0d583d9064e8e1c9530ee8a0a8968f78aeccd67fdc1dba2f4a051b8cf24c8c08

Analysis

max time kernel
142s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260804-layhnagg37
SHA256 0d583d9064e8e1c9530ee8a0a8968f78aeccd67fdc1dba2f4a051b8cf24c8c08
MD5 ddc9341688b666b58e462f0de78d8ded
SHA1 b53469a8f21d9ffcdf067fa96fde573a7fd59415
SHA512 4614a9194f087cfc32cfd79d32201c6812ed4b2fbf7aa9a7f5f63f0896054113597490e22e2b777d2a63e8c3ad3e51b77b8baab032b89c31ffd551ea46393a7d
SSDEEP 12288:8g49H69jyCNtbAd30RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:L49H6JNbk0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T16735BE02B3E9A174F1F32B31AFB552515ABBBC629D35C64F23C41A0D19B0980EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5744	alg.exe
4904	elevation_service.exe
2504	elevation_service.exe
3696	maintenanceservice.exe
5248	OSE.EXE
5452	GameInputSvc.exe
4836	GameInputSvc.exe
2136	msdtc.exe
2760	PerceptionSimulationService.exe
4656	perfhost.exe
3508	ReFsDedupSvc.exe
4820	locator.exe
4172	SensorDataService.exe
5876	snmptrap.exe
1228	ssh-agent.exe
4660	TieringEngineService.exe
2520	AgentService.exe
3144	vds.exe
3252	vssvc.exe
2728	wbengine.exe
5152	WmiApSrv.exe
2052	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\30a70dfed744edbe.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4836	GameInputSvc.exe
4836	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5844	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	5744	alg.exe
Token: SeDebugPrivilege	5744	alg.exe
Token: SeTakeOwnershipPrivilege	4904	elevation_service.exe
Token: SeTcbPrivilege	5452	GameInputSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3508	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4660	TieringEngineService.exe
Token: SeManageVolumePrivilege	4660	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2520	AgentService.exe
Token: SeBackupPrivilege	3252	vssvc.exe
Token: SeRestorePrivilege	3252	vssvc.exe
Token: SeAuditPrivilege	3252	vssvc.exe
Token: SeBackupPrivilege	2728	wbengine.exe
Token: SeRestorePrivilege	2728	wbengine.exe
Token: SeSecurityPrivilege	2728	wbengine.exe
Token: 33	2052	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2052	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5844	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
5844	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
5844	2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 4836	5452	GameInputSvc.exe	96
PID 2052 wrote to memory of 2780	2052	SearchIndexer.exe	113

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ddc9341688b666b58e462f0de78d8ded_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5844

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3696

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5248

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5452
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4836

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4172

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5876

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1228

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d973bb126b59c0660bb51ec5a8fe6d51db94a979c77a5bcd694520100f66abca
MD5 ffade5ae42a184b99c87d681433a3419
SHA1 7243e2cb67bf8897074cb18a4034cb44f69453fb
SHA512 dd33f1c472f5b77918b7c50afe5df4c66a2c9aa3e47b2fccf6e162b7fd48945f923a400050e11fa778950976c1fb3d2530639ac395759e0f8a87a505c171498e
SSDEEP 49152:xb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnyDRzQXJTkFIbl:33q6gjBFclJ
TLSH
T16BD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 6cdc078db09d2fde30dfa4530cb4eb48bc19b9c23c378f4f5d19d567183deb42
MD5 e5c1742d0761aacad30770a530460134
SHA1 b183f9cc57388ac14e0dc5e5ee94d64865c7e16c
SHA512 c34e46e9eec69b6c36d27c36efb1cda62936a65bfda9f99d873a501c8f232d6d4a54ae5331a71ff99c624d1585108a2cfe406fdca763d3ea4d4991cd22f40ae6
SSDEEP 24576:pXYfDtczAY0gH4Rz4ppQmJTwzFIbmqitQ:MtcSDRzQXJTkFIbl
TLSH
T18B05F12863D449F9EC67823DCDE28401EA7378954760E6DB03E489792F237D85E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2d2450250add3cd7f308f0c25b1006a6bd45950747589da28f4ef0ae13477b35
MD5 eeb49fe5d024c37b36e6825cc097b311
SHA1 d5845af1840b38216f5978534ecdb10d49be2534
SHA512 0eb82afbe5228d29e3d26aa41e5f043c425d638e608d77e0eff4603508931d302d6388143939e3c4970b4076cef22a25b18ad012e80e0099acb95830dcd81005
SSDEEP 24576:W0NeOog0hmxOrMT0gH4Rz4ppQmJTwzFIbmqitQ:W+og0AoXDRzQXJTkFIbl
TLSH
T1F135AE16F5748771D073C0B9C5D2A68AE97230825B3089CB4296C77C7F67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 707e1d510f0097f29667a2fd123ed9eb4a2c49e7455d194eeb6af4f8e429df70
MD5 cd68bc81f84108a0c9023dc373416cb4
SHA1 1b5096a3a9bc508adc7d77d049b73623181a9592
SHA512 dba7f850831811aba2ab949774460f95613badd40dfff36495e2a29a1f5ee572a68efd8bf012844f46eea9db60b68f69d6df1100ca7703779c67b23531f5f6ef
SSDEEP 24576:6hA/ezSC6vUyD/aqgrvW/6q8wyuW0gH4Rz4ppQmJTwzFIbmqitQ:l/ezSC6vUzPvuHjyKDRzQXJTkFIbl
TLSH
T12D756C15F5788323D0B2D0BAC5D67A9AFE7230865B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1b4f8952dd260c7e0960ef6926186f6946ddd38fadc2cea3ca43e161334dbfb6
MD5 6284390d1a516b1c21025327ec76bc05
SHA1 4af4bc3a6c3b33136332691fcd3bf41d25f0bba1
SHA512 18f3ace2e26213d9988bec091864330140d14492c42ba338fc8035fdc23d4d6ed852f532918ee5f936a78006cb2e09eefdc26e54565f584be5b5b248528e398c
SSDEEP 24576:AabiPHvVrv/l+db0gH4Rz4ppQmJTwzFIbmqitQ:Aa2vVrXl+uDRzQXJTkFIbl
TLSH
T1FD559D66F5B4C371D073C0BAC5D2AA9AEE3230424B318ACB1246D76C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 29955ef5b370e53cbbaf19380765784a08571efc2c343140cefdff3fff471306
MD5 0914f40b9d2e2b4bc8168de133a31521
SHA1 5ea15bd7044100f0dfeabcad17c2cc08fe8d62ec
SHA512 356ced5fa56bf6229d66c93b94858f3d7e09a1ead2f031b822431b84ebfd5536f0f8c4cb4b67cd1ff39c39d2458ee46f01b737242ab82be28076159bc4c45266
SSDEEP 12288:Otf0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:Otf0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1E6D4230444C8F9F4ED51AA3DEAC12C417A8735E4CE23C4EB12B05ABD366A596DC8737B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 662d5592ef166079ffa5e7f03dd77b59be8f11f92e8be77ffd959f0c654d7d97
MD5 ac264d82257972ca56637ffab7d18f12
SHA1 5a95b884faa7708effd9b0d2e25b637cf56d1380
SHA512 c7a0df5edeb1dd69de22916dca22ed4aab2c054279d07e6ae7bbca99fcd0f5d027853836b13ea3f7cb40435668042d35c724d93d0b9faf1c503d6b066e7106f0
SSDEEP 12288:AeBNUbTVO86U30RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:AJIU30gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1FB15CF3BAE28FCE1C67A9D785B918600E76274704F22D3CBD174820EEE135E15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 09d2f9afeaaca5afbf51a709e677ead0cf8ad6210b4dfd2acc257b1a10e278ad
MD5 8d72662ee6ee5774088810af9fd76eba
SHA1 49327e3429791103359b3aa3a5d456001e0e4656
SHA512 39f6e8293bc511d85036b975c84aca2c875e4789f7ff95748c1faf7c9aeb02bccd91cf735d4b629f3a08d4b2067baadaf9054f9c20de401ea94754f2177e98dc
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5JXNRV3THf:pQvGAdlCEL8c/yRNb5CTclJ
TLSH
T1C9367C656BF880F5E0A7E178C97A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 8869314af63710abcb3f04ca0b21b723f96fead7e5e79c5a1506b7b36ff97010
MD5 8c59c508e6ee380d5220da479a263d40
SHA1 b8dfc1d4d793c58ea92e4b9e07fae24f22016b48
SHA512 fa93bad2cf1cbeb7c37e7a03098443275df16d90a41abb4c5641ff87a2ad6a6371f1b0422f44bc2ce4e60bc707e86ef5f8f3577a7418ac95a5b7229ebf18b077
SSDEEP 12288:p3wSfxL/2Dc3bDLLmt0LDQewsAjj0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtl:xmewsAjj0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T18015E030FE74E436C67B0DB61B66C706246D79604F6219C3E3F84E9E69202D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c528d793febde9345ee00edd8108f3c855f328eb6a5adb1ac8d97c7a385e614f
MD5 9d1af3a23073713dda71f3cde4c54ff0
SHA1 32f33ef68ddcf91f464cd087eea4ada16a61e36f
SHA512 a252d17be226862f1d757ff2914a108af3c7248ef03da4ba9979bcca488ffb33a81e253fb7d7ad3578a06c02e3a1960d0f2c85f1a575844d8aa20af6e01e64f7
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrfdPlbuJHv7:zUEtQevvqc2W1cpV2Xr12v7
TLSH
T1AC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b40bee10ec44cee7ce52149de0602916db8a2025b04fa74752aad80f1b8c7a2c
MD5 0677d7ebf4643ba95c1e4ed0bd70470f
SHA1 14c0540f57b40da27cc28470a22aee1359a3752f
SHA512 bc999acee459f17b77d172764c6ccbe2eb86864aa9b9b5159e0ec69709de9f6516858226a92eef65c0181b2ab7a016f969f1c18acfa4057181415fbf77072fa8
SSDEEP 49152:VhbRquA/m2yL5zMfFiV+XenmE3/zDDRzQXJTkFIbl:zoq1Vjnm6clJ
TLSH
T16DD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a5ab9cef1cd74a9552cdc3020507815c5464ce93bb9d4209a728dd0475e42d1c
MD5 8976dacb6f12f2f6dcbd73c25eaa0d10
SHA1 3e45767dbf3785100198aa9f6fff9ca082819a00
SHA512 68eae0bc9305569320c73a90449ae78b37126fa108626a7a1cc2e5e6225eda0424f9220083a3be44fb45fb11aec724345d7eaa53ff583eb00e15710e64857f90
SSDEEP 24576:LAhGLvMFoiwtA5l7S53O0gH4Rz4ppQmJTwzFIbmqitQ:LAM4Foiq5PDRzQXJTkFIbl
TLSH
T157459D80E7F955E4F5B3AA7899B69470EA77BCA95E31C24F2160C11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 824KB
SHA256 3a83b026122b7fe838d35966619dd6d183ec3478ad3591bcf323bf32648cf6a7
MD5 2ddfefa9eafda59d77b43d32c03c50d2
SHA1 dbba33986c643d638357f001f573a1ce87e4eced
SHA512 5934f3bae355fba71e47f2511285d4476f9acd03d3eab35537f21f7503c80607f88197ff0b06c2174533bdabf95cf2f52ac8f6d7f18bb620fa7c9c9407f0bbad
SSDEEP 12288:Cmw5HEjsChNYBFgl0WVm+Cf0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmJ:bwuROWu0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T17405F14922E45CF8E962963DC6978432F7F3B8512A22C75F1360C65B7F27361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 674KB
SHA256 56573181dd6a7c23c6fa0cc156d57aba8577c23316965ebc40b1ddddcd05d0a3
MD5 50a25ab6462d1b00327431f2d4ddb63b
SHA1 2a92b2e136442ea79ee84b399d71fb6213ea96d9
SHA512 aafa00cfc591478458c2b88c8b3a2335bcbfa1619a614d946affa20c37c654a46d21f38e8115a245e4a6d0f3db032f513d7edf53659983870e16b070e8d81841
SSDEEP 12288:AKt1IZ10RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:VtuP0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1ABE4124912D4F5F8E5A2963CD9E11941E7A370A16B33C3CF126446AE3F23AD65D3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 17a5d2f582bc8e80276dad4d597b6d3cb4ddfd216ab24665d8f99ec6909ee7d4
MD5 a27ebfae456f56f17af19df917b64601
SHA1 7fc34a8a6236ef47837d4fe71b53143a13b83147
SHA512 518df048239ba6d69bf633d68735b5883f684a4212c74757bc19e2e0eb55d030b12a5d2e5145c70c75eb427c06fde9757515d5f36c1e4647211a625c56c953e4
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Up:JQRQyi36YOcP8Lvw2gAf+PN3MclJ
TLSH
T189667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 be11782a7a8b03743c8585e174e5b615ad74bf1f0ee9d9fb963baeac9c1ab4de
MD5 9badf080d473c49cf3d7dc691b4d704b
SHA1 8d1e01353431471b068168d114c1de16f55d7a4a
SHA512 d70b5891ee42a717d90d8174d31c60cc71a4e83cd115bc1ff0fb54f85ccf57a7a8dd2f7ab7e41e563de491cbd045adcb0d8caf1ef37ff47572caa04cabcc2c96
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UJ:JQRQyi36YOcP8Lvw2gAf+PN3sclJ
TLSH
T1F0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 575fcefee455c56b8ee72bf3f30d3e7673589b98ab79963278f4b202428b44d7
MD5 3b3dd7175b6aa11ebfd2ae7772d84f15
SHA1 be53df6686f76a4d1a576077e832212588e0023c
SHA512 25a188c16a5d19967131ce6c065ecc69e4338b71a46515e3d6cf322b3ee04474cd636aa9381495767f2612daf41d9fec05dad16c10f20e13e5f68df2501f33a7
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0a0gH4Rz4ppQmJTJ:g68Qg55nhMeWu7PNU3/MDRzQXJTkFIbl
TLSH
T180B55A33B2F600A9C44DE1769F46872196D27C75CFE1E3DB8111721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d30d35c4cbf2e19dfdc1ccf61c9b68558078af9efddba45b8b245f9c0d357a75
MD5 8e0ff6257d20c8dff59d02a761cdf824
SHA1 a0cb3e53d6d5d9dc7b93704b8f6d19970cf2acb2
SHA512 a03eb70b32657c17a4d3a8ee754e17abc96a92e08faa39a6eec74eda25bc2266046754bdd4b74e1c6c719848adf5e79d5eacdf6aaecef0a94ab9eb6ab71d266d
SSDEEP 49152:q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99n:7y5112gYy5azzVv569nLKnhZrclJ
TLSH
T1D0168B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47fb9af14e9160ff89b6804ed9ce1b74bc79e704eacc2cd100fba15ab0ae8bb3
MD5 aa5d3f069edae810fba784c809354f9b
SHA1 a4450dfa25ccb09f3eb2371bdb52ba1534b89980
SHA512 8322ca0e8737012821abe6bc02b31de2deb8b49d40d573ba5ee8eae6ea5070d63a3235798a2fb49f6759708d2e70fa2e6e474857cdaf58281cc615bed7957aa1
SSDEEP 49152:CB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glVDRzQXJTkFIbl:wu6JmTxd2dbclJ
TLSH
T12DD59D13F1DA01E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ba58df86e8465f35509ea42866e8bdd71cb98b3c8f2a6d165429f785ab0b40f3
MD5 09ab662b415cdf5daa79b0545e005396
SHA1 5122d455cd1c1c49895bda4a0def586c9fbe189b
SHA512 5ac11524e2f8802cccc2703ad5afebe773297c884f65f7e5aeee068623ee1fa5ee8a5a00b87aff11e2450604ae8fb33adc106057a4ed9f951a25b16baebfb64f
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xM6RfuneJFN:pmifPbRvSW
TLSH
T15AB5BE13F2D901E8D06DD17887569232EA72BC450B34B6DF0A90B7962F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ecc12ab01202487d746d7bb70dfc5c7e307e213b691e7e908d38a33de0ec6ba0
MD5 6ef105b728f691a8cc17490389ab9942
SHA1 ca37c0fabb96e2c54bdec5c4a1638266e14ab21d
SHA512 f4700bbf55384be14265771fc58c060261172944190748c3e102c46d9d220f766fbfe81e393eb01157eee0b9bb4385f9574e58c79aa0c29b08d782ef15d2f4c6
SSDEEP 49152:zSuZQIY0Be2K6RVtOnks6NMHqG6RfuneJFN:x5dKoi61GSW
TLSH
T1C9C5BE03F2E941E8E0BED674CB669232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5d16207639c6d871c8bd19b08206bcd344f65b332d4bcc612e915da26cacbe3c
MD5 eb0a0842c4c5eea718df97f8a8b7de4d
SHA1 ff38acffd613571eb68454689930a4e7eb4f53ac
SHA512 bdd2542f470a843fc64c86569e62b10c7f023b3c3973dfe7cf4b2565f674d2f382326ab0c538d57fd33cf027fd7bafab17108ff015c391ed62669e03524f66b0
SSDEEP 49152:UhtSn8EApI0figTgiDn0AP5wl6RfuneJFN:1X2iyphuSW
TLSH
T1E6A5BE13F2D901E8D06DD174C7468632EA72BC160B34AAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 5b2097907eb78c10299888d81e978195ead6054c6b963284dd7359db740725dc
MD5 f1c466acf14b784e1ef92da4f112d50f
SHA1 684eea7b30aa475951bc779ec4ea97146fefe46c
SHA512 6f989caba865c111f870161a62fb1244f022ae9813b9f52ab9d493b637007b1a6d6a3310f6bd56599fceecbdcbf98925c934af45e94e439fde7acbd649f2eca4
SSDEEP 12288:kocD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:kLATmhlTS6fg7nNwJFN
TLSH
T192D4230DCF9DBF48FAA849F0D852060AE5BBA9713D81D76337D38552F9788023096D9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 beeed5a156f48b79573d16f80fe843de6519d5a3ded94e86871e2ebad1c6b5ec
MD5 5924b8c1b8a072c39e8108b831b6d3cf
SHA1 64b12ee64904c9a4a7798993a37ab6a6ed1e9b35
SHA512 31bb05af22a4472867dcd77be88a3aeadae333ebb4f3c07788cf6839e799373716d8b66e480eb084fe4f592e7673cd4e60b3c9dc0c3d805e6e3e6c14d208c5b4
SSDEEP 12288:uSDcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:uS4ATmhlTS6fg7nNwJFN
TLSH
T1D6D4230DDF9DAF48FB6849F0D912050AE5BBA9713C82D76377D38542F974802309ADAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 278f37c30d72fe33a1eaf3c192ab120c37fca8e949f9751072a9579464e81a40
MD5 3ca76cfdc4e235f69d999a934ef8694e
SHA1 4da3cf2043af229e190f1753800add99e1258aa2
SHA512 8012a8b69b32e4734953634f4414767c2df5b7cec482d05f703e86ab2370503201a03091187b901e07220461597cc56ad5f627fe1982c116657b434bd2b75f50
SSDEEP 12288:M3cD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:MMATmhlTS6fg7nNwJFN
TLSH
T119D4230DDF9DBF48FAA849F0D912050AE8BBA9713D41D76377D39442F978801309ACAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 4f8b29c3f15bf118ca990787ff94b0202210f0ee60a4d9fc89404935ee25e751
MD5 cc02bf9b49fc27ec355ef38a7836eaaf
SHA1 4a5ede80c7d30f3e51493d59ea2e008418b4ecf9
SHA512 c49ae874ddcc5421643f8e002189456a5e06a8774b9d0dadaf59e863db5d5f57bf3cbd8121bdc15983ca9ee8cddf33e96aede3be98cb84cb5691dd2ddaca435f
SSDEEP 12288:2l+AcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:rATmhlTS6fg7nNwJFN
TLSH
T179D42309DF9D6BC4FDB885F0C822050AE6FBF8B03E21D7AB67934942AD705413465E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 48f37bc04b2f8a4b54c8c9c343b377b61212474ea7430c52edcd09b638d6670b
MD5 1b7953fa519414975a5b56a62409d37d
SHA1 ee577ec63efcff979e3721f1e1220aeec7e008cc
SHA512 f6274ed45ce24c1dd8d3ff260b67bf10b609660d59ccdad65ef5a1a3b28dc81fe4c88488cfea32c1798e42db850f7d7d0a079dd9214859807b72f898a0910d06
SSDEEP 12288:LGcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:LpATmhlTS6fg7nNwJFN
TLSH
T154D4230DCF9DAF48FBA849F0D912060AE9BB99713C81D76377D38552F9748013099CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 cff4a04f1d0ce29aebb135f8fd88249d1830651cd28b9d56fd7fed42cd889ff5
MD5 fc4b10d2b342b892962e3a061b703307
SHA1 6e84cb9b13f50161863bee32f8599c0c0f349bec
SHA512 60b133c3ef07a51c1c9121050535d68a48758396ffc389c452d5f6152c4e7735535965497edb7bf41a36a2b0770985ff78ae7711278583e26eaa0b5d4587b7a9
SSDEEP 12288:gCcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:glATmhlTS6fg7nNwJFN
TLSH
T137D4230DDF9DAF48FBA849F0D912050AE9BBA9713D81D36377D38552F9748023099CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 e3e555c3719560c1cf26134d2d41ee435090dbfb72a888c82470f14e03ff1ded
MD5 b5e12583ff0471c2bfefc1a14eaba373
SHA1 860295cbcb35d34d6d2d2cb14dcca717d89c23fd
SHA512 5c4cc09d3da6cb5e105c16fbaf1dfb55d7a100b0c12e106a3c0957ce5591cd5e5830ee8f9d379c90c4afe61b1eaa06d3ef004837d448b9f044eebfeac9476408
SSDEEP 12288:9mcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:9JATmhlTS6fg7nNwJFN
TLSH
T164D4230DCF9DAF48FAA849F0D9120509D5BBA9713D81D76377D3C542F97880230A9DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 24d47b77aa805b4f14f4621c5fc8b959e7df095993ff52558e8f2af69ad5cbf4
MD5 8579f141a0287915ec63645a64deb274
SHA1 ac0c5b203033aa0ac3285f5efde4c4101ed2a638
SHA512 c362945b6562c4a0015ed6c8ca10c1d25011230f1a594be0d2ca4f16e17db97ff7edab95ca83ccfcd573bbae782aa15248912ee96f2b8a849a5f92e8fe801eda
SSDEEP 12288:eiZwbXVzIvuS+cPvylcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:BZMFzImSmqATmhlTS6fg7nNwJFN
TLSH
T198150199F3941CF8EC66817ACC124906D6B2BC661A60C71F13E536676F333511C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 16ccefeb8fd05812e052fa84d4e7f891aacaef966857ef7405005cf13783bb93
MD5 d95e7aefd269670c01a804e83834bac6
SHA1 907cecb9c5158dcc5c627804b759905a25b91781
SHA512 d71fdb7cb79fe50b0f9b2d990136a3eb77e6d59614cbd4a275158e81b29b8c1d7842180f325e7dd0d60372999bd86c50106e9e79232983c72176f13c3c201827
SSDEEP 12288:kAcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:kTATmhlTS6fg7nNwJFN
TLSH
T174D4230DCF9DBF48FBA849F0D912050AD9BBA9713D41D7A377D38552F974802209ACAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 d239f42ebaea9349ac934c609c3d7a14fe969de0087d733b714d40f06f056982
MD5 7c50b74aea3ba6a12612ac1c1b7e9f28
SHA1 b790b64c2777684dd30d354e3ed114074735e65e
SHA512 8effefe0a38e2fe9a04cab4c503e41515c9cae65735db267dd2739bb13bd68846097e1a7d170735fcf9a8fe6d5c2f0180e91d42417a04905bf82cb20d9618f62
SSDEEP 12288:CLcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:CwATmhlTS6fg7nNwJFN
TLSH
T1F1D4230DCF9DAF48FB6849F0D912050AD9BBA9713D41D7A377D38552F978802309ACAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 68f2b74a4b66065cc6ad8dcc3398718bca06f75f1bebee1cf8b51f89466936e2
MD5 de0aa4e2cf21835684b185102181d19c
SHA1 694323fdf52216a9bff2f305c8b22b367f47bffa
SHA512 144176d6e5f82ddfec63dc873735e3f3614eac6569b4da4912669686a25ae9fd64f68ca77050b2f11f8045a1e909abe69b05e67eb2a54e972b506362fce79e01
SSDEEP 12288:opP6rLGVcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:G6m6ATmhlTS6fg7nNwJFN
TLSH
T18DF4120BB7A531F8E5758270C8520A06F7B6B8321B20CB6F17A147766E376812D3EF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 6aec5db04363f7d6f640e45865bc83aaa966bdcac9b620a6c6f7aee97709e23b
MD5 4c33beecd13f1b4b41b1275692bd994d
SHA1 09df1499d75bf3f403791c58f90ee1a1be4dd7e7
SHA512 195df0797ba235ae68dc0544c5c0c036096554ba882391bf7951bcf25cab721c90bd3f2208e90e04cdef6a94595da791509702a19aba1c04950c5e615183f611
SSDEEP 12288:46+cD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:4KATmhlTS6fg7nNwJFN
TLSH
T13AD4230DDF9DBF48FAA849F0D9120609D5BB99713C81D7A377D38552F97880230A9CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 886caf3bc94452ba9798d28183528ad6422e2df0e5073ba1c5fbd1bf7660869a
MD5 888b991e10fe6620096d8fed7a87d7a6
SHA1 e517bbd69e645d6acb049e7e0c272ed755f32c3b
SHA512 81bbedd0a7505aae7eedcc0830b37a7a70b598d251ab96d2bf1804b3ac4e5fb499d980df53918e97ae1bef68b3595c82acdcf34c0c4c7a1e6975ca3d98ed3d66
SSDEEP 12288:oScD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:oVATmhlTS6fg7nNwJFN
TLSH
T155D4230DDF9DBF48FB6849F0D912060AD5BBA9713D81D7A376D38542F9788023099CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 7e7a32cddd78538aa4f38c7e9c5d5929f04a6db8fb8a6bb4a9f7a0650e619d87
MD5 432cdcffa13cbccfbbad93e22aacfa9f
SHA1 6c61b5cb1d5acc1484cf175e5b03c22a50dcf78d
SHA512 9a76cf1fe6dc59f00e3fa901cbdac041bf0e36f3051533f477d7af7e6b2a588a49309bdc28be0d7acb70e89b8f083f95f7aea241f643b38ef2251bafc6e92b5b
SSDEEP 12288:5pP6rLGqcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:X6m9ATmhlTS6fg7nNwJFN
TLSH
T13BF4120BB7A531F8E5758270C8520A06F7B6B8321B20CB6F17A147766F376812D3AF65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 bbbe39c7872c8dccfab6b2bc6e48b0e19b4c6435db22cc489be1d1c52f70eaf2
MD5 d4b9f3bc5e719653b68b91c75d33a068
SHA1 a422dd54c86ac964fb89aad358d967580824c47a
SHA512 fe758ed742dfcc6b6b738587206a9e92dc89c4a6b725e3f98215d7021fe22a052c7269fd2e811c1b16504000ea749fbd40ae04c0af04241867f9702da961eff6
SSDEEP 12288:hCd9BgloaLHF3z0z24PDvhQEcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNy:cTtaLl3z0zBUATmhlTS6fg7nNwJFN
TLSH
T1DA150198F3945CF8ED66817ACC124906D6B2BC660A60C71F13E536676F333511C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 cd0f6232813466691605b84f37293a3802bb46a51e6bc14b16eb59c2cce3fbac
MD5 3e05e6b78a76b21e2b9f78b24de1ccaa
SHA1 6e7d31f9d0a16b369b60fe5841bd60c7b6809896
SHA512 195d8efdf06d019f171d65afe1a33827c0fe852d6b85447661e7c48459295d4dc18b67f381e3f8e97440677446218159b64dc991a1fd65e76627dd466d61c92b
SSDEEP 12288:xi4e7HkdafgwCHPy7pLbbdIv2rcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JF:x3NdECHPy7pZgATmhlTS6fg7nNwJFN
TLSH
T10235CF90F3E815E8F1B78A75CD724501DAB67C691B21DE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 b47ed63cf0838e18894816fedb4c0f881777d53fc8a8af09e69fd6a52e7f35aa
MD5 d6fd911e458445e40504490a9711e00b
SHA1 02d204bf35a4f77f8ffb386ceff5bbddbc14aac6
SHA512 7aa345b428704f7ca96d12ff6258e6def9e5d61fa09365052b9f1e4bdb759eb9685078a4b4613a0e4ddf3260c69eb7c7e5a6aca38a48bd216124fc00619a23ab
SSDEEP 12288:WmcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:WJATmhlTS6fg7nNwJFN
TLSH
T19ED4230DDF9DBF48FAA849F0D812060AE5BBA9713D81D7A377D38542F97480130A5DAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 7e9e189dc23e0c04542528ccf4b551cc7225d14e39263a25ce85a29ba8913f10
MD5 6b55289bc99c050c01f2a792994a3b03
SHA1 16049c52d885208c84987809b0492b467a5e94ac
SHA512 d9293b3bc3b626be87c9d451b025c915dcfa5f9177a63796956c3fcdafb566b749ea7ba2992028591f34d8191ca876f2658a369bc0f9fb11271dfe3c0e895dc2
SSDEEP 12288:MOcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:MBATmhlTS6fg7nNwJFN
TLSH
T1F6D4230DDF9DAF58FA6C49F0D852060AE5BBA9713D41D76377D38402F97880130A6CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 39b372d1d3c23336acd0fc326d1849550c2cb47feb64f19b986cf279dc792f34
MD5 e3f0bc3d3a2d51863d2a30084064722f
SHA1 b8b0e677e047353d31a417b6d2e32b7d3148da48
SHA512 de50a086201b059760b680a7745a8ea59084c5757e1919d6863545a5ed3025e9bd5f40e50d888b168c6cad1b2149196dc0e2ea93d298052047e087484858238e
SSDEEP 12288:tmcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:tJATmhlTS6fg7nNwJFN
TLSH
T13DD4230DDF9DAF08FB6849F0D9120509D9BBA9713D82D76377D38552F97880230A9CAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 30ec4025f58642e5fa16d348b7f51435c76278005a6d486bdf92dea9469234e8
MD5 a128e6b3a213c9181624e2ba67f52ec1
SHA1 d039bf722005475d827fd6e24d24e803c740ad7d
SHA512 ccf09927c9338d35e87ec2ff3e475bc108fd1dd496732189367f2e953de79a84f812dbf5865efc9ae7251f64f31790833c488abd0a4aab8c0b642d803ee964cd
SSDEEP 12288:yKcD8D/fdMhzrni0xlNy2z+SJ84fg7dlXFjp+JFHNXC:ydATmhlTS6fg7nNwJFN
TLSH
T164D4230DDF9DBF08FB6849F0D9120509D9BBA9713D82D76376D38552F97880230A9C9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 3cb327e7817135e7cd415f8a2601512d19d07d75ec5cdfea833c54d489a74108
MD5 6c48af763d3e00d3627ec93814d3726f
SHA1 6d41e848b46b74717ac6e2fa55d98144a2aac4e3
SHA512 3e13e467a3fa6ae0cdbf5a783f008a38a81d81b583a9715e456be19042ba58fc08f4918f2f0a75873b0d13014273d1c02d377cb5982e9e49eeb3a5877d82a6c0
SSDEEP 12288:FJTsfVw0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:WVw0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1A0F40109C29892E8D46EA279CB811941F3633C6487F2D2CB53D0F57E2F766909DDA723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 b3af7dcbc8beae6a84d716f711030dabbe839851af2db34e302207f5c4e3a54b
MD5 5e7edeadc9369949754810ad0c6b7a9b
SHA1 28c5edca7a9e30b4cf5c81095fc0f4f826f49e9b
SHA512 90bc60fb82fa3d0a15532835e8c8a7da9c4932d3e0fb0c4bb1335304a88010988112274525ce160e0e17ba45b41060b64fdacdd24e7f5bc6d0963f1d478a5c67
SSDEEP 12288:6d73OK0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:e3OK0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T14ED4230445C8FEF4F860AA3DEAC11801764B72F4CF23C0EB626406AD7A669D59D9773B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4a323903ac7c674115b31d317b006ff38c387b142e4eea2c031ba5988c6ab9fc
MD5 a6894dc0c73e5314db6ced5faf160ea9
SHA1 714a7fefbc0920ab965940731b3fde2c86d29c4f
SHA512 5f628afc0c1e3f63cde189ff35b3067c92d481f51d1e1a2758600bef8ee8d83aedae78f6ca960b763a3328fde6d839b6844d5f0b2ad42ea722c87c23ca886e7b
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYm0gH4Rz4ppQmJTwzFIbmqitQ:tgb4mBIBhGFuDRzQXJTkFIbl
TLSH
T1DA659E1E22E802F5E0F5E2B8DDA64407D6B378164732D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 31d0b999c620330c51a00f5dea5a1a244a162948c6487c90731f975bb0cb8cf7
MD5 73d0af11bad65ac4d60a2bdd3979c9c3
SHA1 2d5e91553fbe567043723c8a4cb165fa5eb8396c
SHA512 b78c6451ea7f5c8d4636a309a206a51e0f57cc6ab878e40b9d72bf7344fb7545116af00d6c1e1aabadeaddc43515e6a00ed8690c08c904860186d23d7a63cb84
SSDEEP 12288:jsGr0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:4Gr0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1FAE4221C10E9F9F4D831D63DD9D01842B9A331E09B22D0FF05E0857DBB56AE16A3AE79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 c20b78a8bd9d7e93882cf4ca9ad6487944d2e02a07cb30375a20a3e47a321038
MD5 6645446dcf1cb603331b6e1a6d06947a
SHA1 f1db35299c1291c0b9b2e70665e8585e782a075a
SHA512 934cd82eb2a1f28529be5fb461549748f23c5671f42dfb67b8cfa86f8214778451f1c3d0977fc51704b8dc8c1fdf9504d68fe88728b1c0976fe1a90c1a80053e
SSDEEP 12288:QwsZ0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:QZ0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T19BD4230800C9FEF4E850AA3DEAC11841768731E4DF23C0EB61A4457E774A9DA9DB777A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4a9249e31b5a672968971dba45216fc98a94842abcd558ae22f3e4a9088aa8da
MD5 638f4066bf5e1f857e6ae8f982da398e
SHA1 80b659f2010c4c3dc76b4a5e7b79303fe4eba6ed
SHA512 f5e487550bc87a75ccaf590745037f7ed24b9136c343c073a1a20abb5b33c2ff154bcd2a7039d40a7bb07ffff09ec01642308a12aca3735d01a59a2314e14a6b
SSDEEP 24576:Kd+8k8FpJqH1Mzria7/m/EA0gH4Rz4ppQmJTwzFIbmqitQ:e9rFPqVra7/OEpDRzQXJTkFIbl
TLSH
T13D35F16566E142F0D477D13CCA820A53F6B2B4250325EBDF07A88B552F23AE54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 1be9c2108b62a9ceef1bb76635cfcc5ea07b301f7146403d690cb3a8f35c738e
MD5 c96f82f86679cd4ec0efcc031aad74ad
SHA1 f154c6e5e0d3ebe38c30ba9aec2c1746b19a7911
SHA512 8d6464dee23c5567827fc5e3c9f351b257e347c0c48bbb4cdb02d7978c8480c0bee1b80f27e6e31cc94962f1d7af48419fe4a547e6041c75ff2e289862946d80
SSDEEP 12288:MHvUrBFrEjwaQe0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:MPUr+NQe0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T19F05E11E21EC1CE4E676E17D89824609F77274620712D1DF02E0817E6F67EE8BD3AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 0b389893f85c7a7d479cfd22f3d86e047844f745ce9ffeb9468214fd92164c91
MD5 dd0e33760a051e22fc5a3a6cfbdd1cf1
SHA1 3a494eaeb066b3b54476b0bbe7f137b29d5a4f84
SHA512 bcb13321b7cf6377dadb6a936f64c3360828b53744dafba95bee5b25fc15707775d6d84d457f4c3a39435b8bd6197c33016e39e29ddfa62f328914b7da6dbd3a
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/DRzQXJTkFIbl:aG05lO43bcclJ
TLSH
T15CD5CF6A62EC11F9D0BBD17CDAC64A0BEBB23415033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c0ebdb7f7777928d62ada73fca2447290cf0e684a9efb78b105c125411b94d1
MD5 68ec737382fdf1a2ca327da9e1a07595
SHA1 ffa07bd43ebc85c5026f9a6c62ee9abb5ec0de77
SHA512 caf5b390175c24cf23757bcf6405231d844a6715312b24f5961f06469e80dbdb72a57a6de6cc4d57ac8b46278154b7115c100c54488b1b5e00e865a1d0cc5c56
SSDEEP 24576:kaa5POZ3dpbWVM50JicR2hG0lasx2+47eidnOSP0gH4Rz4ppQmJTwzFIbmqitQ:5a5POZ3wJt2pasx2+mkS8DRzQXJTkFIB
TLSH
T10265BF5EA6FC01D5D5B5D17DC5834A0AF5B2346153329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 30caf36bbd5116a17e356501559b25bef56ec1cde96606cd8885d46bcdca0463
MD5 5a3869aa76524bbca35a510320824369
SHA1 053d50ec362aa30ab832a6d62ce16004eb1adc3e
SHA512 a0ff8af1df6c452e4bf1eb08f1acd5a3fd0e64556bf4cb7cdc4bfc2d79ce8f1ba4cef176a26aede04da5ecea9837a87ab1b2b19bf08f0bd6b12670b6f48cf897
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7Fkb0gH4Rz4ppQmJTwzFIbmqitQ:yNc/zEOVHFNDRzQXJTkFIbl
TLSH
T1DE858C1622E901E4F5BBE1BE89779546FAB17865533086CF0291811F2E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 ac93113b1b6ed35fbcd2196123919487afc20b6dc81c16cf69890536d94d6dfe
MD5 8c70c73bba79db105a4f07dfd020dd84
SHA1 498df3481c63389c93ada14c081660e43b19e09f
SHA512 78e9e0b55ab95288c3181b6be2a731ac93836b72926f183bc644c5a975cb4d2a96122d94b8931bb2ef7f200c21659767108278ea4a3ed33ae7d901c86f2b96ed
SSDEEP 24576:dJnJPbzB4Sx0gH4Rz4ppQmJTwzFIbmqitQ:dJnJv6SGDRzQXJTkFIbl
TLSH
T19415E13DD2A820E8E4B7C278815A1A55FF72347C2F2269C719B4D5353F12EE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 b3cc3af4658aa58cb435b19d678aefe4cceb89522ad53b173d72db7df382d250
MD5 4c5b82a71f6947591f318a335165e287
SHA1 f49168b0c58b1667a8536bb1e9686690435af96e
SHA512 5290c60e3daa5a1cd4076d78f0962062afdd8b6f231034db7ab79e2f530b4e2aed12ea1a2d2e540ff381eb14de3d250dcb1125a2d6b9e0037cb20e8606dc9124
SSDEEP 24576:HCLHGL0MoeVtFumTijCmlKQWDkx0gH4Rz4ppQmJTwzFIbmqitQ:HCLHGeeV5ijCmlDWDkGDRzQXJTkFIbl
TLSH
T183A56C05A7EB5184F8F3CAF5CA2294169A327C549B34F7DF4A80C96A2E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 cbf32c344238b04aef4341001765c58af7f3b9fafa39a8fff2ad6ed7d3c89db8
MD5 91d2aebe334515e375d97ddd282a616f
SHA1 de680498159ae02e3cffe74829bf277dfcf5a2db
SHA512 c0c0ba8143ae2cdf373cd1a94f04bc566176ca415a446829fef6fc638a39763c186b806211c36b961fa616561bc6432fc1ed02838458d2e14d94a22eb54e5910
SSDEEP 12288:C1Hck6j5ZI7m0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:e6DIi0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T11EF4F11C22AA61F5D067D03DD6C20502E6B3B1B0C72295DF06E4C5BE6FA3ED8B939E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 7bd92f4c6cf253fe4d09227d8422248adfe24fcaa22d831df275e239afdee039
MD5 76ea2467ada617ebd256aefd2f3e4ad3
SHA1 da180ed3f55cd2e7a631cdecb68998afe1380eb9
SHA512 2a4ca1a761d5f056489c2c614f6284415566fccc2e2f8ac84246dffe91fde2ee5f28e884ad530a8c26c41c4976c9e5eb555cb133589e0c06d85766d2915efdcb
SSDEEP 12288:vG6kyh0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:etyh0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1BEF4120452D8F5E4E975563CDAA20481AE7778609F22C1EF11E0963E3F36BD5AC32B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 20cfb0293f86413e85abc9c3627155faa56c6d03047849f48b9ae2085c6e509b
MD5 4061f7d328bd778ecbf1b1a4d7774b45
SHA1 c57c1439d9c8566a9d785e549d9ec727b1c111e6
SHA512 f7b39161b015eefe6df29c3b93a7fd2f919db36a6fc817605785bc463e8cf896a7419fc7dc5510483f43e4766d1397cabfa8c57ebfdccabaa14dabfdbf06821f
SSDEEP 12288:pq90RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:090gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T108D423084089FAF4E810AA3D9AC11841B58731F49F23C0FF25E0897DBB5A6D69D77B76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 c5ccc7be64c686692c45c8e49cabd2e1593ca88a21fb012e0f18848edae797c7
MD5 f5f5aaf502a1039c3fba15d64eff02c2
SHA1 ca58f2e621b3c4da37c3d2ac6f8042d80a6fcd91
SHA512 c53f6ec048ded8b999895e41a6c9bd806744ac6f41ad2e8b10a5963cac1f89e043a096e8662e9371876c8dc9a1656a43ea510e23d9b8fa41d321a3041544be01
SSDEEP 24576:nggILoTfaidZm0gH4Rz4ppQmJTwzFIbmqitQ:ggHTrZ3DRzQXJTkFIbl
TLSH
T1A9559D1D63EA05DAE2B2D639D9721483D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 2d6819eaabdc6a78873f8da0f7d1cacfa29008cb99fb45e9ace1dbeac3167e1c
MD5 132a8b304c5c9ba5bd1140a55d4e06a2
SHA1 34b5a9434030b1f9f650ae54cbd2c6c49c093776
SHA512 06f89fc59dec2b7f5dcd289630709771dfd08ea4c07014f4b4124fdce3aa4dc9497412c4e2a610bb0259ab2bcffeec1e9c56b38581bbd587a04af2a0f42c9de7
SSDEEP 12288:0pJcm8CNj0RqH4RzuJ5pcWQmJuafOtzbdKSp+9bmOEMtC7mEmjkC:0rcmRj0gH4Rz4ppQmJTwzFIbmqitQ
TLSH
T1E205F00EB2AE50F5E1B3D23CC9810542F6B37070572292DF02A1877E6E57AE97D39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 f4b92f75817ae20a015b795b8239069b9209fd53a1d2eb1ed497077b9ebe1536
MD5 d11e5eb2987bafe21b9eaeb37466a7cf
SHA1 a1abd3ac3657ba669fc9214e2d6f50f468a125fe
SHA512 bb8e5efb66789b6c847930ce13ec422f5ab3429e1388bafebaba28215336982fb29a087983a9202d9a6076cabff900e88b15e833472c276ed342fff41cbb407d
SSDEEP 49152:hDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3xDRzQXJTkFIbl:S3Upow8sBqclJ
TLSH
T124A58C3DA2E810A8C9AAC379C54213A6EA71742D3F3055DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f223979c201267ba4e3b9f87eb803ab2a4cfb702f8706a191c650129be256cd0
MD5 040648a2c6af1e4abc8741eb83a52ba9
SHA1 bbd9dd2b455212067ea9575efbc6da08ce473bb1
SHA512 5bcaf6d58a69667e7f027ae35cee1ac50902c56fa7a2bd4ad147ebb4742c5fac0071fb55a927ad43586eec7efaea886900bddff8b134f55f211946ca6c463cd1
SSDEEP 24576:rTkNvNnaFeYhJNtmZBmJ0gH4Rz4ppQmJT:rTMwBtOmeDRzQXJT
TLSH
T15F558E2EB6F806E4D1FAC6B5CD238512EA727461173293CB5390C13E0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-323-0x000001C3DA960000-0x000001C3DA9C6000-memory.dmp

Download

memory/1228-388-0x00007FF7DACD0000-0x00007FF7DAF72000-memory.dmp

Download

memory/1228-324-0x000001C3DA960000-0x000001C3DA9C6000-memory.dmp

Download

memory/1228-322-0x00007FF7DACD0000-0x00007FF7DAF72000-memory.dmp

Download

memory/2052-390-0x00007FF659220000-0x00007FF65955D000-memory.dmp

Download

memory/2052-389-0x0000021A367A0000-0x0000021A36806000-memory.dmp

Download

memory/2052-448-0x00007FF659220000-0x00007FF65955D000-memory.dmp

Download

memory/2052-391-0x0000021A367A0000-0x0000021A36806000-memory.dmp

Download

memory/2136-255-0x0000022DF7660000-0x0000022DF76C6000-memory.dmp

Download

memory/2136-301-0x00007FF7BEA70000-0x00007FF7BEB88000-memory.dmp

Download

memory/2136-248-0x00007FF7BEA70000-0x00007FF7BEB88000-memory.dmp

Download

memory/2136-254-0x0000022DF7660000-0x0000022DF76C6000-memory.dmp

Download

memory/2504-39-0x0000021C00A60000-0x0000021C00B8C000-memory.dmp

Download

memory/2504-40-0x0000021C00CB0000-0x0000021C00D16000-memory.dmp

Download

memory/2504-41-0x0000021C00CB0000-0x0000021C00D16000-memory.dmp

Download

memory/2520-339-0x000001E49F230000-0x000001E49F296000-memory.dmp

Download

memory/2520-338-0x000001E49F230000-0x000001E49F296000-memory.dmp

Download

memory/2520-340-0x00007FF74DF50000-0x00007FF74E26F000-memory.dmp

Download

memory/2520-344-0x000001E49F230000-0x000001E49F296000-memory.dmp

Download

memory/2520-346-0x00007FF74DF50000-0x00007FF74E26F000-memory.dmp

Download

memory/2728-446-0x00007FF68CE80000-0x00007FF68D385000-memory.dmp

Download

memory/2728-369-0x0000029BBF490000-0x0000029BBF4F6000-memory.dmp

Download

memory/2728-370-0x0000029BBF490000-0x0000029BBF4F6000-memory.dmp

Download

memory/2728-368-0x00007FF68CE80000-0x00007FF68D385000-memory.dmp

Download

memory/2760-265-0x00007FF694AE0000-0x00007FF694C28000-memory.dmp

Download

memory/2760-312-0x00007FF694AE0000-0x00007FF694C28000-memory.dmp

Download

memory/2760-266-0x000002262BC30000-0x000002262BC96000-memory.dmp

Download

memory/3144-351-0x00007FF6DCB60000-0x00007FF6DCDE9000-memory.dmp

Download

memory/3144-350-0x0000017E8F420000-0x0000017E8F486000-memory.dmp

Download

memory/3144-352-0x0000017E8F420000-0x0000017E8F486000-memory.dmp

Download

memory/3144-444-0x00007FF6DCB60000-0x00007FF6DCDE9000-memory.dmp

Download

memory/3252-358-0x00007FF754A90000-0x00007FF754F5F000-memory.dmp

Download

memory/3252-359-0x00000232DF1A0000-0x00000232DF206000-memory.dmp

Download

memory/3252-360-0x00000232DF1A0000-0x00000232DF206000-memory.dmp

Download

memory/3252-445-0x00007FF754A90000-0x00007FF754F5F000-memory.dmp

Download

memory/3508-284-0x000001CB26DF0000-0x000001CB26E56000-memory.dmp

Download

memory/3508-283-0x000001CB26DF0000-0x000001CB26E56000-memory.dmp

Download

memory/3508-364-0x00007FF610F70000-0x00007FF6116B2000-memory.dmp

Download

memory/3508-282-0x00007FF610F70000-0x00007FF6116B2000-memory.dmp

Download

memory/3696-55-0x000002BCABB40000-0x000002BCABBA6000-memory.dmp

Download

memory/3696-49-0x000002BCABB40000-0x000002BCABBA6000-memory.dmp

Download

memory/3696-58-0x00007FF6B6580000-0x00007FF6B66E7000-memory.dmp

Download

memory/3696-47-0x00007FF6B6580000-0x00007FF6B66E7000-memory.dmp

Download

memory/3696-48-0x000002BCABB40000-0x000002BCABBA6000-memory.dmp

Download

memory/4172-377-0x00007FF764B00000-0x00007FF764F15000-memory.dmp

Download

memory/4172-443-0x00007FF764B00000-0x00007FF764F15000-memory.dmp

Download

memory/4172-304-0x000001C32A4B0000-0x000001C32A516000-memory.dmp

Download

memory/4172-302-0x000001C32A4B0000-0x000001C32A516000-memory.dmp

Download

memory/4172-441-0x000001C32A4B0000-0x000001C32A516000-memory.dmp

Download

memory/4172-303-0x00007FF764B00000-0x00007FF764F15000-memory.dmp

Download

memory/4656-349-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4656-270-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4656-271-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/4656-276-0x0000000000980000-0x00000000009E9000-memory.dmp

Download

memory/4660-332-0x0000026448F00000-0x0000026448F66000-memory.dmp

Download

memory/4660-331-0x0000026448F00000-0x0000026448F66000-memory.dmp

Download

memory/4660-409-0x00007FF72FE60000-0x00007FF72FFF3000-memory.dmp

Download

memory/4660-330-0x00007FF72FE60000-0x00007FF72FFF3000-memory.dmp

Download

memory/4820-291-0x00007FF7ACF40000-0x00007FF7ACFEC000-memory.dmp

Download

memory/4820-292-0x000001DFECD70000-0x000001DFECDD6000-memory.dmp

Download

memory/4820-293-0x000001DFECD70000-0x000001DFECDD6000-memory.dmp

Download

memory/4820-367-0x00007FF7ACF40000-0x00007FF7ACFEC000-memory.dmp

Download

memory/4836-245-0x00007FF75BB00000-0x00007FF75BBC7000-memory.dmp

Download

memory/4836-250-0x000001F7A1520000-0x000001F7A1586000-memory.dmp

Download

memory/4836-249-0x000001F7A1520000-0x000001F7A1586000-memory.dmp

Download

memory/4836-298-0x00007FF75BB00000-0x00007FF75BBC7000-memory.dmp

Download

memory/4904-30-0x000001D1BB1B0000-0x000001D1BB2DC000-memory.dmp

Download

memory/4904-31-0x000001D1BB3B0000-0x000001D1BB416000-memory.dmp

Download

memory/4904-33-0x000001D1BB3B0000-0x000001D1BB416000-memory.dmp

Download

memory/4904-32-0x000001D1BB3B0000-0x000001D1BB416000-memory.dmp

Download

memory/5152-447-0x00007FF715110000-0x00007FF71523D000-memory.dmp

Download

memory/5152-379-0x00000188BB850000-0x00000188BB8B6000-memory.dmp

Download

memory/5152-378-0x00000188BB850000-0x00000188BB8B6000-memory.dmp

Download

memory/5152-383-0x00007FF715110000-0x00007FF71523D000-memory.dmp

Download

memory/5248-60-0x0000018D92B90000-0x0000018D92BF6000-memory.dmp

Download

memory/5248-59-0x0000018D92C30000-0x0000018D92D5C000-memory.dmp

Download

memory/5248-61-0x0000018D92B90000-0x0000018D92BF6000-memory.dmp

Download

memory/5452-237-0x000001393DEF0000-0x000001393DF56000-memory.dmp

Download

memory/5452-290-0x00007FF75BB00000-0x00007FF75BBC7000-memory.dmp

Download

memory/5452-238-0x000001393DEF0000-0x000001393DF56000-memory.dmp

Download

memory/5452-236-0x00007FF75BB00000-0x00007FF75BBC7000-memory.dmp

Download

memory/5744-73-0x00007FF6FCB60000-0x00007FF6FCC81000-memory.dmp

Download

memory/5744-17-0x0000028F1C560000-0x0000028F1C5C6000-memory.dmp

Download

memory/5744-18-0x0000028F1C560000-0x0000028F1C5C6000-memory.dmp

Download

memory/5744-16-0x0000028F1C560000-0x0000028F1C5C6000-memory.dmp

Download

memory/5744-15-0x00007FF6FCB60000-0x00007FF6FCC81000-memory.dmp

Download

memory/5844-7-0x0000000000C30000-0x0000000000C99000-memory.dmp

Download

memory/5844-6-0x0000000000C30000-0x0000000000C99000-memory.dmp

Download

memory/5844-27-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/5844-0-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/5844-1-0x0000000000C30000-0x0000000000C99000-memory.dmp

Download

memory/5876-385-0x00007FF7E0830000-0x00007FF7E08E2000-memory.dmp

Download

memory/5876-313-0x00007FF7E0830000-0x00007FF7E08E2000-memory.dmp

Download

memory/5876-315-0x000002267F3F0000-0x000002267F456000-memory.dmp

Download

memory/5876-314-0x000002267F3F0000-0x000002267F456000-memory.dmp

Download