a5b003ba705f1fe5edbeb7ad83b45108ea2fcdfe097f212dd0dd34d0c59dd2de

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260808-dhyjmabd36
SHA256 a5b003ba705f1fe5edbeb7ad83b45108ea2fcdfe097f212dd0dd34d0c59dd2de
MD5 a04d37706cb2a8052514d39df2532e3e
SHA1 959cad1b7532e2d49b98b26aedbbb6807d4a36ae
SHA512 1b05e84736a97a0ea8f168495637486a4c124b0e7c75a8489d7955f93cdf34335e6ac9e28f4a83f3e9c0183d57c4c38a28993d3b65fb892dd33ac6127f30d7df
SSDEEP 24576:k49H6n494I5K4R1itChwEaGNpktQWge4uP8V2EhYq:k4p6n49v5K4R1GCOE26W+2Eh
TLSH
T19835BF02B7F99034F2F31B31AFB552659A7BBD629D35C60E23C41A0D09B0990EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3536	alg.exe
1792	elevation_service.exe
2340	elevation_service.exe
5588	maintenanceservice.exe
5736	OSE.EXE
6020	GameInputSvc.exe
3520	GameInputSvc.exe
792	msdtc.exe
2624	PerceptionSimulationService.exe
3776	perfhost.exe
6116	ReFsDedupSvc.exe
5996	locator.exe
5704	SensorDataService.exe
3080	snmptrap.exe
3360	ssh-agent.exe
1272	TieringEngineService.exe
5524	AgentService.exe
1116	vds.exe
1888	vssvc.exe
2376	wbengine.exe
3836	WmiApSrv.exe
3736	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9226aa283806d8d.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3520	GameInputSvc.exe
3520	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1856	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	3536	alg.exe
Token: SeDebugPrivilege	3536	alg.exe
Token: SeTakeOwnershipPrivilege	1792	elevation_service.exe
Token: SeTcbPrivilege	6020	GameInputSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6116	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1272	TieringEngineService.exe
Token: SeManageVolumePrivilege	1272	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5524	AgentService.exe
Token: SeBackupPrivilege	1888	vssvc.exe
Token: SeRestorePrivilege	1888	vssvc.exe
Token: SeAuditPrivilege	1888	vssvc.exe
Token: SeBackupPrivilege	2376	wbengine.exe
Token: SeRestorePrivilege	2376	wbengine.exe
Token: SeSecurityPrivilege	2376	wbengine.exe
Token: 33	3736	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3736	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3736	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1856	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
1856	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
1856	2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 3520	6020	GameInputSvc.exe	97
PID 3736 wrote to memory of 4768	3736	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a04d37706cb2a8052514d39df2532e3e_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2340

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5588

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5108

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3776

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5704

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2376

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 747c25a8390259f4c32e5476b092266c90b399ba0d579d2301dc1a487854f896
MD5 b0812e015c8a4504296e1901e2875e0f
SHA1 459e9e8890ddacd8edfb58c1b5854d52bc9f6c0d
SHA512 175554bbd240e7f38a2550ac230933c866e5919b9e58b5c7dbbaf59e8aa07f1a3ab2baa6d46646fa51751be9b410434e1e7e94c2bffd31cd504c1cb0499f1f1b
SSDEEP 49152:A9C632BuPkFKRrdE6oh7stBhuXjfS4LWxnYf5K4R1GCOE26W+2Eh:M3q6gjBAg1YEPWYh
TLSH
T1CED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 846KB
SHA256 e76a18071c642e8e9ba4bfc7f9420d463f554c1d9dc1feb9812b03a733f486dc
MD5 787e1a6a7d2f9a632d11fa7145063bc3
SHA1 e591aa9f65b342617bc13f6d063f3e3a15727d15
SHA512 1fbc8dbdd0d68b86e62cb9b42c5ba07465192d912efe4e38f08b430fc85aa90a54e6f1c66add4ab56e6d69d92bfd0b4db3923c12d13e834d2270fb89e3a97d2f
SSDEEP 24576:rXYfDtczAxI5K4R1itChwEaGNpktQWge4uP8V2EhYq:utch5K4R1GCOE26W+2Eh
TLSH
T1C0050228A7E508F9EC67823DC8A18505E63378514390F7DB03E49A6A1F337D4AE3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 58ae8ed2e8dab16a05ebd58cae77d43654bd0edd5a1900f654ad0a033f1b1867
MD5 fe6b0cd5a540b6516e3a6f3e73b29aeb
SHA1 062188eba2ef7d9befd19f2ccf68b016fb9a526f
SHA512 8c3337664fbe9d28c4169d3a5ea5040bf984191b8e277e4e65d38e7197cd36173b720135ed32db908176c00d5bc26f6ac7deb3fd488e47b54551dd80153243dc
SSDEEP 24576:b0Qexn80cQxOrMYI5K4R1itChwEaGNpktQWge4uP8V2EhYq:bOn80JoA5K4R1GCOE26W+2Eh
TLSH
T179359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4286D77C7E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5d19797e80bff6a8cd5a72a373d576e2b9a51781854be13142395dd1933ff076
MD5 8a3c87df4e0d8d49c9792531d17536a4
SHA1 3642f6bb1a880ea3634c8cc781472e283440ff29
SHA512 a5f5e7b281d678cd0edc430c9569cac4698b85b1f369570597d936806e0a166f0bb15d556caa2a4ea55312616faad80d7a5965b48fc7cab6b57746838b054d71
SSDEEP 49152:c/ezSC6vUzPvuHjyw5K4R1GCOE26W+2Eh:YezSC6v2XuHAg1YEPWYh
TLSH
T16B755C15F5788323D0B2D0BAC5D6BA9AFE7230464B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a4e75d47d45022490daf20486fa51c27d90ae65cde47570fac93c88c1de35ed2
MD5 e2ab35131a06ba2df5cdeb8058d173e7
SHA1 00d3aa46b1e748224116dbaa2016713046b0b2f1
SHA512 d822af8aa4d36827dd2daabd7c77ab394773e26c6a9e26afaa517b1bfab1dbb059afa84a149ab7b67e97d7514f6c0acb53624ac94160abf6cdb5ea79b524a843
SSDEEP 24576:eabVPW7h6Eul+diI5K4R1itChwEaGNpktQWge4uP8V2EhYq:eaI7h6Rl+f5K4R1GCOE26W+2Eh
TLSH
T152559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 852e55de81c0a1003855a2f08cde2bd88eb0d46677b1d95df77855f6c5f80120
MD5 0e776e8bb9100a903db3bd87776fab00
SHA1 b794128b000b450e824fa8dc38d421add20e071a
SHA512 c1971b7a9a8635de4ef294f20da7cba4787bbc2f0c3c389ffde76f874f1f556c82d95b88c3d5687b785df152bc86035b93b8f325127e207c1b2e3d4f10be1189
SSDEEP 12288:QdKGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:QdKI5K4R1itChwEaGNpktQWge4uP8V2M
TLSH
T1CDD42355CF7A2062E2BA1773B1A83F0ED1641D9587843CA0862BBB9FA235DD1F34905F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 38cb71e0a774f80a89afb5b2a98c1089c60fdd24ca08bf530fb707f092abf976
MD5 12f09f260ac94bab8eab2b209340bf1e
SHA1 199479469da4cfe49ed1daed42f954940714aa43
SHA512 bb28bb6beb2e32bef4ba675cefa5a5701255d01efe2f4d023744ec681931ded4bf1bf110b6998bbe32471e5f4a4fed40498c5b198745949477d83ddc7007b7e2
SSDEEP 24576:T9IUVI5K4R1itChwEaGNpktQWge4uP8V2EhYq:T9IUW5K4R1GCOE26W+2Eh
TLSH
T14415CF3BEE38FCE2C27A4DB956918700D77278704B52A3CBD165820EDE239E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 1c423a1ef21fe03e45cec2c93d418b1d5a111f6149812a5d545424e10e5b582d
MD5 fd9de62e2815996989364945def5f9e9
SHA1 89a7ce33ebaed3aaa37d2b2d952fb323d998c88b
SHA512 090c1ddf3f34d4f5230746f3b8eb8343907f6b352fcb805b3ed12fce7feb63a457f1fb6c155ea4600bcc422d3f33390455cfff2f40190ae6df0771ac1670d6b1
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3TH5:1QvGAdlCEL8c/NRNw5CDg1YEPWYh
TLSH
T104366C656BF880F5E0B7E178897A8672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 536a0bb06283552d61e2a0dc41560517c338b26108a14d7001a39e17dd9e17af
MD5 f9edcfffd001abc29fc730c91edb4e09
SHA1 6da979eb607fffe0ca64aaa2dbef7b8a685e1a95
SHA512 e7385f931c2067dbed2c4c1d00b0497245bfa36b595478e5710915413b3be344c428c3a784015b496b34af46d17a6fa2e10bf53005504f14b73b592e3ba47685
SSDEEP 24576:VmewsAj1I5K4R1itChwEaGNpktQWge4uP8V2EhYq:Alj25K4R1GCOE26W+2Eh
TLSH
T1A015E031FF75E032C2BB0DB22B35D70A547C79604B5129C3E3A89E9E59306D26376A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7c294f8bf112810a9301399b95c71fe0fc7c0012573099cd98bda7b8d1bb5207
MD5 d4cb3875f65f7cdc5d5acfd66a235fab
SHA1 32dcd7fc4974dd1c71b625d56efe75e529345ac2
SHA512 151314d2e5b01b3c6fea23e886737741fd06725211547f6bacc119a30d79ae67e4c70b441279b8fcc9b526a879ee9d40bbc854eb0ea5cac893c2047ef24edf0f
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHFQYEPWU:HUEtQevvqc2W1cpV2X132KYoW
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0388225a42249a733f4751adb739c7ea560da2a138cf2996d4813407fbf69feb
MD5 07fd60d26fc357ca53dbebe93c478818
SHA1 8811876b48292830362b0bd00ca242582900a679
SHA512 8dcc393c559867aaf9e5fd84366129fd2aab6f527dc4cfcaca3f65b8663da340e8cde7d87b56cad0f6eaa648183fe3289e1f806a095857725be174e414b6b96c
SSDEEP 49152:JibRquA/m2yL5zMyFiV+XenmE3/zT5K4R1GCOE26W+2Eh:aoqcVjnmhg1YEPWYh
TLSH
T1CDD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7bf77eb4044184c75698923c0691703638c90e645eb48e87913b31e05a12bee1
MD5 f17cd3059f1cdbbf0e716e52adddbe73
SHA1 10fda142a9d2496356a9c5ebeb4747da8a3a4fa7
SHA512 0df0a821c6196b4e8eeea7263b73d11ee6d221fe711899bd4d209494d5f5110fcb1cdbb5bf4553249175fd25ea237aad363ce990c402259feadcae2109c9b503
SSDEEP 24576:BAhGLvGFoiwtA5l7S53PI5K4R1itChwEaGNpktQWge4uP8V2EhYq:BAMaFoiq5Q5K4R1GCOE26W+2Eh
TLSH
T10E45AD80EBF955D4F5B3AAB899B69571EA76BCA65E30C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 fe29aaa043ae8ac3a0fa8b4a3d2170595e6dc07f744114270af62e3fea4fd904
MD5 0553a23541ee57fd1b7e55c608ffe99e
SHA1 ba4f3bba41cb25ae0939bab7f5089e6410db1a4e
SHA512 bbf0c732d66df89cbd76735d110cd7a6d9cd21ba1e62c6878b297806b7d8a06b5be3b746911853077871f3c40e6c56a8ca39033e5b1386acfbddb5184692303d
SSDEEP 24576:Qwu+OWnI5K4R1itChwEaGNpktQWge4uP8V2EhYq:QwlOl5K4R1GCOE26W+2Eh
TLSH
T1A805F14677A50CF9E5A74239C597963AF3F2B8011A21DB1F0360C65B6F33661BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 6fc1f140d5169c0b48e5bf5625e94e6395c1b8405afd5df91a365dbdc8eb48e6
MD5 c3cb2450563881d05fc5bf5e2725000e
SHA1 cd95655af2a31c0a0414b80fd8e0df1cfd986740
SHA512 d9a1f6fec1d813c36039c580d39a7889455a1c455d11b9237e62fab52b8cbd4a4b6dc70cf67cd80afd9c4bfb68b9f64f264e925623212548450c0fe1299ccf6a
SSDEEP 12288:FXz1IsfGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmT:pzumI5K4R1itChwEaGNpktQWge4uP8Vt
TLSH
T157E4125A2BF930F6E1A7127AD8E41B09D3713452437113CF022A579A6F33ED1AE39726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6e46469920b6ce8886b5a5b6567ee03f77b1a8f9e8ee4ead23583c52d02caa85
MD5 e93e6d4e270117cdd9c7bde18b1d34f0
SHA1 3b4663a71f224a9a0b8ced84ac87b3fc7c1187a6
SHA512 6f31497adcbc02d6fc197ff0c9c079d9d3852bb495a705af07278ba020eeadca0382fdb78e4e2e084f9f80a2a66c109a7085bd5cbd8d9abeb9470b8a12b0f540
SSDEEP 98304:9QRQyi36YOcP8Lvw2gAf+PN3Eg1YEPWYh:0QyiKa+X+PN0QYEPWU
TLSH
T1E4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c6729a5b04b6591b0865477911f06dc1573ec1b43bc05be9692bf5b510f9324
MD5 6ba141170d52050a3b850345ddd018aa
SHA1 3b44f680b0953490e046eb68c86f7768e7b729cb
SHA512 e72e2c5c9d6e0a5a65e9823e5e60ae166c352017af767b0c498f06a08e86741afb9deec943a6f054aaafce24b2fad8dc9d7ebcd4bc3b2f9c358eeea6975efb3c
SSDEEP 98304:9QRQyi36YOcP8Lvw2gAf+PN3Yg1YEPWYh:0QyiKa+X+PNoQYEPWU
TLSH
T1AF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c7ef478bb3234eeeb1a4f57376f54eb6e3f4b5d409aef81b981618ebe43cd02b
MD5 15021cf8e6a8018be7bd0801c5c79418
SHA1 a2bf277eb62364b0e6412fffde2ee0241490a799
SHA512 ac087108cda171aef13147a2b4d3b13439dce1362a1c77588e30c959f0e254b104c095427a916e0dc7f3deb634ae583efd0e011f1ad2541164ff7c8eb603d09a
SSDEEP 49152:X68Qg55nhMeWu7PNU3/Y5K4R1GCOE26W+2Eh:BthbRc/fg1YEPWYh
TLSH
T1ECB55A33B2F600A9C04DE1769F4A972196D17C75CFE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cfcf30876474105710ba08248f5e988f8efeb6c27706ba38ea7672fcaf187f3b
MD5 de952892ceb9363e1ef42d7cab82bae3
SHA1 a80ae65c1e89bbbaaac1f09c72e1e212cf5ed2e6
SHA512 053d4534092a6aa722d8d3ebc6e03ed71b44442d677abaa121121c3d18d55553cea2a950830a33c2801cb2c26b2f1372c086d2f66e0d5f41d61807e40094aacc
SSDEEP 98304:ly5112gYy5azzVv569nLKnhZWg1YEPWYh:ILIHAWhcQYEPWU
TLSH
T14C167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9e5e01a86e7b04a3b0b41b27109fe2c93aa3da003819ca9bc27dec219a3d2c5e
MD5 62b59b850708c75c0ef09c438716e08b
SHA1 007b86b66e86eb7b8b799978ecac7f348db7f57f
SHA512 4a53d70c7bd3feddbf689d6703db8cd6040cb264741fe31b9bd9829efacab599c3b15a2eca8d3607dbd090f00181e6127f49bb3572b800e8a0855287edf3369e
SSDEEP 49152:S2+taZ3usBWOBr4tEGp0bqx0z+n217aau1glf5K4R1GCOE26W+2Eh:Xu6JmTxd2dgg1YEPWYh
TLSH
T1EDD59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cd3be1a0eb08c912307a664476234ef670fd358d78487bfa449f5445e10a57be
MD5 52a11677f3e03cfde98c657441573cdc
SHA1 af0a1a9b33bb12e6f4b48583837bd8826a6b9e00
SHA512 3a2fd1e3cd029610fa6a79d932cb30ecb97d8d31990ebd80690724aebd1ef7c72c696c655d025a7196edf8a099f36e002109337d9741c3ed714fe6cafc071eae
SSDEEP 49152:p1hpsNoJpF1A6UU44CwH7R4xq5K4R1GCOE26W+2Eh:pmifPbRyg1YEPWYh
TLSH
T169B5BE13F2D900E8D06DD17887569632EA62BC460B24B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8cf3d425e5460243181931611fa6b0144f16fde6601d0dfa5f54ea833ae0698a
MD5 2d8d1735b5c38d8bcfb7bf185aef14af
SHA1 f0c04727620a7f1d30efa26c6d81631710010302
SHA512 b7a05ec8eff98b865e7a9deacb4b126a8d677d53e7c0e6558ebd2c800a7b291bf2916ec4c3d4d6210531b898d450ec294dd545477bbf0742e80966cb3ff4de21
SSDEEP 49152:OSuZQIY0Be2K6RVtOnks6NMHqx5K4R1GCOE26W+2Eh:A5dKoi61Wg1YEPWYh
TLSH
T1DDC5BF03F2E900E8E0BED67487659636EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 55d9130e10016b0c37d93fe6d5d472404759917b3468ce2a320ab42f206df71c
MD5 02f89a0ae1d2a1886049a0b3f73eb238
SHA1 b6eef5233b05d66b26430871590aac499ab766bf
SHA512 d9f15dcddca6ff04c71db89e1d075e0ac6533e5467ce3c237ed89b90f567b0ff9fb3a65cd88b6e265bff7bb80782b5127beec20f333092d5728848a9b650dd45
SSDEEP 49152:DzUSn8EApI0figTgiDn0AP5wL5K4R1GCOE26W+2Eh:hX2iyph/g1YEPWYh
TLSH
T115A5BE13F2D900E8D05ED179C7468632E962BC160B25BAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 599KB
SHA256 3b5e3649ed7a90af06a8cbdf16c9c4b5b35fe0cee5267a6da97ce05c22523798
MD5 4964548d784c98f545870ac7420b54ec
SHA1 592c3b0d950db1bca36aff646828ac208920984c
SHA512 be1287c4a1446ec418ee83fd5d664f5e72a83199256e7051abf535aa65ca7d350a5313570ce87476071086a5d8f64d53a5bc9eb18f7e645e223213f69afbf8ea
SSDEEP 12288:uOGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:uOI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T1A4D42355CFBB1062E17617B3A0A83F4ED168159A878138E0871FB75BA332EE1F34945E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 599KB
SHA256 9657632e29bff5146e4201e2cd6f4673126641337a0ab9766d860b7b423f2ccb
MD5 beb116fa0312262053836cf897edf89b
SHA1 2c17caaf4b63dcbf39f4bd5406e6e64481e47f8c
SHA512 a6d8b954fdd522d0afe06486e9e178dd25752c14c7f8c1d6d179442575bfb7e3e2a28f3af626a9693598d4c046d1af2ad6ab3ace31bca81989f2b796a7f8f739
SSDEEP 12288:sEGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:sEI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T149D42355CFBB1063E13617B3A1A83F4DD168159A878138E0871FB65BA332EE1F34946E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 599KB
SHA256 a3e01ad0c53addd3d826230d46054e8a4c7a0e4df084492022ab5b1ee96cdd67
MD5 a016e7f053a8ad1c9cd0bf769a47b82d
SHA1 4e03cef91322516aafcb92949620df4ef8d983d5
SHA512 aa00d8f8b20ed14393ad55a4a1a44e88433c905432e60d6f628e9f3966350691b5c851421f88c02759055cbaeab24f505c0ac9db099c57d6d8727d442c937e37
SSDEEP 12288:OyGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:OyI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T1E1D42345CFBB1063E17617B3A1A83F4DD164159A878138E0871FB65BA332EE1F3494AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 8eac1ff95680860cf5818b46e072c78836ce7146d7d55bb1e208ec7e94cd547f
MD5 f33410779bf5a922d9de072151666c8f
SHA1 28b0d4088f7d2050bd93d1d0f04f080e494396fe
SHA512 499114a23f387b301a97da232bbf07f52c7dd9b458aacbd76fc0a812546eb568ecfc15dde706ac942bbc07173a61c4a8fc06fe750113a715acc9023681de2ff6
SSDEEP 12288:iljpGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:KpI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T133D423519FBB10E2E07653B7D4A42B0DE2B438D5874139AB871B6A4F1B32FA0F71885D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 599KB
SHA256 e1f51f63f56471e72f8fee12ec6d4643565a1dc7cc619743f3eb0d39d3834777
MD5 801308ed5de651f353123afe70fcb8c6
SHA1 3d4b78b369e016c080c20afba8e751540ce46d2c
SHA512 d386c53be8eefdc7d02c5533c1da261ed54471f85d89373e4ac959b30ab7efd466e27baa2cfc49e98b29a184743400c8f80ca3a826cf8c63153c3b89c341504a
SSDEEP 12288:1aGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:1aI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T153D42355CFBB1066E16617B3A0A83F4DD16415DA838138E0871FB65FA332EE1F3494AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 599KB
SHA256 3ade86b4833278eeae2c1a1430003b7a9cf31a2b2aa8bdc9b9299fa4f308d0a5
MD5 0e53857bfe7a5742018c06096ceff967
SHA1 230ca9c0c3a15f54e28d9ad11cda91f9a96bd8bb
SHA512 862e4da3d4f46914f88df970e8dc8b7ea14d0f7475101abbc51a19a02927a4150d5dbd7d5285f4e49fd0131ded057dd438be930247b9edfb70b2a1cf5dc405b2
SSDEEP 12288:WgGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:WgI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T180D42355CFBB1062E17617B3A0A83F4DD16419DA878138E0871FB65BA332EE1F34946E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 599KB
SHA256 844a496cbe24e8beb0c83116e5e249bcbcfecc6ed50fa106252b58965e294e59
MD5 6b5e44f4994e71f67b2c6d4182c7c00b
SHA1 bc5aadcc3e195e3064f178b46a2d3dae70cbfd43
SHA512 4b1ab6d775e611a19b6ffa26874220d55e68b7f34d236468f855b63f39aa15c600f462998ab2b5ee2f16d5d706ca8957026f63706444e81f132ac559155ee97a
SSDEEP 12288:w2Gd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:w2I5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T1A7D42355CFBB1066E17607B3A1A83F4DD168159A878138A0871FF64BA332DE1F3494AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 ac9d5582bc780b3de285930d72838108e88245f61e0f7a3aa0be87ec64d94522
MD5 b583348f8edb0464e750cb59e810cfab
SHA1 17518604075e3e956ffdff6ed58d8db41a10a8e4
SHA512 4fcee25381ecbd3570b29a65cb4ee80e5cc76b17e735a522e36a3524d24804c4a98eb408347d47fd65ee02926cd66bcc632ba76f4d7d55a31705e57d26c289fd
SSDEEP 24576:BZMtzFVScUI5K4R1itChwEaGNpktQWge4uP8V2EhYq:BZMtzfl5K4R1GCOE26W+2Eh
TLSH
T1C2150295B3A018F4EC77423EC8555E0AD2B27C5A0760C61F03B8366B5F337A15D2EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 599KB
SHA256 17523b4ff34ee05ddd679972e764997b97d16a8fdd34fc95b14e85ee25592ffe
MD5 e32b12974bc4ef7c00edd7bca8dff3de
SHA1 f8dd697a34529ab635ab0799ed0a30ba7ad9654e
SHA512 4c5ed9363b6ac9674cbaffc073f191c5acf2a20f0ca4373d06b3b43f2cbaf25ed8e034a2a2396f518c368022510bb19f9bc80b0a7213828cd99752a3e0160aa0
SSDEEP 12288:kVGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:kVI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T168D42355CFBB1062E17617B3A1A83F4DD168159A878138E0871FB65FA332EE1F30946E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 599KB
SHA256 08e22931294a1207ee32e4e6dfa7ad6f77ad50bf9508c06b7081085e8a96407a
MD5 ec65ff7ef77d94030701077c8a080d54
SHA1 cfbccae96d4d414570324883883888a4fab1897f
SHA512 938718cd9ada7c0e45ff506e8045342b0a5a4c11e5e5a57c56462ff78c450b6fb07be28d7b2bc9db6e7f8bade3a1f477fa31dca780746b6dc5e9e7f69768d180
SSDEEP 12288:eSGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:eSI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T1C0D42355CFBB1066E13613B3A1A83F4ED168159A878138E0871FB64FA332DE1F34946E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 d5c6b570a1708a86bf8eab96b11dc9161282ae8ad07951ea2e81442078e5a011
MD5 72840e08fdec2c0e3d4f120c49c208c4
SHA1 d2154ebb4a1631f943bfc50378d47882816b6a5b
SHA512 132be2802813bbe801e48334a974de964dda4b928c5b3a1499d2991b6efc678e121a43187c0b44ab3117b1b1370b4dd54f4175df5fb85fd1fe0527b420321032
SSDEEP 12288:p8Pz5LmQGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKi:OzsQI5K4R1itChwEaGNpktQWge4uP8Vt
TLSH
T1DAF4120767B630F9D1764239C8A11F0AF371787647105AAF4365577B2F33AA0AE2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 599KB
SHA256 6591ef489b0f4877321e4ec6f07e699d8f8e25d8af8aa3203a6e0d112382fb2d
MD5 52a34694319a04fa495cd1952799d6e0
SHA1 d28ca38be45e698ad4923bcec439b18debc1654e
SHA512 42d36f2bf3fb327556ff2d63eb0595155a15158890c5c51d591bf77e78564c93579de85ab4dcf24a3b15d4fbbf0ea13ec81f690c3d5f261fb4b4d80a6a08a6c7
SSDEEP 12288:I9UPxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:I+ZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T152D4234FB1B21828FB698FB57171813FC1F4612D87EF97B2B71820673A19085A6342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 599KB
SHA256 cf503014d77b448a4ae656aeeb3ef8569950ac7aedca8172818f14aaacca03fb
MD5 b5c050497dfd9b4d1d7e6d7c11953f08
SHA1 8d9be71e39504c214c351fd4661142d4e160763a
SHA512 105cbea86f53fcf521a676bbaa4f8e287c6ef978e2e5014fd93cbe6b040d74cc16ac3fa29592e0a2383a6a9101ecb7e6b0f1d7117d506e7c573f563685a91b53
SSDEEP 12288:sVPxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:sVZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T18AD4234FA1B21868FB298FB57571812FC1F4712D87EF97B2B31861673A19085E2342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 1685ae9ba031bcc06bf21537ae438d1334b7b4399e0fcb2bb4bacafaac241bef
MD5 f55f1be0e9fe46a34a1d6576d785eedc
SHA1 427b1e29c09fbec23f6bd2e69c08a878560f64b9
SHA512 7dffa3f01e5a1fe5fc282a851bcd8b2a72992946b85cb9ec7b6cd09ee598673d56b3e26f76e04c5ab4d622a09a30f4bc394044223577f8cf38ad740d343eb882
SSDEEP 12288:dQPoLLjFPxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:mojFZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T172F4020B73B130F8E576863898A14A16F3B1B43547759B7F636402772F272909E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 5a0c6fc97a1a981dc7e7eaf9a282d9f1550d3abc93f377b0db72934975ef7cf2
MD5 1831dc0becc0b728943e7f3dc310209f
SHA1 78fef96cf7ca7df4c7f6ae7f93947efb4a97c1a5
SHA512 e6e4c3aad3a4e6acb7b44e1cc1f0ccdf79c54841070d6436712c0d74d7665e4fdfc1089dfce733dcd66bacd4f591bcfc7fab570a3d2fb2bbac37a880ffa84fc2
SSDEEP 24576:nTeaLl3z0zDQZuIylLJ5nr/hrVyUtgXvH5fthm:nTtLljH2lLrThrV1gv5f7m
TLSH
T116150199B3A018F8ED67863EC8618916D2B27C1907B4C76F13A436671F333905D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 a2f919011f8f2965a35e798d28ee1a454248d28e3382e0522474d7962250f88b
MD5 1d4e42723080bf98da843c7901b810ef
SHA1 e33c845fb620fa586c7117a881452628e11b4d87
SHA512 6f02b0c56b8429869826aaa4aa111a75a898cf0c6525f54eb7f62499901f81b44d742e51fca1bb4473095bc462082f56b8d8155324f0d39c055e7a0799915b85
SSDEEP 24576:y3JdcCHVy7bmnZuIylLJ5nr/hrVyUtgXvH5fthm:UJdcCHVyng2lLrThrV1gv5f7m
TLSH
T15435CF95F3E414E8F1B78A3589728512DAB67C591B71DB8F03A8261A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 599KB
SHA256 2f61f514d7a32deeb18d8a1fb819c6cccafb631013dff62236063a4b140cea19
MD5 df6b84d499e75c8d0a3a9ffa719dc849
SHA1 4a5a9960bbc361e9c5bf94542ebc357ff2b4ca37
SHA512 32b8b1c4f19bb852d889a988e06207caccec8334b292aad2b7333601c19aaea66f7ead8745a2f260b40ac1ee3ed9d0f6fb9070dfa4e617581f03228eab931b35
SSDEEP 12288:g3PxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:g3ZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T1DDD4234FA1F21858FB698FB57171827FC1F0712D87EE97B1B71860677A09085A2342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 0d360f47490dc1a2bac148d1d846f022b7bb6591b6c9c5157350d7c1c885da22
MD5 ce3d92eefc2897697713e95ac09ceb53
SHA1 958e6dd795a07c0a9634c7c93436422d654844ec
SHA512 5e7986b214660ccf1d3e72025c19d0a3c2bc0e8bd2a17f21805adf5a7fc0d02296990a79f110c490ea0c0246632ec4fe5b5989fa7a8c8bd6cb0ff87399aaebfc
SSDEEP 12288:ISPxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:ISZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T19CD4234FA1F21868FB6A8FB571B1822EC1F0711D87EF97B1771820673619085E6342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 599KB
SHA256 9cdc33bd095c4dc39dc9fe80df79d1458310785a9b319b2768a32aee35551651
MD5 947cfc1a2f849bda48aab676bf1eabda
SHA1 7bb39bb4750e6f635081934be065265cea497710
SHA512 9c2171d7a8cd0f56a0d6eb666f027277bf818de396506a2f083d8b199a9d13661cf7ec18f4fd360aaec34c9839a7f904448da408ad4e24e637056ea2845da69f
SSDEEP 12288:5oPxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:5oZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T1A7D4234FA1F21814FB698FB571B1817EC1F0612D87EF57B2B31821677A18085A6342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 599KB
SHA256 95b14cb5da931fe0790ff9cf99d92ce95731bba96f6fdd0be20dbe3e16538938
MD5 6ec50775d928cff8fc9dbde67f8b6a46
SHA1 74e5b887094e73d1026ffe60d041a4510a6d267d
SHA512 8794478f7d966f0e9caed3ac645c5439418274f9805b4e15df9f31ee4f99d4b40e0e5bff574ec6542ea1b418d309572a9c23720c6ac2de9012e989e9eb101758
SSDEEP 12288:68PxuLcWd7lLWsa1LwGWr/mexFVwbUrWuqg4XbfTnH5P3lDhkXP4:68ZuIylLJ5nr/hrVyUtgXvH5fthm
TLSH
T1AED4234FB1B21868FB298FB571B1812FC1F4711D87EF97B1B718216B3A18085A2342F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 719KB
SHA256 f22a827823121a6e4a770d49ca84ad4037b0318269171d98677d3ffce099a3a8
MD5 c85d751a3dea2c7aaf0fdc92bd72f9f5
SHA1 94200e97bb45cc8be9e289105ed527bfb650be43
SHA512 3cf1ea3cb130721fd2f5036f38dc4ee876f4606aa181cc3d72677da2589be53d23f0deedb52115228db7657372986cf7849800b2536c832bd2697ec1f7467c94
SSDEEP 12288:GpsfmGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDk:TmI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T194F40119D6A801E8C06E2276C7555A45F3333C6583E1A3CB43D1F57E1F36AD0AEEAA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 a476142f7d68a08f99e81f135501014951a4b8ad0d0ecc783ba1c54fe7614e08
MD5 db14d9c733af0a6e19700f0dd6f0ecbe
SHA1 39c1d93bfe157f2ec9305e282461abb46b0f81ec
SHA512 72974adc768b35c1e840dc36f0fbb4e89f1c6ebf0ca80ea5b815f3982a4a13e0b1afb63d9c6ca8ba0b0aa90102fafd592bcddbc857e22750cf96a38a5c1b289a
SSDEEP 12288:cv7gGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:KgI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T112D42352CFBF1412F07617B260AC6B1DE21975A58B4028E3860BB79F6231ED1FB6941F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3c6086842d5e9807be3419d2f42af4d3adaf433c9699873f4a4904afd72fb14
MD5 d104362b00447d6f07824dd8852d3876
SHA1 d896a6421252a06b3666631d6bcd2ea022c5518d
SHA512 ad82a4fcce3dadef4e609a4f8f221367489f343833837f8ac7ef2483d5c54b59c5c22bd0a6dc8cf2e37a5ece01827df53f48e3e68311550ef654804ec4fa99de
SSDEEP 24576:Vgb6bmBIi49WNNFpg1rSvFv7bYjI5K4R1itChwEaGNpktQWge4uP8V2EhYq:Vgb4mBIBhGFJ5K4R1GCOE26W+2Eh
TLSH
T1E165AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1251426D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 2a87030029754dae0fd0f809c615a46fbc27eccea7f1691bd6395d8c99591473
MD5 8dffeaee79a172c9628ebbb381a95dc1
SHA1 a967fbd0083b9efa26a298cec5ba7a4465d9be80
SHA512 27631f8f9eda9d0daa88443ed3948cda07392903cdcd3267e6c0b1ccff30ef10ec140ad09b7ac7f23bb5010a4339434e5946e4b3d8399c3724769caeade2ef5f
SSDEEP 12288:z2GMGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:aGMI5K4R1itChwEaGNpktQWge4uP8V2M
TLSH
T1E2E4226D5AFB30A5C07A437694A82A1AF17134A0470038FF469AF67A9B35DE0F339C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d28c880dbe42fc3bd516cc8eeeebc77eca1a843becb5976b8a2d273de346aa86
MD5 57751e166f3116b4651220daad4a7a78
SHA1 62bb40fc764b47c9e17d9571a08d0d27777f404c
SHA512 7e3097eba4a71e4a556e1872266fa59d0b4c29281da3b6fad8d9e89c5e8554571ba7d1cc235c949f53eab4cf7d9ae57c2254e52e36072a63bb07b371a94b4d2e
SSDEEP 12288:UJGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:UJI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T135D423558F7B2062E17617B7A0A83F0DE2141595878138E3821FB79B9236EE1F33946E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 222cb1f956061c88d61a476c60c9272ead8eb2ad7e443d9364f1938d79232c29
MD5 1bf9ce8347d3eaae63bb20556300b751
SHA1 987d8725b8d5b8b190914d52aed6ea5796780ed6
SHA512 e8e14aa4078e53135b090f151932109585272ea8260d98fdd35439dba79407f1852b2f89f50dcce38001a8c7d71d71e55b31a2cc11abd19bf202ad32ceced338
SSDEEP 24576:nG88u8FpJqH19zria7/m1I5K4R1itChwEaGNpktQWge4uP8V2EhYq:G7ZFPqVka7/n5K4R1GCOE26W+2Eh
TLSH
T10335F16567E101F1D07BD13889864667F2B2B4250364EFDF07AC8B561F23AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 f638e1d15efa267382f27fe7c84b6ce5c9dd39c015b00fc1d2c247c72cd57d92
MD5 5428abb07631d5b870e77184527db908
SHA1 5c02d6da53ea43fa8b233b4821e11cb11f9dcb09
SHA512 072e2fbf90b76f8abe20698750a2bec5c9589455b545311ec7abcc259b1eaf899d614b15719ab538b8f3daa3646773ea2cbeca589fe9cd0d9e4de684ca6dae46
SSDEEP 24576:/PUr+NQCI5K4R1itChwEaGNpktQWge4uP8V2EhYq:/JQp5K4R1GCOE26W+2Eh
TLSH
T1A105F12F66ED18E5E27AA17D8586470DF37174620702A2DF02E1817E5F23EE8BD3DA14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e5ae1323607c09f8b1edb24e608fd164da7764421f9482bd9ab89e6dfd5c0cbf
MD5 4e86debd48cd06f3f5d05fcab37c6a98
SHA1 746657d971f76735b6cd12d1a6d9a75ba3bdc8e8
SHA512 c4a0340dd91ad1ace0e53cfbdf9b86184aa939de094b797b63aae88589e7916e085332c10934f1959acda8f01b2928a626726220eb2a520a4a306b7d9bba2659
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc5K4R1GCOE26W+2Eh:7G05lO43b8g1YEPWYh
TLSH
T10BD5C06E62FC11F9D0BBD17CD9C64A0BEBB23415032556CB02A486A91F27FF4A67E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 5572aeb1fe726829d1bc115397e7401af6cacb12a8cb99623b4dec896cb29cea
MD5 fcb6ab115b73178704ef2eb66eebf771
SHA1 64e2286a0bcc504d27388ce3278082742cf1913d
SHA512 7ea61ae4b7e3e0bd396ed43b21f08263e7c00e2abde948c00007634a712e9a96658fc3815aff73ff97ccddcd2e1405524dcb9661a4f9bf9c6dc38f0b027d03b9
SSDEEP 24576:Fdx5POZ3dpbWVM50JicR2hG0lasx2+47eidnlI5K4R1itChwEaGNpktQWge4uP8j:nx5POZ3wJt2pasx2+mM5K4R1GCOE26WU
TLSH
T1FC65AF5EA7FC01D5D1B9D17DC5834A1AF5B1342653319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 80f485c2748d31a1ba3a27fe94a183908b12ee9d292a1f0fd7d197f0217f25c9
MD5 ca709143c9c6575cd4d4cd4ea924eda6
SHA1 312321e3593f03f511bd8d81cc99725ccdf1517a
SHA512 7f419213e84207ff316fb99e8fa54677f51253a6cb362900fe77fd948f1210c11285e038157593b855905869eead7677d37cfd232de45c675043df531a823a27
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkDI5K4R1itChwEaGNpktQWge4uP8V2EhYq:VNc/zEOVHFR5K4R1GCOE26W+2Eh
TLSH
T1D9857B1623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 df163f15767c556bbb9e4a932f3f994c33ac10a3bcbdc8f46b5efbc60f7ce653
MD5 a5c70a31005d7bb6062d66eae0037c23
SHA1 44d5630c4ec09f6853509e6673b85ace3525120b
SHA512 3df0c61adafaad4c2a533ea37f93610bff2009c49eba068bd1759ac0a48ba11323f759bbb02667d22eedd224aa021ba3a47f32feffffa8e1601164f4a6376a30
SSDEEP 24576:LJnJPbzB4S/I5K4R1itChwEaGNpktQWge4uP8V2EhYq:LJnJv6Sw5K4R1GCOE26W+2Eh
TLSH
T1C015D03DD2A810E8E4B7C2B4815A1B5AFF31387D2B1169C719B4D5353F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e4a65dc03b0608bb786c5617dc5e858c344c45b8c05166c91e72bcc23ad3115b
MD5 69d3ee5b38bb8b1da5492e0a9420658f
SHA1 bf0af39849d0a4d529547c31bbe4a130d4c52dd6
SHA512 e0ae1710e1da03e60cc926f6c9b1de6f47f148164c0bbd91c73804fc09d5e8da477941d5147fc0ceb86205f2b0fcc10c2e1686baa81ecec34a26ac28f7a69b0a
SSDEEP 49152:GsoHGeeV5ijCmlDWDk15K4R1GCOE26W+2Eh:j9g1YEPWYh
TLSH
T11AA56B05E7EB5184E8F3CAF5C92694169A327C549B34F7EF4A80CA6A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 1c31a432b7cb1fe652134e4022d600a61d3f9d6b4fc4001e662ab661d3fcbc35
MD5 de252ea719bd86ad81c443ee4367e42e
SHA1 9b754570b7f6ea46633a1ef452fc58a68842220f
SHA512 5febbc4c0d3b2621730cfb8a0e6971247a6624c9a65538e01d8d750152a802a2d83afaff9e2151926f8c0073b07a8334838c207620b31c170e42dd17d93db883
SSDEEP 24576:N5DIeGI5K4R1itChwEaGNpktQWge4uP8V2EhYq:N5DIel5K4R1GCOE26W+2Eh
TLSH
T154F4015D677A10F5D07B903EC1820606E2B2B0B1875229DF0799D5BE9FA3ED8BA3CD41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 cab0a74a3ac921834724b5f7def38381d7e48cf611f3dbb2b2b7ca6f75327be5
MD5 d92a8bb663749a8df747c18e0ce44caa
SHA1 62db583f30d15379b921a57bd37e4a3ba780a955
SHA512 089052fa383360f988c8f35ba5811e43e9187695b5382c7f05f743c5a287383a93d652702d431fd2bc9c734ece0fc75d923935cb53049fe2428ac2700c8522e0
SSDEEP 12288:KT6kyiGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDX:OtyiI5K4R1itChwEaGNpktQWge4uP8Vt
TLSH
T157F4220497B92095E1BA037999B65759D6347C208B0126EF4292F73F2F36FD0FA34B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 0bad7f63e695c117d27d320e9530394f9f447ae62df23d1712550b7402ef1e9c
MD5 a860c72530365a1374b9c67ab201a340
SHA1 f51e2ed9ece8a4c0713acb8d7f040d16b86c0da6
SHA512 03444b5edcf2648801f9384f184b198ed06517af9f6e4ff9e842034889d25b9672ac467627022c7872e2ac8782deff195ce96881ff0a85e065f9a268f31cc9cc
SSDEEP 12288:TJsGd5gl4nbtGeHCYqSDtPhlt4EhUGNpqepVytQWgaD4uPCpV2CP/hbEHKmDkA:VsI5K4R1itChwEaGNpktQWge4uP8V2Ef
TLSH
T1D9D423598F7B3066E02617B760A82B0ED16431A5474128F7869BF67B9336ED1F339C0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 595f683c34f243854df6c3e776f0e53ea06c0ec7901945adb20cd7cfbb6695c9
MD5 c4fb20016f817f8cb43317282793922e
SHA1 fde4a0fbf1239441027b983d4642f965c1220dd9
SHA512 941fd986fcc700b1d9b4c81a343f14977a2ae6400c81b938474cdab1c0b22e2fba8d807d19c283e36df101290e0a18922aa0802decd19cb6d6099de6becaa300
SSDEEP 24576:0rg6goTfaidZGI5K4R1itChwEaGNpktQWge4uP8V2EhYq:+ggTrZl5K4R1GCOE26W+2Eh
TLSH
T196559C1DA7EA05CAE2B2D235D8721493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 6a0cc4a7af3253b24496b3da65417a18e1dfedee5ba0c6df8ab52ee5f850af74
MD5 7f83dfb65df6f20384a6aee7cbfb5df6
SHA1 0637283f1f9f7a5fc540e9c0638bae0f1c8fd62e
SHA512 2bffe87184ea67c6cff554cb52eab93b9e018112147fd9bb4166afc4a554ef72fc6df826cd85e88e1d97354438904ca98b743cadfbd3225259b54480ed8d3a35
SSDEEP 24576:wrcmRkI5K4R1itChwEaGNpktQWge4uP8V2EhYq:ScmRD5K4R1GCOE26W+2Eh
TLSH
T17F05F15EB7BF00A6E1B7827CC8454609E2B37070435227DF42A5C77E4A279E9BE38B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6924d75917c0cc90e22cc999d26444aa736447ab626eb1072734d9adfffdf607
MD5 f78017e76a35c50a9ed8ec01bb0b25aa
SHA1 62d42e1fee25c686863417bf25d307eb80d6f934
SHA512 d6088167f4596b237b3f0dcb7f55e3d7877255eb34ef431535b4d2b0d9ffddb2921fd4194d17589c58749d19d8b316aacc3a6a77e2996c9f9a1444c29b6c4dfd
SSDEEP 49152:+DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3Q5K4R1GCOE26W+2Eh:f3Upow8sBQg1YEPWYh
TLSH
T1A8A58C3DA2E810A8C9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-255-0x000002187D9B0000-0x000002187DA16000-memory.dmp

Download

memory/792-249-0x00007FF7E1040000-0x00007FF7E1159000-memory.dmp

Download

memory/792-338-0x00007FF7E1040000-0x00007FF7E1159000-memory.dmp

Download

memory/792-256-0x000002187D9B0000-0x000002187DA16000-memory.dmp

Download

memory/1116-357-0x0000027566C20000-0x0000027566C86000-memory.dmp

Download

memory/1116-356-0x0000027566C20000-0x0000027566C86000-memory.dmp

Download

memory/1116-355-0x00007FF7EA270000-0x00007FF7EA4FA000-memory.dmp

Download

memory/1116-449-0x00007FF7EA270000-0x00007FF7EA4FA000-memory.dmp

Download

memory/1272-448-0x00007FF647150000-0x00007FF6472E4000-memory.dmp

Download

memory/1272-339-0x00007FF647150000-0x00007FF6472E4000-memory.dmp

Download

memory/1272-333-0x00000247AC1B0000-0x00000247AC216000-memory.dmp

Download

memory/1272-332-0x00000247AC1B0000-0x00000247AC216000-memory.dmp

Download

memory/1792-31-0x000001D1A2210000-0x000001D1A2276000-memory.dmp

Download

memory/1792-30-0x000001D1A2210000-0x000001D1A2276000-memory.dmp

Download

memory/1792-29-0x000001D1A2040000-0x000001D1A213B000-memory.dmp

Download

memory/1792-32-0x000001D1A2210000-0x000001D1A2276000-memory.dmp

Download

memory/1856-26-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/1856-0-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/1856-1-0x00000000024D0000-0x0000000002539000-memory.dmp

Download

memory/1856-7-0x00000000024D0000-0x0000000002539000-memory.dmp

Download

memory/1888-363-0x00007FF772B30000-0x00007FF773000000-memory.dmp

Download

memory/1888-364-0x00000188048C0000-0x0000018804926000-memory.dmp

Download

memory/1888-365-0x00000188048C0000-0x0000018804926000-memory.dmp

Download

memory/1888-450-0x00007FF772B30000-0x00007FF773000000-memory.dmp

Download

memory/2340-40-0x000001D7E38D0000-0x000001D7E3936000-memory.dmp

Download

memory/2340-39-0x000001D7E38D0000-0x000001D7E3936000-memory.dmp

Download

memory/2340-38-0x000001D7E36B0000-0x000001D7E37AB000-memory.dmp

Download

memory/2376-374-0x000001CCF1090000-0x000001CCF10F6000-memory.dmp

Download

memory/2376-451-0x00007FF69F150000-0x00007FF69F656000-memory.dmp

Download

memory/2376-372-0x00007FF69F150000-0x00007FF69F656000-memory.dmp

Download

memory/2376-373-0x000001CCF1090000-0x000001CCF10F6000-memory.dmp

Download

memory/2624-342-0x00007FF792740000-0x00007FF792889000-memory.dmp

Download

memory/2624-270-0x000002222C020000-0x000002222C086000-memory.dmp

Download

memory/2624-268-0x000002222C020000-0x000002222C086000-memory.dmp

Download

memory/2624-266-0x00007FF792740000-0x00007FF792889000-memory.dmp

Download

memory/3080-317-0x000002436F900000-0x000002436F966000-memory.dmp

Download

memory/3080-316-0x000002436F900000-0x000002436F966000-memory.dmp

Download

memory/3080-409-0x00007FF6DA6A0000-0x00007FF6DA753000-memory.dmp

Download

memory/3080-315-0x00007FF6DA6A0000-0x00007FF6DA753000-memory.dmp

Download

memory/3360-410-0x00007FF6493E0000-0x00007FF6497C4000-memory.dmp

Download

memory/3360-325-0x000002341BCD0000-0x000002341BD36000-memory.dmp

Download

memory/3360-337-0x00007FF6493E0000-0x00007FF6497C4000-memory.dmp

Download

memory/3360-326-0x000002341BCD0000-0x000002341BD36000-memory.dmp

Download

memory/3520-250-0x00000268FD770000-0x00000268FD7D6000-memory.dmp

Download

memory/3520-246-0x00007FF60C140000-0x00007FF60C208000-memory.dmp

Download

memory/3520-251-0x00000268FD770000-0x00000268FD7D6000-memory.dmp

Download

memory/3520-324-0x00007FF60C140000-0x00007FF60C208000-memory.dmp

Download

memory/3536-17-0x000001B56F6A0000-0x000001B56F706000-memory.dmp

Download

memory/3536-64-0x00007FF7A40A0000-0x00007FF7A41C2000-memory.dmp

Download

memory/3536-16-0x000001B56F6A0000-0x000001B56F706000-memory.dmp

Download

memory/3536-15-0x00007FF7A40A0000-0x00007FF7A41C2000-memory.dmp

Download

memory/3536-18-0x000001B56F6A0000-0x000001B56F706000-memory.dmp

Download

memory/3736-391-0x000002836FC50000-0x000002836FCB6000-memory.dmp

Download

memory/3736-394-0x00007FF6D6820000-0x00007FF6D6B5E000-memory.dmp

Download

memory/3736-393-0x000002836FC50000-0x000002836FCB6000-memory.dmp

Download

memory/3736-453-0x00007FF6D6820000-0x00007FF6D6B5E000-memory.dmp

Download

memory/3776-276-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3776-281-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/3776-275-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3776-354-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/3836-383-0x00000258F1580000-0x00000258F15E6000-memory.dmp

Download

memory/3836-452-0x00007FF752030000-0x00007FF75215E000-memory.dmp

Download

memory/3836-382-0x00007FF752030000-0x00007FF75215E000-memory.dmp

Download

memory/3836-384-0x00000258F1580000-0x00000258F15E6000-memory.dmp

Download

memory/5524-351-0x00007FF73D7D0000-0x00007FF73DAF0000-memory.dmp

Download

memory/5524-344-0x000001E62D680000-0x000001E62D6E6000-memory.dmp

Download

memory/5524-343-0x00007FF73D7D0000-0x00007FF73DAF0000-memory.dmp

Download

memory/5524-345-0x000001E62D680000-0x000001E62D6E6000-memory.dmp

Download

memory/5524-349-0x000001E62D680000-0x000001E62D6E6000-memory.dmp

Download

memory/5588-46-0x0000016321960000-0x00000163219C6000-memory.dmp

Download

memory/5588-55-0x00007FF7D52E0000-0x00007FF7D5520000-memory.dmp

Download

memory/5588-47-0x00007FF7D52E0000-0x00007FF7D5520000-memory.dmp

Download

memory/5588-48-0x0000016321960000-0x00000163219C6000-memory.dmp

Download

memory/5588-53-0x0000016321960000-0x00000163219C6000-memory.dmp

Download

memory/5704-306-0x0000024DDA550000-0x0000024DDA5B6000-memory.dmp

Download

memory/5704-305-0x0000024DDA550000-0x0000024DDA5B6000-memory.dmp

Download

memory/5704-304-0x00007FF662E30000-0x00007FF663246000-memory.dmp

Download

memory/5704-447-0x00007FF662E30000-0x00007FF663246000-memory.dmp

Download

memory/5704-445-0x0000024DDA550000-0x0000024DDA5B6000-memory.dmp

Download

memory/5704-392-0x00007FF662E30000-0x00007FF663246000-memory.dmp

Download

memory/5736-58-0x000001C8AD590000-0x000001C8AD68B000-memory.dmp

Download

memory/5736-59-0x000001C8AD7B0000-0x000001C8AD816000-memory.dmp

Download

memory/5736-60-0x000001C8AD7B0000-0x000001C8AD816000-memory.dmp

Download

memory/5996-297-0x000001DC22A80000-0x000001DC22AE6000-memory.dmp

Download

memory/5996-296-0x000001DC22A80000-0x000001DC22AE6000-memory.dmp

Download

memory/5996-295-0x00007FF611080000-0x00007FF61112D000-memory.dmp

Download

memory/5996-378-0x00007FF611080000-0x00007FF61112D000-memory.dmp

Download

memory/6020-239-0x0000028256B10000-0x0000028256B76000-memory.dmp

Download

memory/6020-238-0x0000028256B10000-0x0000028256B76000-memory.dmp

Download

memory/6020-237-0x00007FF60C140000-0x00007FF60C208000-memory.dmp

Download

memory/6020-314-0x00007FF60C140000-0x00007FF60C208000-memory.dmp

Download

memory/6116-371-0x00007FF69F0D0000-0x00007FF69F813000-memory.dmp

Download

memory/6116-289-0x0000027E1E5B0000-0x0000027E1E616000-memory.dmp

Download

memory/6116-288-0x0000027E1E5B0000-0x0000027E1E616000-memory.dmp

Download

memory/6116-287-0x00007FF69F0D0000-0x00007FF69F813000-memory.dmp

Download