116637d1e6b83941359cb901de7fdb398b39d01cd36bcd050e21b14f1987bc484d0b40c7b1f165d676ee8bbca3f6b28b21
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xd41NUVe5b2InRm:rmifPbR841Hg6Rm
TLSH
T17EB5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b3e2de15ec201c08e8a2071a823b074e05dc0befd86bd9a9f76bb5505f4ae61f
MD5 0d2f6e8d1d841409bec6f86e0fc33cb5
SHA1 774b56883a77b459c1a82212e6bac67767decfe8
SHA512 4ac91f546d8ae5962c6b6a74d9bb93bac2e3e8bd53cddbb223467e6f911f00bdac9d22fa00ed0d74d8a24691cda6f98b379eaf6a717feaa0ade805cf6482ef1c
SSDEEP 49152:+SuZQIY0Be2K6RVtOnks6NMHqf41NUVe5b2InRm:Q5dKoi61f41Hg6Rm
TLSH
T1E8C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 56c7809527324f6e6e32b7ecdc6d05ac0a71d10d78bafa7428f731aa95428c6f
MD5 1225843e8816c0cfe32d9553ef39b964
SHA1 1382279a4e69f9b513e71385d2c193fb1be330a7
SHA512 28783068c287ec835a022dba3ae13ba5f5da69b8707fc009f2102a3baf60c12dfccd624c90ac3cb3dcf647804ca9b22898494cef1fc47a4426a5bc3f1627d9a9
SSDEEP 49152:vZGSn8EApI0figTgiDn0AP5wR41NUVe5b2InRm:dX2iyphs41Hg6Rm
TLSH
T15DA5BE13F2D901E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 c6ae163fdcb0bb7a11e05ee39201f44b9e088f9a771a73fd56aa32ea3156cbf0
MD5 ceb6a222408e61dc2d598dfae43ec73a
SHA1 67a9eafb0fb46d5002ddec395fcf89c0938d0c8e
SHA512 d63af3ddc729d7c622015c114279089c6eff49a82dbd2dc2f77adc98c21368ef30139c6b34206ef5ffb3e88f06b936a60948a9e1600f8c0e692370207067e3ec
SSDEEP 12288:0s9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:0W49fN1sxVeWgb2IXslneYOUfim
TLSH
T153D4231C689B83BCF589C3F2C0263455A63958DFEA328A412BDBC63F6ED3E613981501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 ca961e0352472d72cf36dfec30a10b98ae1bd9372fb5b76f772329fc7ffeb487
MD5 e029a1ecd8d757d7e94615c1d65d3fe0
SHA1 81af66d6376a77f2586a297f18955d9f3c607deb
SHA512 001432d43b3a961b6ef9fba4a74e4e283cef5cc517a609af264d9eb6a95914ae1b5a8b5e3b058b2e7da81800858a999c6c22e15cec63e458f199d707aa6ffc78
SSDEEP 12288:uo9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:uC49fN1sxVeWgb2IXslneYOUfim
TLSH
T1FED4235C289B83BCF589C3F1C0263465A63958DFEA328A412BDBC63F7EC3E653985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 5b98a241705bc8937f92c0477cf9cac0fb76f71b475fc35ad32a41b0bad2ead5
MD5 dc3747f2cdba4ac1942c3ff95b602dd5
SHA1 21ab8ecafa22b40c75ffb604d5b8afc568c658b0
SHA512 c47212a1c7d9b14175df21b3df22a064bb26f952a3a37f7399f7c60e844f3a93ccec65a87e811e7cc166dc805bb9ec37883e651c2726681a2cc3ba044451b39f
SSDEEP 12288:sgqg9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:sgqa49fN1sxVeWgb2IXslneYOUfim
TLSH
T1D1D4234C289B83BCF5D983F2D0273865A53918DFFA328A412BDBC52F7EC3E612985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 f3196da58275582cc212698ca771af2e302d6f6df657cbe90f108a8f4331d474
MD5 284b0f4337d7da47896afb8dce2cdf9d
SHA1 f9a2321ce8a6a5168b03ed40432d86bbb61d6927
SHA512 aa21de97dd9ca57ed2d44dc5910f3fc859b9d9201a29af43f0e244177815f9099b99f00b4fda4d4f95e4be7bf0a11ca1b796db1c22878cac26139fced7e73b86
SSDEEP 12288:hls9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:y49fN1sxVeWgb2IXslneYOUfim
TLSH
T1DFD4235C299B83ECF49AC3F5C4323415E6797CDBE632CB4B1B83852F1EE2B212954A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 2ace629bdf77060cb201957677f88c9065c0d1fbca35248f7b67f98652012057
MD5 eada33624702781c6d67b01dc4c285b5
SHA1 7cfead332c85185f7619c2056514ced01ffdd8a3
SHA512 c5aba0375cf31b2c60b54ec5abb30713b92ec88cde6cbcf9d9073f60aa00a9ee4a536d3e993501ccfca9bb1055629186f2a1b79ffe342aa60414ab4b86223de3
SSDEEP 12288:r+P9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:r+l49fN1sxVeWgb2IXslneYOUfim
TLSH
T1CED4235C789B83BCF58D83F2D0273465A53918DFEA328B412BDBC62F6EC3E252985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 a5e91d7959526db27bb46c3afcc17e713925b1331075f49016d03b6da3f6acf0
MD5 7ce47d2ac2728d8e686a512208b55005
SHA1 192b35007bb44be370af89fde5007f5e502f6369
SHA512 767a99dbd90190b1dd5988e1d1dde43d3ce75e7056b4c0886ef6a65abd7844772b38d9a7b47cc5008a500a2076b329d0799cdc159f51a741f105c8c80be0dee0
SSDEEP 12288:A0P9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:A0l49fN1sxVeWgb2IXslneYOUfim
TLSH
T1C9D4235C389B83BCF599C3F1C0263465A63958DFEA32CB412BDBC52F6ED3E212985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 4031a9a332b2ba10e837f6707c98a97fa14d7b97ad28c528cfb43380dd05c8d7
MD5 2496e26e15256aa53d05563fd9bef192
SHA1 7b64e11b2e1d1132d05e38e56fcaa14e457d0b7b
SHA512 2badaa923d47627a9da8890affa04e2b6da4c5fdfbb0ad73c89289b31eb638963151493679b42eb1a60b897f3037ca98284685ff31a4539ac9e666d801e1d616
SSDEEP 12288:PV9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:PT49fN1sxVeWgb2IXslneYOUfim
TLSH
T1CED4235C288B83BCF599C3F1C0263465A63958DFEA32CB412BDBC52F7EC2E253985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 e6d5d3c49564f1bb17f375ae489da2315e8fe95dc5c672caad588ac03b266bc3
MD5 3eac8985f80ddf454ae7f92ba45a9f74
SHA1 777bbcad48ec21dda017cb73065a6cf578500b08
SHA512 f582e827c332f8eb69a197f9082591a2eb3ffdd70a2f54e5e30eae1c577de62f6e8f4f886f4fda90ea0b311b1f3ebd5f0ca4767edb95b63542c8d7c310e696bb
SSDEEP 24576:HZMhzR/S3549fN1sxVeWgb2IXslneYOUfim:HZMhzV641NUVe5b2InRm
TLSH
T16D150298739119FCECA7827EC8255806D6B27C5A4B70CA1F03E5362B1F733611D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 939bc5f2b5dcfc5f6da4289ac7a6567e31451bfddb824787bcea69dc1b35141e
MD5 7b133f25d74fea89b1a54307acf3d285
SHA1 052525e39162cff0b6d2d98c6f9a46910f8a6e33
SHA512 412fa20076be06767ec9bcfd1a53a390fba309cca001c2c27e43fb63ad7282f06c76c6eefbe1dced6378fe6485479d545c91542b97da0f3c1507848fdf7cb0b7
SSDEEP 12288:Q19BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:Qz49fN1sxVeWgb2IXslneYOUfim
TLSH
T1F9D4234C289F83BCF59983F6C0263865A53958DFFA32CA412BDBC62F6EC3E252945541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 73907b5634e597cd83efa350dfbb4894d685819ed71a9992ae4d0235b9596284
MD5 0f1af6adcc7b52b996f86e473ae51118
SHA1 b7f77ca15dd07bb62d32248207408b6335afde43
SHA512 8589cdd8a718fca98191449df8d46936a5abecd2753707481902290262d7057bdf7c11fba35d1f9ed324feb689654b7985e03dda12a6f01c1b67314b847718d2
SSDEEP 12288:eDW9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:eDQ49fN1sxVeWgb2IXslneYOUfim
TLSH
T129D4235C389B83BCF59983F1C0263465A53D58DFEA328B412BDBC62F7ED2E212985542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 55bcca8154ceb1be530e4e1d5bcc8ec0352e6ae6246a9da66a748da39e93fc83
MD5 643771a65179ac9b867ee9eb4c78504a
SHA1 b24dc0caa75aa50d3df70a721084fe2be0524fa8
SHA512 004d6a29360c1ba8a6929ca861e2e94b3e15c3ae37cf08bf39b9f7be1f47b289c49065df5b7affdcf4da4887ed7b5b4f1dd1f6467734bfc8e3ee7be23e3e9f69
SSDEEP 12288:dePz5LrT9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:Uzpp49fN1sxVeWgb2IXslneYOUfim
TLSH
T1DAF4120B32A631FCE1668274C8622912F776787757308F5F17A5477B2F637A06E2AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 d99b60fe0e52a39205bac79bf877eda311f17f31676e7437d031ee1ef6cd4d09
MD5 a18e4737a8990ea0d51023a217c8f3af
SHA1 0817c558d99207645198f812a6ad9ff6043a01d0
SHA512 18c79e7142d289a3a4082e4e7f7a049c0acd24f850f8a91558021e265f31731ea13019bddf39277af9dc4a61b9010ca45823fd60eef0b6c7c0ff4c2c8e1a58f8
SSDEEP 12288:QaN9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:Qar49fN1sxVeWgb2IXslneYOUfim
TLSH
T102D4235C689B93BCF59983F1C0263465A53948DFEA32CA412BDBC63F7EC3E212985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 9db3a5b5727cd2a1e787c876c88f8d7f082e6f8b2911f258806422eab67e797c
MD5 08387f448575a9659630b47ad1e18bc4
SHA1 919a1b54dc7ed37b38c8c8909dd16b78d7df8df9
SHA512 78f72ddd772255cd3993069b2bae1d9aca7832ebb1fd9b5a0321e2904a503fc419eb6a6a90a31bc0f938b8da8fde0e306671b7ec5392a830c2707232eb617e03
SSDEEP 12288:8EN9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:8Er49fN1sxVeWgb2IXslneYOUfim
TLSH
T1B3D4235C789B93BCF59983F1C0263465A53D08DFEA32CA412BDBC62F7EC3E212985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 c26c03ff1192f1f141d6bff5e77a72574e722e97f8e9548187b2ce9cbcabe9fe
MD5 337a73534b79a76768307abe6888174b
SHA1 a2d8f60112bece5c145a54aa31a0eec119bc1c98
SHA512 bfd9ae58ccf9ab359b86aab9bc898de5cb31f69d7aa3bbf8ece39db935b4043855745aa9f9deecb8da5d2ee48adb66faa4189910dcef34b7ac0792556d8d152a
SSDEEP 12288:QePz5Lre9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:1zp449fN1sxVeWgb2IXslneYOUfim
TLSH
T1F9F4120B32A631FCE1668274C8622912F775787757308F5F17A5477B2F637A06E2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 1b8965e216bb926796248dc6a404a658f36a7987d36cbad37006076da85f8702
MD5 53c6c483527c036721550c0e5c5868a6
SHA1 8c50576fd6e4b1bb2272a7c77d711748864018d1
SHA512 8492b181469448c585b457880207498e0b4fb215159c08e01fe1188a3d0496f4d0ac93d4cd1a3206209c2e5face1077937d39d73ea042ab41783a6d93cf827d3
SSDEEP 24576:KTbaLE3z0zB949fN1sxVeWgb2IXslneYOUfim:KTWLEja41NUVe5b2InRm
TLSH
T1A2150298B39118FCECA7827EC8265816D2B27C5A4770CA1F03E9362B5F733611D2DB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 426bf297e3cd1d089ca5edd82473143716f4f5ace54d5d3e2e177b1c4ba46c0d
MD5 0746cfcf4d7e60ba56a35e82f4bbdee9
SHA1 b8d28d8843aadc34177be0f153dfcbda286dccec
SHA512 17057f66cbd168de41a010a1d9027d1f6a393e0330cd95defd38a4c5cc8a91e54748b99757fbdda679fbeb4f56f8e4b5f4b6ad89be1519a76c34920d1f5409e8
SSDEEP 24576:C3kd1CHKy7Ags49fN1sxVeWgb2IXslneYOUfim:kkd1CHKy0h41NUVe5b2InRm
TLSH
T18D35CF90B3E411E8F0B78A75C8765511DA767C9A5B31CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 1070a0c73d1bb3a2c6482e1891db2983ff1b5dc25b1988c2c06b75a316b9b93d
MD5 e27811292ad69db9d653254184d4ca5a
SHA1 3b1d1f7d9a53f8211b036e1115246c164c5d47f2
SHA512 572a3e3c4ccdaa494444f603ae84e99011f04f4c72c9562996cc53fedd0ab79d255391e51f0a43d0dd23b0db28e737014543e651e8010d1b9440394cb280745e
SSDEEP 12288:WD09BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:WC49fN1sxVeWgb2IXslneYOUfim
TLSH
T139D4235C689B93BCF589C3F1D0263465A53918DFEA32CA412BDBC63F6EC3E613A81541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 9e12fce4b786be918785accefb2331bd63b21dff2aebc707ac33b771b8e8c88d
MD5 82ac1083d8a9a3b033f2abedd7136594
SHA1 893b48d1923cf17c22e9c18978a967654d87a207
SHA512 4b2ba3b82cc18508b9848589c5f6005fe13cd3aaa33a3d01beaf1b6a0b09e31e8063a91eca2e46ad8de291c0095b5064359bffdaa872bc550959edf9089be72e
SSDEEP 12288:Yo09BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9:Yr49fN1sxVeWgb2IXslneYOUfi
TLSH
T171D4235C289B83BCF59D83F1D0763865663918DFEA32CB412BDBC53F6EC2E612981542
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 38395cbc7a23a43557dafcaf666baa5402d37d8b475d75596813f638d671e012
MD5 f8c98f020c60f8b1fd373f53077b3ca5
SHA1 769871a9a9fec887c4d34e98134eb5d83eb74499
SHA512 871533a9369452fd120193cd2c0a51dabc512502e909c57a9c887a2cbbcbd6d2a9da866bc030d27d9ca1c79445f370f5302e3cdee2367d135833369cf2954c80
SSDEEP 12288:V89BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:VG49fN1sxVeWgb2IXslneYOUfim
TLSH
T1CBD4235C289B93BCF5D9C3F1C0263865693918DFFA328A412BDBC52F6EC3E653985501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 08613102ba9f634cfc3725d9901ce898f7db1ed372605fcf261cfd8ea9a795cc
MD5 c76f00bcab01e188136382fbf4d6d91d
SHA1 6e6c9c7e244a6b43c284fc8a80f7f4031b946433
SHA512 c58a51a5802d8c07234e36b5f6a73f9a664318a86b903ef668a8b4aea0620676329e567c65c9c126e3c3c8fbf411386657425118a4f9025700be565eac868230
SSDEEP 12288:Ca9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:CU49fN1sxVeWgb2IXslneYOUfim
TLSH
T1AFD4235C789B83BCF59983F1C0263865663918DFFA32CB412BDBC62F6EC2E613985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 d754772e793968ff26da76e8704480728f90bbd8b6189a8b1e6eb8b133feee16
MD5 9e888dda82b70bf5149a7ff0e43a0af5
SHA1 6fbccef04d6cc55716a8f03af676d76404c9275d
SHA512 3f2cd235d0b6bedf3f8ccb2b054404adaeb81bee80d0abd0d3696e7b5e8d603d4011cb58242ff95c6dc33157b7054e39d97252d51e06d7515d46bfb23a305e91
SSDEEP 12288:859BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:8X49fN1sxVeWgb2IXslneYOUfim
TLSH
T110D4235C689F93BCF58983F1C0263866A53918DFFA32CA412BDBC52F6EC3E213985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 3e60f9ebb9b25ce2f078de20f35e166035dc053a7cfd04d4f95a46196a4be66b
MD5 eb432f0a578621eb79d844200b6b834a
SHA1 374edab39fbb7ebdd4dee522762f3cc41c45c5d8
SHA512 be543921e5a42080f1971669ce3d123281547d91ded8969059dcb7415068d8c4cd491b3bcb2d499678dad471a26eb15f94c0ca2206fa11c270b6eab007445821
SSDEEP 12288:TS9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:Ts49fN1sxVeWgb2IXslneYOUfim
TLSH
T147D4235C289B83BCF589C3F1C0663865653D58DFEA32CB412BDBC62F6ED3E262985501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 a92bbf7cad6abefa094d0ac150390b55ecbe18073c51dfd86f18200aaf4456b1
MD5 ed24bffb0fca9ab57ea457e02017c40f
SHA1 aa3eeb8bb60564d2163c5e857c734e1c0d574b83
SHA512 f32730a6965745a1c97c03a8241a957e00846ef538448686f96cd97ff0b188c11c804e633f82fc36b45555bbf61840147b0ea2e8765a0103da8c6b8c5c582490
SSDEEP 12288:a0N9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:aI49fN1sxVeWgb2IXslneYOUfim
TLSH
T1E8D4235C689F83BCF5D983F1C0263466A53918DFFA328A412BDBC63F6EC3E612985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 0f568819b0c9c24a00eeed084eae16b35eec88c57a8cf11e614a7a3fd57f4645
MD5 046e4473c12456ecebec51cf64c06c85
SHA1 4d25547b9d56286cbc0aa17412ba1edd7c383bee
SHA512 9aa846ed5a3d280ad5549d4281e25a48ae8e1a685fa9bf6c2bc99ce0c6b704a2b2da4e20b51ba184dea518dc732e65a4cd4f4aac6bfdd4a7343bf0debbe144b8
SSDEEP 12288:Py9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:PM49fN1sxVeWgb2IXslneYOUfim
TLSH
T117D4235C689B83BCF599C3F1C0263865A63D18DFFA32CB411BDBC62F6ED2E652981501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 3435eae3cb76256e9737d6f5a47346ac6a337bf0e0524d4172783f78642cd7ae
MD5 a85fe49dd716eab2a7457871cd791f05
SHA1 3ff9e287fd7358048e39d97800cfe8d9dfd99f42
SHA512 e931dcb7b0c45852dd90a34c397cb0f6cde132c3fa5c747b08bf7a0d1217c31bda7155224ea100a12d8a950227219aa845306fe3951ffa7ef735ba4146d501f7
SSDEEP 12288:Dw9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:DK49fN1sxVeWgb2IXslneYOUfim
TLSH
T114D4235C689B93BCF589C3F1C0263865A63918DFFA32CA412BDBC53F6EC3E652981541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 97598c3534020722daf5060ad0371bf646036e3592c8cb7232824e41e7b4ebcd
MD5 29e39775d20f57f35c951a09e11de433
SHA1 a4f424f2f5482aaf38cd8fdca24f6fb6a2c6996d
SHA512 373569f87c6c3b36fe88344eb5cd06b17aacea1ac13cf45f902e7b209a78d024e8ef62b31586dfa1e1559a002bcf63a17c62d3bc07930e270812cc60dbbaebc6
SSDEEP 12288:rU9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:re49fN1sxVeWgb2IXslneYOUfim
TLSH
T135D4235C289B83BCF5D983F1C0263856663D18DFEA328A412BDBC62F6ED2F612985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 602KB
SHA256 10ce62a3b66c6da9aba41dbe12b20a21a45bc30310055f555aea7191341043ba
MD5 59ec041ea68b8a1097fd3f8aa95d2b91
SHA1 d419cfe5926813506050983071491cb80c166481
SHA512 3ad9d4a29ee38dfd1d36dd9f99dd527b23513a75a6f5bb96960cdd23b62c8c7f68aa72f660d71a48a3031701677c60661212a889cf8b14d52c8a10934670ae9c
SSDEEP 12288:5x9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:5v49fN1sxVeWgb2IXslneYOUfim
TLSH
T134D4235C289B83BCF599C3F2C0263865653D58DFFA32CA412BDBC62F6ED3E612985501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 602KB
SHA256 1177b551c53f0215f799398e2f767164b6c76556df83d9b956a13a6466c0fd10
MD5 7350c85cce7de77f741d37990087bafb
SHA1 f2715768138699820028bc6258e0f688d481b3be
SHA512 bd151a6d2874ddc1d38018628657888d64883b60c8344717e16b64ee39f00be3a596bfe347b77d017681a489a9fbb2cbdf4cd4c3cecefd573d1867d451e92a7b
SSDEEP 12288:+k9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:+O49fN1sxVeWgb2IXslneYOUfim
TLSH
T1C6D4235C289B83ACF59DC3F2C0663865693D18DFFA318A412BDBC62F6ED3E613985501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 602KB
SHA256 d316c882e4bbdde02769dc5cd1c98845c7074e23053ccb9736ebd03db2fade00
MD5 5330ee8ea82e58d81dda7f5e4c0e8ec1
SHA1 3106e8bc17818a6140491a9c6ca45df585fa25f9
SHA512 ce9d168514072d9998aeb4d895f3b11c899e3747281fe54378fa2b181cdeeaaa3951a357307df006f211155044cdf8f4104e618f46350f1679bce1078ea864d2
SSDEEP 12288:xi9BWHkRwuO/1QPlON1sxnVeWgWkaFbsRXs0IMcfveYCz6xfGQq9c:xc49fN1sxVeWgb2IXslneYOUfim
TLSH
T1FDD4235C289B83BCF59983F2C0263465A63D18DFEA328A412BDBC53F6EC3E653985541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 2f757521bb977e5a348ccfe5762b91417ac7331a52c8d72f2a27222854370c68
MD5 c04904d727168bd95ff957960ba6b1e4
SHA1 b7240637a9809d9798deb7a64d100d2a6687b541
SHA512 b9d3dcd1dd734f76c8783ea65be1643e056d6dd7fdd4bf3a166711990ee374ffb0000eb49ce9bbe1422287b5a9a57dd9cade3211ebe8e704f23c278c1072374c
SSDEEP 12288:LOsfdAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:BdSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T194F4F119C25802D8C16EA27ACB460A12B3737C2153E1D3CA97D0FA7E1F792A59DDE743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 0a80bdbdb5b7dbd83fc41f54daf8d48d64c4026b07af7d4ff8afdb9a8facdb40
MD5 a51f325afdc052cc9e6dbabc01529061
SHA1 4ccb5844ef5530930975346655ab6e3dbd98715d
SHA512 abd00f532e8f4938d6efbcc5f58ec816ee99ebee9b21a5e9818d920577ae894c537d84175e0e3b2783fbc4ec65238010cb990e5421ca6b45ac525c5e70365a69
SSDEEP 12288:jK7cAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:icSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T158D42325031C9C45E676EAFF98091B3212A0DD31274087CBDE08CB9EBE786EBDD6D654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 514fef16d85a41e5d01481d3da85842e30835d6854196893c0c7f19cef34541a
MD5 cf8816f40cbef170e998720db28946a4
SHA1 300b7b0c86653387cacd19bba7890d76c2da3e15
SHA512 0edcb03b25ed66731c97babba7748372846afeeb33dc71666cb9dbab33b0982bc0f9de1a5dfe760c94395cefbe37e46a351c2d086bae0f1e0fc94a22315db3d5
SSDEEP 12288:pMGiAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:WGiSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T174E4132C02A96494C676D6BF98151A2335F0B831230057EFCE54DA7AEF746F6AD3DD80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 eccd905e8f8b5fd1a7ce8410e2f32ccd29403fd3d09890dab3320378d0eaf9ee
MD5 2405bb05e747c938f47cc49d879974bc
SHA1 5af0548e0667f895e08fab0527daf501d8c45cc2
SHA512 874599a11c129f68821285416bb78299017bc89546f76965a9ee76d393d961112e7f4feb8894ecf436533f771b6d565cc70deab2768b10d7af5613a29f295f7f
SSDEEP 24576:pPUr+NQPSh2K+nWhLSv6Pk/eKn9I7DrSiU:pJQPoWmg6lKnQrSiU
TLSH
T17905E12F12AC1CE5E676E17D89424719E771B8621312D2CF02A0C17E5F67AE9BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 01ab6b6f8c5ce709f34593244dbed9b410caacaea8b18548c7ee4cf8a5a4a8aa
MD5 d2224487e834fd9a73fd2efc46130d08
SHA1 fe70ed33ef508bcd3d0807a017a9653b48a3eb54
SHA512 e2a32a50790ff543e6955114f6d81a529afc9c8fd2ab7f2061a221498b55c5872705b294c50fc848557ed075d681baebe30d7303d1c731d8b3061097344614b9
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjToWmg6lKnQrSiU:hG05lO43bNq6ltrSiU
TLSH
T1D4D5C06E62EC11F9D1BBD17CC9C64A0BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 0626407fdf0fad19aed71c1e1fbd76d59aad133212d3da9a6f25da82abf472bf
MD5 67fb2aadcbe56e4afeac37d6be316259
SHA1 e9d3743866230cefab450c235b862e67e6070dcc
SHA512 763783439059b0df391faefc3140f5754f7919877d7b7c54f24fd0337f9caec0784ff1fcf194b772eeee54fed3f3dc9b1fbea791a14ce139b4bae7b984f7c61d
SSDEEP 12288:b1Hck6j5ZI7WAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUO:/6DISSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T1CCF4011C237A10F5D167D07EC5830512D2B2B47193125ADF8B98CABE9FA3ED9B93DA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 494ecadc888eb44e413f7ef8f58664c25fa5c1cfeac012064ed4c44942a83cc0
MD5 463258e76f9aeb6ac1853d0d18e08501
SHA1 cb6a13af49f80716db53b90ba6d7bf899a34b2ad
SHA512 71edc77b264b5cd1d97a17336846c962052f8b1aa2915d96f132848e1c3ddb8b90d4998d23d7e6a8af5cb3de7c3e3b418f68845d6d5bd5a980d0d87794e4eae8
SSDEEP 12288:PG6kycAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaUUNSEU:+tycSh2K+nWhLSv6Pk/eKn9I7DrSiU
TLSH
T1C3F41214039864D4EABA96BEC86206614B70FC30271187DFDA90DB3F6F347E6AC39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e17691285e9c8ca3e13335016716e5d485384057e03811f0edd5f92adc444fa5
MD5 6de0d4550779d09d16e48e71414e3d99
SHA1 8fe2811b25ee03955976c292eaec76dc164a8b83
SHA512 3149c82babf2195e86fa20d1a6c5eba0dc6f55fd533016c18b3e80d90c4b03309b02ea16f5d3bfd320c47fc17d4079f7128d80dadfafd28e1dedac757303f396
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmZSh2K+nWhLSv6Pk/eKn9I7DrSiU:9TMwBtOmZoWmg6lKnQrSiU
TLSH
T10E55BF2EA6B806E4D1FEC6B5CD238512E6727461133293CB9390C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 eb24270ee7d2341bd07c469e5bdb80cd8d1f2cdccaa9aeb80006b6251380b447
MD5 499a17d21014430ba2c96dc76c8a75c1
SHA1 f9cc6f53df8c9738f67afc055885e3c6c0bb107e
SHA512 bfff863c597dc5d23dbc121fec2e7fc7b3e65dc74f1487db414cfd278bbdcb525553b667996d3fb00cfc10e660cc6c5c6fa2ba37667891649fa48a88819f3ff4
SSDEEP 12288:PyS6b3IkxjbBzmAZhIR3peHTKq8WBr3LSqTGLW8Yf6D/egBR0Zw3iYIaANDl5SaG:96UqjpmSh2K+nWhLSv6Pk/eKn9I7DrSH
TLSH
T147F4125D039468E9E57A9279D825423241B0BC32236156EFB688CB7F8F34AD6DD3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-103-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1140-110-0x00000000008A0000-0x0000000000909000-memory.dmp

Download

memory/1140-104-0x00000000008A0000-0x0000000000909000-memory.dmp

Download

memory/1140-138-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1688-45-0x0000022E3CDB0000-0x0000022E3CE16000-memory.dmp

Download

memory/1688-46-0x0000022E3CDB0000-0x0000022E3CE16000-memory.dmp

Download

memory/1688-44-0x0000022E3CE50000-0x0000022E3CF5D000-memory.dmp

Download

memory/2156-38-0x000001CF800D0000-0x000001CF80136000-memory.dmp

Download

memory/2156-35-0x00007FF684950000-0x00007FF684A18000-memory.dmp

Download

memory/2156-119-0x00007FF684950000-0x00007FF684A18000-memory.dmp

Download

memory/2156-37-0x000001CF800D0000-0x000001CF80136000-memory.dmp

Download

memory/2156-36-0x000001CF800D0000-0x000001CF80136000-memory.dmp

Download

memory/2312-97-0x0000020C40D60000-0x0000020C40DC6000-memory.dmp

Download

memory/2312-94-0x00007FF799E40000-0x00007FF799F89000-memory.dmp

Download

memory/2312-96-0x0000020C40D60000-0x0000020C40DC6000-memory.dmp

Download

memory/2312-137-0x00007FF799E40000-0x00007FF799F89000-memory.dmp

Download

memory/2864-93-0x00007FF684950000-0x00007FF684A18000-memory.dmp

Download

memory/2864-29-0x000001FF95CD0000-0x000001FF95D36000-memory.dmp

Download

memory/2864-27-0x000001FF95CD0000-0x000001FF95D36000-memory.dmp

Download

memory/2864-28-0x000001FF95CD0000-0x000001FF95D36000-memory.dmp

Download

memory/2864-26-0x00007FF684950000-0x00007FF684A18000-memory.dmp

Download

memory/3388-54-0x000002304A0D0000-0x000002304A136000-memory.dmp

Download

memory/3388-52-0x0000023048E40000-0x0000023048F4D000-memory.dmp

Download

memory/3388-53-0x000002304A0D0000-0x000002304A136000-memory.dmp

Download

memory/4108-0-0x00000000028C0000-0x0000000002A1D000-memory.dmp

Download

memory/4108-1-0x0000000001050000-0x00000000010B9000-memory.dmp

Download

memory/4108-6-0x0000000001050000-0x00000000010B9000-memory.dmp

Download

memory/4108-7-0x0000000001050000-0x00000000010B9000-memory.dmp

Download

memory/4388-73-0x00007FF60AAE0000-0x00007FF60ABF9000-memory.dmp

Download

memory/4388-136-0x00007FF60AAE0000-0x00007FF60ABF9000-memory.dmp

Download

memory/4388-74-0x000002404FAB0000-0x000002404FB16000-memory.dmp

Download

memory/4388-75-0x000002404FAB0000-0x000002404FB16000-memory.dmp

Download

memory/4608-87-0x00000255B3CE0000-0x00000255B3D46000-memory.dmp

Download

memory/4608-86-0x00000255B3CE0000-0x00000255B3D46000-memory.dmp

Download

memory/4608-85-0x00000255B3DA0000-0x00000255B3EAD000-memory.dmp

Download

memory/4612-62-0x0000023197DF0000-0x0000023197E56000-memory.dmp

Download

memory/4612-61-0x00007FF692670000-0x00007FF6927D8000-memory.dmp

Download

memory/4612-63-0x0000023197DF0000-0x0000023197E56000-memory.dmp

Download

memory/4612-69-0x0000023197DF0000-0x0000023197E56000-memory.dmp

Download

memory/4612-71-0x00007FF692670000-0x00007FF6927D8000-memory.dmp

Download

memory/6060-60-0x00007FF67C6D0000-0x00007FF67C7F2000-memory.dmp

Download

memory/6060-17-0x00000214658E0000-0x0000021465946000-memory.dmp

Download

memory/6060-18-0x00000214658E0000-0x0000021465946000-memory.dmp

Download

memory/6060-16-0x00000214658E0000-0x0000021465946000-memory.dmp

Download

memory/6060-15-0x00007FF67C6D0000-0x00007FF67C7F2000-memory.dmp

Download

memory/6072-123-0x0000022992B90000-0x0000022992BF6000-memory.dmp

Download

memory/6072-122-0x0000022992B90000-0x0000022992BF6000-memory.dmp

Download

memory/6072-127-0x00007FF6E2F80000-0x00007FF6E36C3000-memory.dmp

Download

memory/6072-139-0x00007FF6E2F80000-0x00007FF6E36C3000-memory.dmp

Download

memory/6072-260-0x00007FF6E2F80000-0x00007FF6E36C3000-memory.dmp

Download

memory/6072-259-0x0000022992B90000-0x0000022992BF6000-memory.dmp

Download