af2c63b6a30c9231bead6d672b21c55515d5e8d4aa5a409807ffb5d5026b2773

Analysis

max time kernel
139s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 928KB
Sample260808-c2klfaydkd
SHA256 af2c63b6a30c9231bead6d672b21c55515d5e8d4aa5a409807ffb5d5026b2773
MD5 debfeeb51838431233eb6a0fb52cedb8
SHA1 e89f029d50610c59b97af0d6397cdc6dc2721227
SHA512 b9100eea5e0e2f32b027da282a81d9561c653db8b267665b0e6c99650dea28d3e0f6cb7ef9c5d3e788b2ec6ff1ffc1f7478b9975845e584a4e03bf8f9d450d2b
SSDEEP 12288:/AwSfxL/2Dc3bDLLmt0LDQewsAj552HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3L:4mewsAj54tPpUNMCte7KW2qIoSFG3sU
TLSH
T1A215E031FE74E432C67F0DB62B25D71A542D79204BA12AC3E3F88E9E49741D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3840	alg.exe
4356	elevation_service.exe
4628	elevation_service.exe
4604	maintenanceservice.exe
2992	OSE.EXE
5572	GameInputSvc.exe
1968	GameInputSvc.exe
5948	msdtc.exe
4864	PerceptionSimulationService.exe
4956	perfhost.exe
4244	ReFsDedupSvc.exe
1976	locator.exe
5680	SensorDataService.exe
1640	snmptrap.exe
1504	ssh-agent.exe
1696	TieringEngineService.exe
2852	AgentService.exe
1488	vds.exe
3280	vssvc.exe
1616	wbengine.exe
6032	WmiApSrv.exe
1100	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e148baef24febf98.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1968	GameInputSvc.exe
1968	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2936	2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeDebugPrivilege	3840	alg.exe
Token: SeDebugPrivilege	3840	alg.exe
Token: SeTakeOwnershipPrivilege	4356	elevation_service.exe
Token: SeTcbPrivilege	5572	GameInputSvc.exe
Token: SeBackupPrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1696	TieringEngineService.exe
Token: SeManageVolumePrivilege	1696	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2852	AgentService.exe
Token: SeBackupPrivilege	3280	vssvc.exe
Token: SeRestorePrivilege	3280	vssvc.exe
Token: SeAuditPrivilege	3280	vssvc.exe
Token: SeBackupPrivilege	1616	wbengine.exe
Token: SeRestorePrivilege	1616	wbengine.exe
Token: SeSecurityPrivilege	1616	wbengine.exe
Token: 33	1100	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1100	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1100	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 1968	5572	GameInputSvc.exe	96

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_debfeeb51838431233eb6a0fb52cedb8_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4628

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4604

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1968

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4956

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5680

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1640

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1504

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1696

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1488

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:6032

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 dc6a45e5a55f771f4d5e9b4d0fa6cbc14ed17d72e4a668efd87e0d784601d398
MD5 fc54b713636b39a98f35e846032d1bc2
SHA1 5eddd0d63ab65ebfa0c05eca7874404c8b648237
SHA512 543917adf1bca80b6451079f350f86a3dc43eebb7bf3068485991fe19934f2eff5c82325d894c9ebbf76a7670ead9ffc9e5270cdceb3e8f76a2382f0447156f0
SSDEEP 49152:GyLk32BuPkFKRrdE6oh7stBhuXjfS4LWxnKcpiMCte7KW2qIop:Y3q6gjBhcpiMPL3
TLSH
T19CD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 34c186fb6de988cc52c15834e151a2d4b7027e8837a202ecc4e59acdd7a4e27a
MD5 724685e94032504729e7eb183fe53c6b
SHA1 ed75407f86659c9570a612fce7681667656ee3a2
SHA512 cb0578d6d64fd3bfabefb2249be38d102fec9c9d7f6fe0c7a142a50d6769a73ab37bc9206d12a91721beea009da5e8e5aa69a753c7d1f93777dc0782f65f3112
SSDEEP 24576:/XYsVTczAR4tPpUNMCte7KW2qIoSFG3sU:1TcAcpiMCte7KW2qIop
TLSH
T12A05F16977D009F9DC6B813DCCA19516E733786147A0EB4B03F49A7A0F232985E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7c17d999524ff1b5fabfee9693af38b64528056120053b0994ca097d7fe7ebef
MD5 12206417e79465bc4aaf8a1ac79d1927
SHA1 7fd3c09630b3dbc7ecabb0a05917082f2e85bcfb
SHA512 90322e336c2f1f27b80108d16b9cc36646768991b1868ccca53912a97102949527fdf9f3eeafaa15bbe1514b50a34e55f00add6d20a597ebf2ae4af21a2533f2
SSDEEP 24576:w0Qe+s/0jNxOrMl4tPpUNMCte7KW2qIoSFG3sU:w5s/0JoccpiMCte7KW2qIop
TLSH
T1FC35AE56F6748731D073C0B9C5D2A68EEE72308217308ACB4296D77C6F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a6b7151c82d072719aceec4858f19ae93984bd8e03cc2fc074b8da0aed1d5c01
MD5 032cedc4521f4ede4d2b910888513bc4
SHA1 c738195464002f7ae5022231bf55ecf99128cfbb
SHA512 52f6608c3398a132119d27064d75daa323b45a1ade07d770509398ae6cc4c3fff852679727601166113303059eed34f4fb8ea40f7e651c6f64bdde84b1302cf3
SSDEEP 49152:h/ezSC6vUzPvuHjyacpiMCte7KW2qIop:hezSC6v2XuHfcpiMPL3
TLSH
T112756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0811bcfd70409c769d5f4612269354f32747f308e42a9bc546a479d5a04c1da0
MD5 d63eef91251deea114d7afcfb770dd6e
SHA1 15e2bc6cd1e08dadbf391817e8fa9003b4bfde06
SHA512 77691133bc8ddb64468f509d444304e5393f3bc7ce53e96495958f87364bd15ff4ffad61a66e3430e397ab4e3853c4e6c3674d71246eea7f7f98f255034556e4
SSDEEP 24576:eabWPWjfFv/l+dq4tPpUNMCte7KW2qIoSFG3sU:eaPjfFXl+gcpiMCte7KW2qIop
TLSH
T144559E66F5B48331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 83884f742cd82a144f1f5062bd18eefd12cc699ef0d08d27899f3fca428113c5
MD5 cece25116ab35f0e43d6a52ef3a8d1f8
SHA1 c2d6ea9027da6508ddc56c7ecbf854c3e84e9968
SHA512 ca125adf386c46fa62bc43ea73d7a9ead5447f1183002c1035cb6e1757ee731565edc721b931ff9d4275d71671af0d2ffe34e4406456a4552471c65db5166db3
SSDEEP 12288:QDF52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:QDF4tPpUNMCte7KW2qIoSFG3sU
TLSH
T112D423C66DD06482CE7FA8393CA8B61F47237D7125A1AE0F5AF2FB2E4E790C16115253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 e3f65c9980a4a61c9f3090386bd5b383d55244dc79022a80bb46adf0962b9a10
MD5 41bd3a7d480d5392599d27ed38d3bc33
SHA1 6aa371b1833e109196cc30fdfaa6735177b3f195
SHA512 3ec40d5292fa93170a42947b0ed8dd2be2c177f60f7d21c394a54543867922caeb714afbae876b54a5497dbfd339d7d8262334c3a960bb91ebb3b2538b811154
SSDEEP 12288:4EBNUbTVO86Ux52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:4XIUx4tPpUNMCte7KW2qIoSFG3sU
TLSH
T15715CF7BAE28FCD2C67E9D785A918600D77278304B62A7CBD175C30ECE235D11E7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 6e230499aaa59c1eac3124b9f5d6faab3d7d21c0669d96f88288e868dd38d3b3
MD5 d5e8dc418a562b08d78ebb5b010176c0
SHA1 73d0dd1429dcbc5f5eea9cdd3b169e9ce7d1ce87
SHA512 da5b14570d008ca6c938b52d62b83fd3fbd38f4d5e378b3cb49cad980807b780e667108d32eef7cd866705652173ee6ab7e9c37d471be90cb69597a0a39f9b81
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THY:1QvGAdlCEL8c/NRNw5CQcpiMPL3
TLSH
T1D3367C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 82b5da8011e9108d890206096ffba038cc4527b0d759093ffda6fd5bfa24e629
MD5 559641cdbf737156daaa0a30d6bb0571
SHA1 68e2f45ac619a11ad2d5ea0c44b48303e1126a49
SHA512 cd1668ac01a3cf537d870fc4cdf154cc0f63fb020ab94e60dac0622b259350dcc557781da22ad07f1e56d5135a1fe4e40d6447d38d76014a70a62394e3304163
SSDEEP 12288:KrwSfxL/2Dc3bDLLmt0LDQewsAjDM52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+7:kmewsAjo4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1E715E031FE74E432C67F0DB62B25D71A542D79204BA12AC3E3F89E9E49341D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a69d5a5b15c3b37e43e07f840de3ba7cee7d9bfe5f8c518c3486603ae1b5050b
MD5 d8b443bc606a2d95dfd5b789560e8243
SHA1 d0423e28ef370fb2a794d468da423b3731e61b61
SHA512 c176756586d020b988a368f88b8fd2f01e5c18f1393f3afd2dfa85656b2ef23c641630e5ab3277c3af36a7abf1f87ca5fe3790f64596c5e87b86bfc2e8de4296
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHa2PL:HUEtQevvqc2W1cpV2X132j
TLSH
T1E1474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6e6c96dcbda8533509170ada4afbeff2c13816e304fd55c058b37692c068e163
MD5 a5657626bff317788fbf74ea5e19cb98
SHA1 b5301140bfabf94be4b4308c9c242da930f1c1cf
SHA512 9aff7bcf7ec8e2e7dd7cd0f06ded508b23a0801693e21a46805718a66424e680ceff65a44737fe157c4cb671d4d61bb8f48d5869764cacac9ae18cdb5afcc6c5
SSDEEP 49152:J/5RquA/m2yL5zMfFiV+XenmE3/zCcpiMCte7KW2qIop:boq1Vjnm1cpiMPL3
TLSH
T1A6D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fb42927577db1a6aa2a91eb35f73d5cb01cc7f1556f8579dfebae4c2cbcd9ddc
MD5 9d2648a18ad30530fd0217df1cf4ab26
SHA1 02babae0dfeddb349b99707c4f8d4b82f130c896
SHA512 5df9870710bcd9e905c9f2d31ab00ddabab95eda2c9bb8f9580002470576b02d80aa1bc8222e9b62d6fde46284c4ae4571b339fa8b8538e3a949b6317b5c8e07
SSDEEP 24576:BAhGLvNFoiwtA5l7S53R4tPpUNMCte7KW2qIoSFG3sU:BAMhFoiq5BcpiMCte7KW2qIop
TLSH
T1EE45AE81EBF955D4F5B3AA7899B69171EA77BCA65E31C20F2160C21F0E33A409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 58f6c1442d8a27993506c472574f23a1260bbeb8c5ce59132e31706e8bfd9466
MD5 8d036cf3d84e20a97437bb9c3e0d6ae2
SHA1 48cfe3a78211508c30f1bb9e6322744e2b4d9923
SHA512 cf2a37653e37d13f2790dd7298c8a3fb88c964493f6d0f0a4291f31bb6f3e53e2d0f4856a680f960057419be73f7598531168ec7dc8670f0d8d0f9d1f46a8528
SSDEEP 12288:Vmw5HEjsChNnBFgl0WDm+C952HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:Qwu+OWm4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1A005F18A36E41CF9E96785388997D136E7B3BC122A21DB1F07B0C72B5F272516D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 444a3a9e7e7f1b0cb9d15bafb7e1fae9d7f2b541f8a1bcb060eb96c781bd8032
MD5 b8883bb34637ee2a5237427f04cb2ede
SHA1 034e75ae82bdb76802c424fb84d7d0a9fb6ecc9c
SHA512 89613d5dd0b4b0765eb69ed3382a85b05fb67925123b7b20207fbd9aa1910f8c9d5fcec5252d1668226c47bde0260329ae516815510d84999b0f17f0cd580d19
SSDEEP 12288:FXa1ICc52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:paud4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1BAE4128A36E030F6D5AB953C9CE5660AD7737872237297CF1671876A1F236C11E39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 080504cb4fe9ed3d6acb9540510015f678a51280b7cbec0f61753ce2522004d1
MD5 06b9be2b91f2716fddab431f533d2040
SHA1 8f4784f0aa383264fd0a5dcdc4c34889e5f1fade
SHA512 2a1efcd0c62db4d1d0c5900d8948b4fd682554283c4b8ae4cc9bb67b2dcbeee77096e7e66358d716a6d3267032151acd56b70aa91f0994c58dd921709ca3e27a
SSDEEP 98304:xQRQyi36YOcP8Lvw2gAf+PN3ecpiMPL3:oQyiKa+X+PNu2PL
TLSH
T16E667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cd8049297e257e20eb2f388bf3f43f453e81ba6748172f90d5bcaa0a0b8ad44f
MD5 dece47de7ebb6d85a3930cf2cf6d4ebc
SHA1 5f5a61237b88eeee31ceedeafd151d43773631ee
SHA512 1ae968b4bac7b825307fa3a26ade007f28c2b76424448dd392bd85c56d5f7a62c84a3c245cf8aad57de597c16817f1d163ddb75aa77eb1efaef3fd4ecf96fd14
SSDEEP 98304:xQRQyi36YOcP8Lvw2gAf+PN3BcpiMPL3:oQyiKa+X+PNx2PL
TLSH
T150667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4152ca2ae06da8ade70f0b32f9a11de015cf580cec813ae6b8ca01287f0d15c
MD5 7b9f09e823914480ba0086cb10c7b8d7
SHA1 6afdcc973fe32ba483b142132131944dd7d286b6
SHA512 674a8393d47943d54984dd257c529a9810c99c5a1375b12124f375b7f0abf8cc74a8a2bb8c0ceedd34098561e597980b1ea5740c80662950d062ae6655d85696
SSDEEP 49152:P68Qg55nhMeWu7PNU3/BcpiMCte7KW2qIop:JthbRc/BcpiMPL3
TLSH
T10BB55933B2F20099C44DE1769F4A972196D27C718FE0E7DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3b162ddbfcef0c68d8d9ad071b7b0d821563c704e6bf66e2b718a85a3581fd07
MD5 b375525a3776c291e21256397f723e07
SHA1 ab33fac14d58d2ac5f14f472b7ca24883066be3f
SHA512 5c20eac5e8dc7a135df3e44d2d3134865971288ef3431d6f462b5547a842b3ce56995191355c12843091b4fb3d1d3621f6b273e0e9b340cc07c2c5518434d9e5
SSDEEP 98304:qy5112gYy5azzVv569nLKnhZYcpiMPL3:TLIHAWhe2PL
TLSH
T1D3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 0eae268555fc3396acce2416b20b9d1ebbd6f97ebb5d2a9ba38c980b9ef64faf
MD5 a98a0281d69a3e8083392276423d1011
SHA1 5bbe71c295f6db56ca62083e6e57198bc8e28f99
SHA512 35b9603165fa7df912288540b59c0d6fa3909e25d0fd31e133cd7d1cbbde3b309aa442ef0d855ce49fec6ad2af19df4ed098d2a3344600e18efc656ad1ff372c
SSDEEP 49152:2Z+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl7cpiMCte7KW2qIop:Uu6JmTxd2d7cpiMPL3
TLSH
T12FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 32492e106c0c3a42d9e0788bfdec2491249fe5eda8e2f2b3f41d4e47a9985b6e
MD5 da723364264ef09d59dfe79cf25b503e
SHA1 dd8f4195dea333bca044fc6ee2923b35d3c792ee
SHA512 42492e38c6b00b9a249b15872cc2680881f4c73178136d3ca07700f9bc1943c45d87549dbb8f89f1ef504bf985fdcd82a7250e1a1119621cfca07be11398fcc2
SSDEEP 49152:T1hpsNoJpF1A6UU44CwH7R4xwcpiMCte7KW2qIop:TmifPbRVcpiMPL3
TLSH
T105B5BE13F2D900E8D06ED17887569232EA62BC460B31B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ee268e3e2c3d2fc51660f9745837b58fc40f8b654cb3af6a83ca76c41df96545
MD5 f46691253066ae9df6c73c65d25c5590
SHA1 73996c655f52d7f54567ecb488cfe46a6d753495
SHA512 b13583cdba8f21349de4c36af3b77d1de41277ab8bffe42d93d68873435d0ca6ce34e4cd641da07a1f5a318f2ef9c1ac151998a217718acf4eeaea89793a2c6a
SSDEEP 49152:JSuZQIY0Be2K6RVtOnks6NMHqLcpiMCte7KW2qIop:H5dKoi61LcpiMPL3
TLSH
T1D1C5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e389495ca9ed06ff9599440f98c23d58227ca3d9e03ec4cc85c1eb8ad35e806
MD5 b5f897756df7203a83cf3edb4f69ea01
SHA1 5437ac88c8d3414fe4bf395f0fcf2639148b3df2
SHA512 ecc7c13a655904b2240bf75b2f895eaa5d79915317bd5eb8e0896c5ab498f11281159c1f41b20468efb6c1252d6ef29212ad4b2426fccd8a3f4cf3a01a2eb0cd
SSDEEP 49152:p5iSn8EApI0figTgiDn0AP5w7cpiMCte7KW2qIop:PX2iyphCcpiMPL3
TLSH
T1D1A5BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 599KB
SHA256 0dbf38d4ecce6fb8c48925e080e370587f943f4e4efb85c392e7fb14af747084
MD5 fe6e0315324e03835d58a26902a406d1
SHA1 f8c76670f924bcf3acc526ffad64a189180f9936
SHA512 b1fa9a2d508981765de2f913d4f9522681d7127daf244101d568467b65ffb113170173189613d8e69a61884b65333fb357b05dabf3275e787d7fb2c1a5853c52
SSDEEP 12288:uGC52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:ub4tPpUNMCte7KW2qIoSFG3sU
TLSH
T15BD423CA7CD16982CC2E983D7C98730F97277D7276A26D0F6BB2D72E4F5A0C12215252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 599KB
SHA256 04dd67510fc7bea7f8d764ff2003bcf7c1e22268b41cc51ea7d5ca23cb5b9ae8
MD5 6789c4762683140bb091c005c6771003
SHA1 9156a293d0936d4e6094fb9ef6e5f796925d8e06
SHA512 ace62fef77dccfdf723a851da73135671781a28a72872d347704eb305c7afaa8c8f1d62f670239e6e1eb353d005811025566829fdee370c139857d542b99270d
SSDEEP 12288:sU52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:sU4tPpUNMCte7KW2qIoSFG3sU
TLSH
T192D423C67CD12982C82E983D7C98770F97277D7275A2AE0F6BF2D72E4F590C12215292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 599KB
SHA256 493d9b0852455779b5064d4a2a2ae020508a8f04d7ec1426e8a209ee52479c94
MD5 25c71339430ac9effcaff88ded714c6d
SHA1 4e4d8c5ab72e81866ee47eb426d470a9ec191582
SHA512 517f65f0e6e8ea9cf5dd7de6ae185e8ee3d39df234891d6595b724080ad5a083ccd948d732f09099d263f11c06919f4c716e0d4abba837e05cdcf87d38a7d6b8
SSDEEP 12288:O4152HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:O414tPpUNMCte7KW2qIoSFG3sU
TLSH
T169D423C67CD12982C82E983D7C98770F97277D7275A26D0F5BF2D72E4F5A0C12215292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 05ef7effda5b59b7a1171b04d4f1f9d8e477b14614a8337b857f2c4ef5e3652b
MD5 75dc900df6373a6716bd10a43004f0ef
SHA1 96bba843963d5e8001c7fdea937adf01df774c10
SHA512 005bebde4f46131e7f3ba75c12ad97d772560ef38f9a0bdfc77f391570b72fe85145c18e4b580540b2e4d455b0fceb2cc0d4d9c024dbada20c0e030753511dee
SSDEEP 12288:zlV52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:v4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1D3D423863EE114C2C87AD93CACA5A61FD3777C717672AF0F5BB28B2E0F652802515352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 599KB
SHA256 a2e18f968483388c921f9fef11cea647d201508f922e216c072a267fa8163c0f
MD5 8073ecb923c6f8e9e36d0b2285be6a55
SHA1 ee3fabcb4ffc21d863087d87a9c01c54e5393af7
SHA512 50bc79070821394f81b97a226f002fc3d821230e134b4477c42f264a4662f9694aa5525ceaebba708bcd7df879fee7df6d6a4325d8bdaca9aa4469f77584b7ca
SSDEEP 12288:1r52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:1r4tPpUNMCte7KW2qIoSFG3sU
TLSH
T16ED423C67CD12982C82E983D7C98770F97277D7275A2AE0F5BB2D72E4F590C12219292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 599KB
SHA256 fc15939b0872d3c251d48aa193dee41f4c66b2554dc9008761f9538d45770ce5
MD5 9fea6070b2d860a63c6da08bcd623f67
SHA1 e30982d6f06a740fc643325574e19d5ce8b8e21d
SHA512 5de2d2651c9fee4379b73682e4168dad6e996c4a7fb727cb8c4c4737cf283b9b2957432f755e5c857ee6e39a68b69da3ace7852a3375c8de6567bb5ef244952f
SSDEEP 12288:WD52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:WD4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1DAD423C67CD12982C82E983D7C98770F97277D7276A2AE0F6BB2D72F4F590C12215252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 599KB
SHA256 e9f50e3aabeee3a64da428b404753803f8c1a8d90312779e78b96dbd0c812dcd
MD5 82b1a375b0fde38400b76e19c49ef67f
SHA1 115b3d8b4ca1d23995eb40f555113bc221a65c32
SHA512 7cc876f31f86cab6db31d5ea2a16879469226434e89435bac94213e966b7a1691f87fe404ba2c060bcfbbd308e04996cb841bf2203a7446a9475dd376bb6d570
SSDEEP 12288:wD52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:wD4tPpUNMCte7KW2qIoSFG3sU
TLSH
T18FD423C67CD12982C82E983D7C98771F87277D7275A2AE0F6BB2D72F4F5A0C12115252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 dee7d85b1b3f3633d0453b54031d0f4d32d83cedbc633208e6ebf706c9602eeb
MD5 97053c7b224c0621c7210dc8cc7fc3c3
SHA1 7077fd3e437c7afb4deb88d3220a765dc723a470
SHA512 8e2e92d7e6edf2618f192dd85945e166d6167bbd1ab8d4d1b7d7e064bcbeca0fd305c8576ab5bada9556ab9da7f844479050fbac83635047fa55165a7f341342
SSDEEP 24576:BZMTzVPS2h4tPpUNMCte7KW2qIoSFG3sU:BZMTzllcpiMCte7KW2qIop
TLSH
T119150195B39018F5DC67813ECC55990AD6B27C661AB0CA1F03F4362B5F333A11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 599KB
SHA256 4a6b0c75df51221edf5862f65afd297099c1e655ab7c7532ad427ebf853b7db0
MD5 a103540f16bc71c64de57c92c9eff7ff
SHA1 81a7f1e4c14b1abe14e5780652028d6ffbb3b408
SHA512 ebe5a941ba24fe975de5a08cc87cc1a380d90b32bf3ba7fd3cfb82930191a2128a77ef7c7ba3ae2e47159413a801b983200f6e62c237a8ffe92e2046b85c1243
SSDEEP 12288:k052HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:k04tPpUNMCte7KW2qIoSFG3sU
TLSH
T1FAD423C67CD12982C82E983D7C98B70F87677D7235A2AE0F5AF2D72F4F5A0C12215252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 599KB
SHA256 75ca67a0023a4450efea3777c5c1820ee98f84984a7bc645fe6df4edcace2dea
MD5 50550c221feeae995864a0e2aa3f43d0
SHA1 97133862b9048643e6855a6e9076fe00667763c7
SHA512 7c95bbebf26208d42e4c576685c426c16549557b2c33be9cfab854eee1fd71c0eb366527753ca8766f4b784c2e4c83c188b8487720d0da206fe340bc5fd335bd
SSDEEP 12288:eJ52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:eJ4tPpUNMCte7KW2qIoSFG3sU
TLSH
T121D423C67CD12982C82E983D7C98B71F87277D7275A2AE0F5AB2DB2F4F5A0C12115252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 5a980fabba543f9817c9807eda9d0dfc295cf3455cde580bf8e1191542aee78d
MD5 b4018d7092176d87c61466e17f5cba0a
SHA1 97ee0c3af00833c121c39d0443abd654ef3245a4
SHA512 0a2d7b9cef5582ccb59722b0aea629703a4f7b6ee8cb7e130b8efb84598d81ffe3a96313d5b25b184c355e7f60957745900b3f9e936b3c7f3a814a93e783a801
SSDEEP 12288:wqPMjLB+52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:1MJ+4tPpUNMCte7KW2qIoSFG3sU
TLSH
T175F4024776E130F9D53B92388CA62A06F772B83217619F1F17B0477B1F272906E2A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 599KB
SHA256 f412afb6557f83a7c588da7e7f68342af5c4ab1017b3b3927d4b69e790e4dc73
MD5 36e8360e493cfab37a0b4dbc320c9ec8
SHA1 58be617ae2b9f09c66feb27234173f488bca3a20
SHA512 a2963f0aa36fff655ce53b9d1ff71633412614e624facf6de03fdfc08dec353d5a42cd7474accb5a08dee85e683954ff0df81364c81657cf58ee46f650ff901f
SSDEEP 12288:Ie52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:Ie4tPpUNMCte7KW2qIoSFG3sU
TLSH
T179D423C67CD16982C82E983D7C98770F87277D7275A2AE0F5AF2DB3E4F590C12215292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 599KB
SHA256 8f708b8de673a2dcdf2196d17f627dd9e99e2860f24cd5952560a2838f193c7c
MD5 c15b60c9807d40430e1f033e604fd722
SHA1 d3de3715822d808232c04d6407426c64c1d0120d
SHA512 547be5dff49fe8dfa87ced49dda65716962521671f4f416c10ebca7ed43a02c21643756e02415076ebcc7dd5b27dce06c84bc535ccf8bb0431aa3a136674f52d
SSDEEP 12288:sl52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:sl4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1D3D423CA7CD12982C82E983D7C98771F87277D7275A2AE0F5BB3D72E4F590C12219252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 f8ae1ee3323389376eea6200dbbedbeea645986b1845532d6b671b6caa999fe0
MD5 0f71f79172d2bb9fd87819d768698251
SHA1 5acc6160f05562d9aa5d2018199c9406561c8afc
SHA512 cc49967300709ca5776b5c43aec21c63ff8a6b7bb612a83c58d8b7d0362f342f61a9bf70e019f3be92d055f3a1534ccb8693baa4565dbbb18bc95638efe2febb
SSDEEP 12288:hqPMjLBF52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:0MJF4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1BAF4124776E130F9D53B92388CA52A06F772B83217619E2F17B0477B1F272906E2E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 3438254450713db0118953c18c6b6a3ffba2137eaec7225bcdee4daccc0f7d15
MD5 247f320e3b37b1a0eb280aa4edf73411
SHA1 9b91cef438dbe13bdfe959c37eba689236d81033
SHA512 5894fe3a2222f8b1541d4018c2e5103e6890ba78cf3291652a73ecbc3db9a2c37233eee0c2cad17f9bd54315a3d082c7f2ac5049e2d62747501d7c2732252da6
SSDEEP 24576:nTeaLl3z0zDf4tPpUNMCte7KW2qIoSFG3sU:nTtLljicpiMCte7KW2qIop
TLSH
T17E15F195B39018F4DC67853ECC659A0AD6B27C6607B0CA1F07B4366B4F333A11D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 f2a32be4ccc5f83e136bc624bf658bfa5be6aec9e8bb3e5dcd18fb9370ba3a85
MD5 9ce1ff36ea3f9d398514a07696d5cfca
SHA1 0b6871b39b0fa20b34ccae9f0c028cb4a51b0932
SHA512 fda8e5421051224c27a873834729124ce3bffaf03b01188977d5108ad8a773f9789b35e1fb821cf488468da383c0d83eb954c39f0e32d62bacb9a5046c43c280
SSDEEP 24576:y3ZdWCHKy7EmJ4tPpUNMCte7KW2qIoSFG3sU:UZdWCHKyQKcpiMCte7KW2qIop
TLSH
T1C935CF90F3E414E4F0B79A398C765512DAB67C6A1B71DE8F03A4661A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 599KB
SHA256 ebd2a98b394aeaa595070dbc208aca80b7607b386c1e4831dbb1ae3bfefd241f
MD5 c8f4737a8e6089fe26b45bb5a487a74c
SHA1 1cb6c1c4c5c62f1e96bceb5e71733400f66990e7
SHA512 045bae2c35145d98e6bef62fdf90b28444a988bcfc811dfcf4a269372922fb5d2e317e8ce2495ea705b8f21b8bd6da1be3179199f5d9d617b5c480fc2c1eb424
SSDEEP 12288:g152HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:g14tPpUNMCte7KW2qIoSFG3sU
TLSH
T17BD423C67CD16982C82E983D7C98770F97277D7275A2AE0F5BB2D73E4F5A0C02215292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 f1113306258c3a4051c741329f120596911e84ce04816271fee20f33e0b3f679
MD5 07ea685fd31dbfc232a74125f22edce1
SHA1 dc8f58bc23acf49b26401061de2b49bbde7ca62d
SHA512 35fea916f2f57a2855cd79f50ac13339491485c7d2feb4e50fa3f97f334ced755e6936afb6020eec78e8a2c6df9539163e9f2b3e1f052e1d415c788c8bb67199
SSDEEP 12288:IE52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:IE4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1F5D423C67CD12982C82E983D7898770F97277D7271A2AE0F6BF2DB2F4F5A0C12115252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 599KB
SHA256 145bbf3ecdeb806175fb2b8233f1779989d7245d939cb4ce1a4a3e1a42c72fe1
MD5 64a2cc79c2c279d45a46c0f21f576bdb
SHA1 c6ea1e5a4ebb1db1130799bbb0f0e45737e9d4b1
SHA512 eb85ed3e2864739babb5111d1b2ea068a1d6b39bb9981d82b26fe211d234f2e323430565b72df96b39a56ea4fdb691eeae1c586ba3afe5859f0aa75cbfc747c4
SSDEEP 12288:5552HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:554tPpUNMCte7KW2qIoSFG3sU
TLSH
T1FFD423C67CD16982C82E983D7898770F97277D7235E2AE0F6BB3D72E4F5A0C12215252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 599KB
SHA256 5a5e3b7dff0062e23d2cb79836047d9b71ebd65c561d96b2ebd2ff84ebfa6c97
MD5 4ba991b5f2e8d8c882aa6e3bcb65c3bf
SHA1 1f470b9d5bed1e84596f29ee593c520407260e09
SHA512 5368be5a988fa11e098150dc35ad2e5b3866722aa822a07f5b4e6f6032c1aa3e801150065dfdf918de82c3918d53a7505fc4de311cdd92aa1e767c39589cb187
SSDEEP 12288:6i52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:6i4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1ACD423C67CD16982C82E983D7C98770F87277D7275E2AE0F5AF2D72E4F5A0C12215292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 269512a60a5851fc5dff8ec1f709eb45bedecd24186d10c7c4f8fecd6ac7fbf5
MD5 fb54ce791e13ef71288224ee30fa578e
SHA1 1531bea875a4c6a15d8f4cebcd8bda15d64878b9
SHA512 cb9493e9e1960c5684586dacb1a1742b57f49a3c9fe5010e4dc79ce3a10d54834316f0662b09921c818bf04ca88733d3a9d2357b5a0c222f0f14425244eae033
SSDEEP 12288:N5ffG52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:DG4tPpUNMCte7KW2qIoSFG3sU
TLSH
T113F4014AE29412D9C46EA139CB555A06B3337C3192E2E78F57E0F63E0F765806EDA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 607KB
SHA256 5baecd4e2d9677f6f3adceb831c9956eb0670141dc83272495cd3a0d8af4c4fd
MD5 23b21f3ff3ad5e0b94bc5580b4bb3b05
SHA1 207773fe0531a2c880e3edbff8c4052d40efac08
SHA512 b5528a4de9b3e79d47cdc8f3cae889f16f2d18445931261669e110a47218829092f76fcdf739018ebc9de069791b521a7ff540fdb89a95eac6a146466e710c25
SSDEEP 12288:IN7pB52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:opB4tPpUNMCte7KW2qIoSFG3sU
TLSH
T111D423D26ED16942DC3EA838289DB31E531B7D712791ED4FAAB2973E4E754C02935303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a6c6ef8246fcf2de3f10bcd03131413fa3a3c1c48db511c6c2b794009c043ad1
MD5 6eaca3d0dcdf15f76876d04055529a48
SHA1 916559b76faf745298a80b7babd0947f31b487e2
SHA512 495658918eae5df1c02451ff52c4e9f85d767fa6138588250a7168d59717f9fe01bdfe145bb57d59c1d54e65b12d0339bc276286e1d9988a4abb099ce8d5a903
SSDEEP 24576:+gb6bmBIi49WNNFpg1rSvFv7bYNE3EYb+V0rNK93H5x3IFT39geycv0s:+gb4mBIBhGF5x+VKyH5x3I93+ecs
TLSH
T1F265AF1E22EC02F5E1FAD2B8DDAA4417D6B278160732D2DF1151422D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 f4a739aae691958f0a7ceac6245e840be62f32be0dae4bb34a53209fc0c063d0
MD5 8f5a0a2dee1116d383c25b854af34c84
SHA1 fb0127015901bce70ee6bc1f3a57fd4ef01f74af
SHA512 da2a54afd0ddbf3ab715ddd0e5a1b3007ab9e8db4a0932afd7f068ffb9659d4758b89a144fe9e9f72d614ce503453a7471e08bc98827aa8ff72f05b9fbfdb4fb
SSDEEP 12288:kJG0552HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:0G054tPpUNMCte7KW2qIoSFG3sU
TLSH
T195E4239E39E13481C83EDA3D6864A61BB673397027616EEF09F1D63E8F594D03239E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 558962ef4c95f383f1d67b5d9371f9ac69f9fea28374d464cec6ccb87717702d
MD5 54ea487475901f2b7809fd403b390c38
SHA1 74052bd719917b0cfa4872bb48168fabbf712abf
SHA512 5675523a21f3584345f33aba41486937f5d04ac9cdadb3d83c1ba6c65aa6255b6703b94ebcdd036b582cadfc17912a5b559772146b5ba285e65edbb946b334a3
SSDEEP 12288:Jc52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:Jc4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1C2D423C678D16982C83E9D3D2899770F57137D3127A26ECF6AF2E73E4E5A0C12235252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 3d8a0af5dad1076d6bdccecfe2b2e3e9397a27cbac8fdeaed1858949be382d2d
MD5 5c591d47d05502e62fbead72cff6d97c
SHA1 a848531e106846af51780bfed20728c23d301215
SHA512 8b2bc1222dfed420f869eb64f7438385fa879668a6c2a0ef6705d0ec4c9f36e4eff5dbf3ec3ddf2a50a3ca3b70b554f6cdfe3970d69363877fd8624306c5fdf9
SSDEEP 24576:Wg38u8FpJqH19fria7/m3E3EYb+V0rNK93H5x3IFT39geycv0s:jsZFPqVUa7/Dx+VKyH5x3I93+ecs
TLSH
T13935F155BAE001F0D47BD138C9864663F6B2B4150374EBEF06A88A511F23BE65B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 dd6e20538ffd26b7f837e10232a259650204800ef53a582c7ce8cebb374acf08
MD5 a385e43ffa6e9e5dc6d93497c0da9369
SHA1 abb03c3a93586be4d4fa1732f779f60586ec87d2
SHA512 680c3036ce3254aa0ca319c0f347118c0e7917ed1a81eb0a0485b2da0c56f47dc2f02e945a6515cced336faac730d10ca0cd93a446d05e20aec3d4b06c61b15f
SSDEEP 12288:MHvUrBFrEjwaQO52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:MPUr+NQO4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1D505F15F26E818E5E67AE13C8986870DE772B8621312E6CF02E1817E4F679D87D3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ac54f41cb0cd2e733953dd0da1a432c5cf0af309753fb07440a4b62c06cd2e69
MD5 2a26a4eb44b8ce0c591beb75091ec60a
SHA1 58f16a3f8626013ea9998ea7ef83b909a10acff9
SHA512 7ecad791dbfd3531bad0b65337043e0070db4d990e3cb17c855d101fb80ef041c2a6f2f4c36922014fe597e180848d102636fe0ac48b6ee53fbbfa829c15f60f
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKcpiMCte7KW2qIop:NG05lO43brcpiMPL3
TLSH
T1E7D5CF6A62EC11F9D0BBD17CD9C6460BEBB23825033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c060480f6a0a67b0b122eb60c3014d4013578d143d6a7eeb8c468a528fb82865
MD5 6a2d52259e2b7ef50d846535aca5d942
SHA1 2a3f18d95c818d1cd482bbe33f1c0c9810d65b5d
SHA512 7849e2d96f44536a1e68360a41799ff78c3ec063d8beaed1fbb28e1dc6062ee452cfbfca53103c5ed6f5928936b8d110ea2193030d72b72f907692a2c2932151
SSDEEP 24576:1Ea5POZ3dpbWVM50JicR2hG0lasx2+47eidn7E3EYb+V0rNK93H5x3IFT39geycJ:Ga5POZ3wJt2pasx2+m+x+VKyH5x3I93D
TLSH
T13365BF5EA6FC01D4D5B9D17DC583461AE5B1342613329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 531a47967ef92695fa1bf77c0eb7daef30dfc1eaa899210c4cdfe3409dad5e24
MD5 de9d307a0b7245465293b93606cdfd02
SHA1 3a7fa1ca0260bda8f6f2abca38b92df9b94ca287
SHA512 76c85bbb07b45e42624d47867c05c4869a80dbb1258726a5e8d4de6e886cf7ba92f8ca176923d0e02b77ad1c5a17c98e7112dcce2d3b16658a8812afe8e654c2
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7Fkv4tPpUNMCte7KW2qIoSFG3sU:WNc/zEOVHFQcpiMCte7KW2qIop
TLSH
T17E858B5623E901E4E5BBE1BE89779646FA71786513308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 e1f3e754440fff7f5eb63cb8163b97fa6429ed04027fcfacfded51a3af3b5e79
MD5 dd3fecb5d1a09227ccb97730e6689ab8
SHA1 5ee36c414ef725ea8ae414b4180afbb827ce8b64
SHA512 bf2dc0e0c08565b240bcde14f9ed747e1300aa302c9c7981afdc5c81766e363681aeb7a74e1b3d6edb508f93014f0125b831173d741e1c30ed94326f7078733f
SSDEEP 24576:aJnJPbzB4ScE3EYb+V0rNK93H5x3IFT39geycv0s:aJnJv6SHx+VKyH5x3I93+ecs
TLSH
T1C715E12DD2A810E8D8B7C274815A175AFF71386D2F2269CB19B4D5343F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5728f4a4febb36fc7953214ca0e5503761022f6e544602c365e7d6ef4cdc7c5f
MD5 b5fc453082c84fb1138db199cac1d2f0
SHA1 4da81b6eef02ba50de342b5b14e19c18205d4775
SHA512 5e9cc99b42b36c42b11204987ba4c818145db72b3104c3677aa99c251fea12d9eb8400803e1a7a43592dc9102dbfccdc7bdc55be53a2ff7dbeafa44c00448b59
SSDEEP 49152:bCLHGeeV5ijCmlDWDkJx+VKyH5x3I93+ecs:G0V9k3+ep
TLSH
T14EA56B05E7EB4184E8F3CAF5C92694169A327C549B34F7EF4A80CA6A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 efe628d6bd2d95ba424320ae5bd9fb1ee536a73d0b77b782204fc0f57c55d5b8
MD5 e8f3a5ab96419d61dfbfabceb8747fc8
SHA1 0733201dd268eab35a638f88541278cea414b79f
SHA512 0c5cbc6c9362e58127acf62c8d94545e0ba87d6c9cc1d8a5455de8f7909305b4d47110321c5bbd8a47d82855cb98b539644695380e006011aada3ba7eae4122f
SSDEEP 12288:Q1HxkoD5ZI7p52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:nojIl4tPpUNMCte7KW2qIoSFG3sU
TLSH
T138F4F15D33B610F6D07BD03D95820606D2B2B47197626ADF0BE4C67E4FA3ED8B938A41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 d54f6aa9e342b83d70d78b7afc384dbdf68533c1b6e08675c4495e50c6aea570
MD5 4f80996209c351ea69f2bfbac2b40086
SHA1 d4e5458f0391e3b99696a629e68c8c7213834d0b
SHA512 0e4741640db22e8d8392e553a16b20a18aea37ef70ff667d482e65ca26d806cfd571a8edfbb42edda7d41854b70285814c9b748e756a8d2caa7dd981d155af27
SSDEEP 12288:BB6kyt52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:Ttyt4tPpUNMCte7KW2qIoSFG3sU
TLSH
T1EDF4124567D064C1E97A553CACA6921A8B32BC306B62ABDF16F1E73F1F367C06930712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 74bf300cc6838d7d477c6b227bac043fcca1d3088213245748edb617ae66239b
MD5 957745f231ab8a66118b102e1cdf8fb9
SHA1 7e584a0fd7813c071e9e845c9195b3d3a0c268d7
SHA512 34ab947561fd9ca1217433e12ee20fafc7a25efc31c3ca46b10237438735fc4e319f1a5e3b6016a7f24ff9006541b9ceb66ab33a19101cc5fd0e358a3ec903d6
SSDEEP 12288:5mg52HNPpUNroOOste7KWXR8vqIoTIGJ0RFP+3kRtU:gg4tPpUNMCte7KW2qIoSFG3sU
TLSH
T171D423D979D13582CC3AA93C2858670F9327797127A26DDF69F2D73E8F6A0C02235702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 518469f16f42142d4381fe90647a4ee77a924873a5a7aca913f885f4d95e7fd1
MD5 29e460464ba1526967057cc376f04087
SHA1 7bce17a05c69ffbe4e8035114f488574f66be850
SHA512 27742b18b0119b2c4a8ed05d35cd58bbe99009ec4bc62e013e256ee613125f6e01e1234f8637e6341a3d25ae1fa04f7c73ea772fc75d9e65d62e56a615f4238d
SSDEEP 24576:G2gnLoTfaidZUE3EYb+V0rNK93H5x3IFT39geycv0s:hgcTrZPx+VKyH5x3I93+ecs
TLSH
T160558C1DA7EA05DAE2B2D635D8631493D633B4311772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 acfbcfac328b6dc92f9b69a77d63d8f0497406e345287ccd5ab76d8a6f2181bd
MD5 aa49df273897e7f374086f046cefeb7c
SHA1 d47a89db240298d24b4e4417f12a206c4e4023f2
SHA512 57245145ef0b5f98067b4036a498429d3ecb7d38e603cfdb92a6640a75a4e806670f9a25ebec746bc64b0ecfe674bfe165363cdfe17b3c0abf9fe548892cae5b
SSDEEP 24576:vrcmR2E3EYb+V0rNK93H5x3IFT39geycv0s:zcmRhx+VKyH5x3I93+ecs
TLSH
T1F105F14EB6AE00F5E5BB813CC8860615E6B37425272253DF12A0877A4E17AEE7D38F51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 7b4917a4fdb507c5bfba5baeaba46f910215c26722be7574b58bec2aadb72781
MD5 6281b1461439d23af5d26c8afeb4472c
SHA1 ef93aeac48d65c720e3a2e2c951ea3c856ff945d
SHA512 2a7099275b025157325f1f5c24ea2847c73d6c6af055052c6625f4692238ebccbd92d85defaa0c1277229f1ccad53d69ac29019c391d443dc59414acbfcdca50
SSDEEP 49152:QDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Ax+VKyH5x3I93+ecs:93Upow8sBCV9k3+ep
TLSH
T102A58D3DA2E800A8D9AAC379C5421366EA71742E3F3015DB0174C578BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1100-392-0x00007FF79DA40000-0x00007FF79DD7D000-memory.dmp

Download

memory/1100-393-0x000001FB16840000-0x000001FB168A6000-memory.dmp

Download

memory/1100-391-0x000001FB16840000-0x000001FB168A6000-memory.dmp

Download

memory/1488-351-0x00007FF69D390000-0x00007FF69D619000-memory.dmp

Download

memory/1488-352-0x000001D33B1A0000-0x000001D33B206000-memory.dmp

Download

memory/1488-353-0x000001D33B1A0000-0x000001D33B206000-memory.dmp

Download

memory/1488-448-0x00007FF69D390000-0x00007FF69D619000-memory.dmp

Download

memory/1504-323-0x000001C258A90000-0x000001C258AF6000-memory.dmp

Download

memory/1504-322-0x00007FF695E70000-0x00007FF696112000-memory.dmp

Download

memory/1504-324-0x000001C258A90000-0x000001C258AF6000-memory.dmp

Download

memory/1504-390-0x00007FF695E70000-0x00007FF696112000-memory.dmp

Download

memory/1616-369-0x00007FF7773B0000-0x00007FF7778B5000-memory.dmp

Download

memory/1616-370-0x000002C0280C0000-0x000002C028126000-memory.dmp

Download

memory/1616-371-0x000002C0280C0000-0x000002C028126000-memory.dmp

Download

memory/1616-450-0x00007FF7773B0000-0x00007FF7778B5000-memory.dmp

Download

memory/1640-313-0x000002347ABF0000-0x000002347AC56000-memory.dmp

Download

memory/1640-387-0x00007FF602FD0000-0x00007FF603083000-memory.dmp

Download

memory/1640-312-0x00007FF602FD0000-0x00007FF603083000-memory.dmp

Download

memory/1640-314-0x000002347ABF0000-0x000002347AC56000-memory.dmp

Download

memory/1696-332-0x0000026BEE3A0000-0x0000026BEE406000-memory.dmp

Download

memory/1696-443-0x00007FF76A9F0000-0x00007FF76AB83000-memory.dmp

Download

memory/1696-333-0x0000026BEE3A0000-0x0000026BEE406000-memory.dmp

Download

memory/1696-331-0x00007FF76A9F0000-0x00007FF76AB83000-memory.dmp

Download

memory/1968-253-0x00000266B6C90000-0x00000266B6CF6000-memory.dmp

Download

memory/1968-254-0x00000266B6C90000-0x00000266B6CF6000-memory.dmp

Download

memory/1968-330-0x00007FF604090000-0x00007FF604158000-memory.dmp

Download

memory/1968-244-0x00007FF604090000-0x00007FF604158000-memory.dmp

Download

memory/1976-293-0x0000025A3F5C0000-0x0000025A3F626000-memory.dmp

Download

memory/1976-298-0x00007FF6532A0000-0x00007FF65334D000-memory.dmp

Download

memory/1976-375-0x00007FF6532A0000-0x00007FF65334D000-memory.dmp

Download

memory/1976-292-0x0000025A3F5C0000-0x0000025A3F626000-memory.dmp

Download

memory/2852-341-0x0000024C1F160000-0x0000024C1F1C6000-memory.dmp

Download

memory/2852-447-0x00007FF7778D0000-0x00007FF777BEF000-memory.dmp

Download

memory/2852-340-0x0000024C1F160000-0x0000024C1F1C6000-memory.dmp

Download

memory/2852-345-0x0000024C1F160000-0x0000024C1F1C6000-memory.dmp

Download

memory/2852-347-0x00007FF7778D0000-0x00007FF777BEF000-memory.dmp

Download

memory/2936-25-0x0000000000AD0000-0x0000000000C76000-memory.dmp

Download

memory/2936-6-0x00000000028C0000-0x0000000002929000-memory.dmp

Download

memory/2936-0-0x0000000000AD0000-0x0000000000C76000-memory.dmp

Download

memory/2936-1-0x00000000028C0000-0x0000000002929000-memory.dmp

Download

memory/2936-7-0x00000000028C0000-0x0000000002929000-memory.dmp

Download

memory/2992-58-0x000002826EA10000-0x000002826EB0B000-memory.dmp

Download

memory/2992-60-0x000002826EBE0000-0x000002826EC46000-memory.dmp

Download

memory/2992-59-0x000002826EBE0000-0x000002826EC46000-memory.dmp

Download

memory/3280-449-0x00007FF7FA930000-0x00007FF7FADFF000-memory.dmp

Download

memory/3280-360-0x0000029979470000-0x00000299794D6000-memory.dmp

Download

memory/3280-361-0x0000029979470000-0x00000299794D6000-memory.dmp

Download

memory/3280-365-0x00007FF7FA930000-0x00007FF7FADFF000-memory.dmp

Download

memory/3840-16-0x00000240B7640000-0x00000240B76A6000-memory.dmp

Download

memory/3840-17-0x00000240B7640000-0x00000240B76A6000-memory.dmp

Download

memory/3840-15-0x00007FF67FA80000-0x00007FF67FBA2000-memory.dmp

Download

memory/3840-64-0x00007FF67FA80000-0x00007FF67FBA2000-memory.dmp

Download

memory/4244-368-0x00007FF7CDFA0000-0x00007FF7CE6E3000-memory.dmp

Download

memory/4244-297-0x00007FF7CDFA0000-0x00007FF7CE6E3000-memory.dmp

Download

memory/4244-286-0x000001645AA50000-0x000001645AAB6000-memory.dmp

Download

memory/4244-285-0x000001645AA50000-0x000001645AAB6000-memory.dmp

Download

memory/4356-30-0x000001AD02300000-0x000001AD02366000-memory.dmp

Download

memory/4356-29-0x000001AD02300000-0x000001AD02366000-memory.dmp

Download

memory/4356-31-0x000001AD02300000-0x000001AD02366000-memory.dmp

Download

memory/4356-28-0x000001AD020E0000-0x000001AD021DB000-memory.dmp

Download

memory/4604-48-0x00000225C99C0000-0x00000225C9A26000-memory.dmp

Download

memory/4604-47-0x00000225C99C0000-0x00000225C9A26000-memory.dmp

Download

memory/4604-55-0x00007FF69B5E0000-0x00007FF69B747000-memory.dmp

Download

memory/4604-46-0x00007FF69B5E0000-0x00007FF69B747000-memory.dmp

Download

memory/4604-53-0x00000225C99C0000-0x00000225C9A26000-memory.dmp

Download

memory/4628-37-0x000001E9300E0000-0x000001E9301DB000-memory.dmp

Download

memory/4628-40-0x000001E9302B0000-0x000001E930316000-memory.dmp

Download

memory/4628-39-0x000001E9302B0000-0x000001E930316000-memory.dmp

Download

memory/4628-38-0x000001E9302B0000-0x000001E930316000-memory.dmp

Download

memory/4864-267-0x0000014DC1050000-0x0000014DC10B6000-memory.dmp

Download

memory/4864-350-0x00007FF7384D0000-0x00007FF738619000-memory.dmp

Download

memory/4864-264-0x00007FF7384D0000-0x00007FF738619000-memory.dmp

Download

memory/4864-266-0x0000014DC1050000-0x0000014DC10B6000-memory.dmp

Download

memory/4956-359-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/4956-273-0x0000000000400000-0x0000000000548000-memory.dmp

Download

memory/4956-274-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/4956-279-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/5572-235-0x00007FF604090000-0x00007FF604158000-memory.dmp

Download

memory/5572-236-0x0000021DA03D0000-0x0000021DA0436000-memory.dmp

Download

memory/5572-237-0x0000021DA03D0000-0x0000021DA0436000-memory.dmp

Download

memory/5572-321-0x00007FF604090000-0x00007FF604158000-memory.dmp

Download

memory/5680-304-0x0000020A4F2D0000-0x0000020A4F336000-memory.dmp

Download

memory/5680-302-0x00007FF687AC0000-0x00007FF687ED6000-memory.dmp

Download

memory/5680-303-0x0000020A4F2D0000-0x0000020A4F336000-memory.dmp

Download

memory/5680-444-0x0000020A4F2D0000-0x0000020A4F336000-memory.dmp

Download

memory/5680-446-0x00007FF687AC0000-0x00007FF687ED6000-memory.dmp

Download

memory/5680-380-0x00007FF687AC0000-0x00007FF687ED6000-memory.dmp

Download

memory/5948-247-0x00007FF717060000-0x00007FF717179000-memory.dmp

Download

memory/5948-249-0x0000022462180000-0x00000224621E6000-memory.dmp

Download

memory/5948-248-0x0000022462180000-0x00000224621E6000-memory.dmp

Download

memory/5948-339-0x00007FF717060000-0x00007FF717179000-memory.dmp

Download

memory/6032-385-0x00007FF70CAC0000-0x00007FF70CBED000-memory.dmp

Download

memory/6032-381-0x000001C86B270000-0x000001C86B2D6000-memory.dmp

Download

memory/6032-379-0x000001C86B270000-0x000001C86B2D6000-memory.dmp

Download