951cde84a20b674b9a6379c450096e5265ee487683a6d44d1bbe150c30e1f0d3

Analysis

max time kernel
142s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Size 4.4MB
Sample260808-dnfwrsyfnd
SHA256 951cde84a20b674b9a6379c450096e5265ee487683a6d44d1bbe150c30e1f0d3
MD5 903d1eb8855501108c1a5a3063cab102
SHA1 27c2d2d254590feb3771c0d88f889a7d138370b4
SHA512 e81c94dc2670118e9b6adae577067fd1acfcca98761aef88d9fa7ab8dd0d378358acd40a07bceacdb2ab9f8c3916c1c4017c8fc69aeab7e5b9542f82aa4c7caf
SSDEEP 98304:tEjMTXAwkVmf816+A+by0kyJsoGvoH7eFEc:tEjMTQwkVm01QT0pGvTC
TLSH
T11B26BF11770FC166E65102702A2D6B2B92BEBAB65F3642C3F3D42A5D0D612D36B35F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3320	alg.exe
2668	elevation_service.exe
4728	elevation_service.exe
5744	maintenanceservice.exe
4372	OSE.EXE
3340	GameInputSvc.exe
4300	GameInputSvc.exe
5176	msdtc.exe
4624	PerceptionSimulationService.exe
2160	perfhost.exe
3784	ReFsDedupSvc.exe
3960	locator.exe
3212	SensorDataService.exe
5304	snmptrap.exe
6108	ssh-agent.exe
2332	TieringEngineService.exe
1492	AgentService.exe
908	vds.exe
4420	vssvc.exe
1716	wbengine.exe
5920	WmiApSrv.exe
2144	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\91bbd30bd744edbe.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2944	5824	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5824	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5824	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5824	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
5824	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
4300	GameInputSvc.exe
4300	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5824	2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeDebugPrivilege	3320	alg.exe
Token: SeTakeOwnershipPrivilege	2668	elevation_service.exe
Token: SeTcbPrivilege	3340	GameInputSvc.exe
Token: SeBackupPrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2332	TieringEngineService.exe
Token: SeManageVolumePrivilege	2332	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1492	AgentService.exe
Token: SeBackupPrivilege	4420	vssvc.exe
Token: SeRestorePrivilege	4420	vssvc.exe
Token: SeAuditPrivilege	4420	vssvc.exe
Token: SeBackupPrivilege	1716	wbengine.exe
Token: SeRestorePrivilege	1716	wbengine.exe
Token: SeSecurityPrivilege	1716	wbengine.exe
Token: 33	2144	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2144	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2144	SearchIndexer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 4300	3340	GameInputSvc.exe	99

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_903d1eb8855501108c1a5a3063cab102_amadey_avoslocker_coinminer_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5824 -s 744
  2⤵
  - Program crash
  PID:2944

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5824 -ip 5824
1⤵
PID:2160

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4728

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5176

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3212

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5304

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2332

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5920

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4f256733b8cb51e1c64dd8d826c60887ddfeb190c8d547abd98caa43f46be71a
MD5 97c5e7fd854fb4bed63574c8d1b504e1
SHA1 665b0f9b36b15ed8ff10d11d162e400d13bd55a8
SHA512 adb805c2edb4c08216c1d39bcd6b6c6cd03cdf75a3eb315f8ae5816c5956a58607565f542163e0c99b8a70a6e483bd85118153037b6aa53abdf8e456690cc13c
SSDEEP 49152:Mib+632BuPkFKRrdE6oh7stBhuXjfS4LWxnUEr1Wbjq:L3q6gjBTEc
TLSH
T11BD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0784B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 3d792f1b2a0820ea1f5120da15a3ac680ba323a90d70559edd41d6351aedd630
MD5 82e46aee7fc2d719e7d2984d64c79ff8
SHA1 cc7a6423794239a90e48efb725810ebb167b7ed8
SHA512 659ba60d4de7af2635f269f88dfd0aae9dfbde5f651d28564dd731edd6ce8efbffe76bf372ad0e6dcd24a831c751a483acb6c19513b4095d7e2066cce096eff5
SSDEEP 12288:o1XLsxhWkxy2lRq2czA2o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZf:OXYLDtczA23JiebITEUWbocDu3
TLSH
T14D05021863E909F9DDE7827CC9A28412E67278454774EF8B03E896360F633D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 af47d839ff96ab2cbde3ab21eb6186a4a0ede7189b1f3ccf4f2504c55bad8fbd
MD5 e3d71a2c515f3b8c9d150d1692ca8e74
SHA1 c1ad0d0f2c00cbd230023cb3cb5a7a5ec8320672
SHA512 240c51ba25b50d24ea8151fc00e343c7437902a7392cb3d61a315067912d632e22c0b95431510b1965fcb9a6eff0cf20791deacc5aab3c710b904e84a07d2c9d
SSDEEP 12288:y4JNYVJegUNQ0w90ZD0wxpGZIVuhrHsfo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZr:D0Je/NQ0wmxOrMf3JiebITEUWbocDu3
TLSH
T14845AE16F6788335D073C0B9C5D2A69AE971308657308ACB428AD77C2F677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1a48fad5ac501181a539f4a9c69feae63a7c2d3402868dac365a249368c38e83
MD5 2472ddd58e300a363f00d9d57c88411b
SHA1 fc937f2efd19fff63a8523c7dfb07afb947921b1
SHA512 217f72f93c2f700fb8ed9c84498a865b5f210358b0db515dcc10765fbdac14f75a27a5f6f81bceb117466197bc1d274c9299684f34df38c6b8141d3e3007746f
SSDEEP 24576:pLE/ezSC6vUyD/aqgrvW/6q8wyuA3JiebITEUWbocDu3:K/ezSC6vUzPvuHjy/Er1Wbjq
TLSH
T1E4756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 3768f6d7e3bd3d2d4a1947664e79b397018d0af1e0bd5b0f31abe02a7337f46f
MD5 27c04b28a34154319abdb33d9d809497
SHA1 1cfcd0d2cc4bb7a9ab287fdea7ef51f31d817c56
SHA512 b0be41c5fe188e1c6f6b194780b421f1a435d60cb8aa3b72bad84d77b52b966a45fa8389094c50c4c5066b0463eb8acaa13218be91a70c479884122e82ea78b2
SSDEEP 12288:wAJjBC33vdhgud+l1D0hwsEBoW/lx4jf0Im98r6o+Wt+4fx0NbKwcLqAFGUEmJW0:wAbCPduuOv/l+de3JiebITEUWbocDu3
TLSH
T186559E66F5748331D073C0BAC5D2AA9AEE7234424B31CACB024AD76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 fada28ef87504bb96b80d5ec6795960dbcfd68e96474e975023a872f0e957a6c
MD5 c239b4a4d23a1e7f9402e915d6f4601f
SHA1 10acadd6d009bcd9c10b59e0d8ca86f9be4b5057
SHA512 25513c7e6c0a4b019375ed9f737794ec8451e69149dd7a53cbea422d204e75ff4b5237740efeb7fd127d318aec00f82b933c47f3d063ca013ccc125c01e4ce77
SSDEEP 12288:AGIo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:AGI3JiebITEUWbocDu3
TLSH
T118D42305877D876ACFCB6A7DC34B402390E0AA49877CDF1A458D367F41EA29CE57B092
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 0facbf4a4698cae40e1a0c9e957833227219a1528605df24dfefc729d64258b6
MD5 2b855ea4521617a1c1321168b17e0175
SHA1 2e562750eefea84cb04d529534d5641790f5bc93
SHA512 bd70f13f6bd2ad645bb20c9f3368de060bb54acdc289b372f88ab477cbc1df99a86ba74f003aa2838562fce7c87a19132d6a7230403418f2b3fa7f8ff241d000
SSDEEP 12288:FeBNUbTVO86Uio+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:FJIUi3JiebITEUWbocDu3
TLSH
T1D215C02BEE38ECE2C6BE9DB857918200D7B274304B6197CBD169831ECE135E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 6422e620765b51ac77a9d4ebe6e730083ab188b499bbb8b6682f48e4243643f2
MD5 0e9f2a384253ed9a999cc4771d121500
SHA1 3c3edb4c53b9d6c52638a0cd1df3abe846e584aa
SHA512 a1cd2f8262fea8f051324681c61ff1977d75b4c048e0ff5cbe772c186597c5895cd766c860f351ea29cfc1c60bcd18f31868b9bd03da678b02471a27ee1d85e4
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5Jj7NRV3T/:nQvGAdlCEL8c/9RN75CHEc
TLSH
T1D1367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 98f094f07f9a6bc732701fe55ad6508cd740a78215b7aca545e29707979c44f8
MD5 aa36df7ab0bf615e54bb3d5b9e5b09a4
SHA1 246e8461a81c7a9e3a61d5ee1c2839c33e605fe3
SHA512 aee3c15ee925c53af18a403014097cb61e55c4cf1ba9b4086519c6d382a0a31bd4c9932f0e8245a94f5b971e2b695474ca4d02a1c5ad10ec3d4d33045079b8db
SSDEEP 12288:aFwSfxL/2Dc3bDLLmt0LDQewsAj/o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD68:SmewsAj/3JiebITEUWbocDu3
TLSH
T1DC15E031FA78D036C7BB0DB61B26C716547CBA204B651EC3E3EC4E9E49642D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 159115f5d8dc2ee157c3e603615107ced785754290235cf612b4c29f63a32aab
MD5 31ccf2b367c92a7001afb1718ec7efb3
SHA1 d5a87d9fdbda0b3dd4a712ee7e274de9d1bff315
SHA512 a190fb1ec3bb8a72b375ca74e5cd2cc3b6bde5ab9678dc151b12b5b4dcb19f72a1203b9c2e5d3d4433f7581821268b1ed6fb7ad7adcebb58bed75b854cca790c
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrydPlbuJHu:BUEtQevvqc2W1cpV2Xrq2
TLSH
T106474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c8bac4e09a64e34a89265c7293aa3606fcdc2afc1992cd5ee3ca3e83a2a1037b
MD5 2a941c753bc3a4d8e35f16c850568ddc
SHA1 3e44f32d5aec0a9d57565b50d4a072b8a9e0e40b
SHA512 b47caf16aa2994f4eab6a7341a2950718ff6bac9ff66145251a3a29150129da99c744f401fa7485b676ec572451a968e0ce35c930641d7320b6f7dc381bf8a4d
SSDEEP 49152:JebRquA/m2yL5zMfFiV+XenmE3/zZEr1Wbjq:6oq1Vjnm6Ec
TLSH
T154D58D0976B8C2E4D1F6C77886A2C647F37178154B349BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a97f24d79e4ad92a505f358ce761c1cbd647d7156ab9ba94b5e3be76a0bc5b57
MD5 f7b23eed5f2ee5f3bef188f527383a01
SHA1 371c8f39a0eaa9f915499e3dcbd93aeee419d269
SHA512 939a2e7acad73712ed9e34a837f2017ded77033700c571891b10439d5855f16a3d5ce1e6ad757955055272837c860bd8f32b93f9cbff50289c983d9aff65063e
SSDEEP 24576:RAhGLvHFoiwtA5l7S53q3JiebITEUWbocDu3:RAMTFoiq56Er1Wbjq
TLSH
T1C9459D81E7F945D4F5F3AAB89AB68171EA76BCA65E31C20F2154D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 7787c095410927d9ebeaff76e2a5b9d89409b16225f5f4294f371ee49378eb71
MD5 eb25d37868eeb59e36185df6ec1aec9a
SHA1 ee35ca880fbcaef51fff956aba05f472d23f445c
SHA512 36b0b9ce9b417befc7baaeda8af501b9c3055ddc31cf1c8789a2b71dabc631ee8ed83f754300b839d8c8f68c6bce58db8fffd25d8858a54830da8ba8a9990066
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+Ceo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r2p:uwuuOW93JiebITEUWbocDu3P
TLSH
T19305F14572A90CF9E9A79638C6478132F7F2B8012A35DF1F0764C66B5F67360AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 7877993760206038e167772ee5d1cb2b522d1dacdcd0a6431a165b4e8cdbf3ae
MD5 3c94afd13614a390ba9f65861cf29187
SHA1 1fae9036eb81d5dbf0bca39c78a878a46dd638b6
SHA512 cbd0f7f75703a073a962d6e65e76d0b3083f1841802d77781451de772085f4217e4792616efceb17345d24566c2390b20b1912f10a3e1aa708ebf61fcbf9b8d8
SSDEEP 12288:NI31Imeo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:S3uv3JiebITEUWbocDu3
TLSH
T184E4124A23BC52F9D6D7967CCAA64502D3B1745643398FCF065D027A0FA7AC86D3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 de5d90986f2227c61b883e8409b62dc5f42d27fe109a2a47c898cb4c5792837e
MD5 833b27dca4c82b4c6be6979eeebf2243
SHA1 627648e7e1cf154fb03bdd1441a50204c9965d58
SHA512 25f93caf998d893a71ffbaa4e03524c9122d4dd539c271bae98733da924c87d2c16d1297cf78342164d5c6396a1f0f0e4551f8a0ecd903fbe53ff5b0ad432b52
SSDEEP 49152:IYj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23k:uQRQyi36YOcP8Lvw2gAf+PN3eEc
TLSH
T11C666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c2af6b0c3afaee2cb9356d6bddc44f1bf0920256f885bf05c580acfb64f009ef
MD5 76fc65502f3ff928f4998f0096319d9e
SHA1 39081d37ee7683a875afe73d0a390001784a7c85
SHA512 b6446961a2230355441f13f889c4bcf9f4988515bdbfa20af9c62efdd23c64f69ac8e1aec7233e03569cc1f72d67f327635219868d6cdabb01ef67e31a66eb79
SSDEEP 49152:IYj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23G:uQRQyi36YOcP8Lvw2gAf+PN3QEc
TLSH
T115666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 22dbdf9113d8a7892d337b60befcf8149d52fa5aec8dbc5c7007d739b182438c
MD5 9b0d1d6a098a04f3025ed93662645fb0
SHA1 e8e91154909f2c0f5e7bdc7332916cc4e7031cab
SHA512 f410100b06f21d3e173ebd6d847f6c00bcdd791c1c6212c41ad78b4927e3b7987eddb27388af4c7527bcb83d456d04af74cfd15fb235936e2861a2e454d8b2c3
SSDEEP 24576:uJwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0U3JiebITEUWbo/:uV68Qg55nhMeWu7PNU3/pEr1Wbjq
TLSH
T108B55A33B2F600A9C44DE1769F4A873196D17C718FE0E7DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9f332a23505242cc7d43aa00859cf1c5fac01f85802be8f9da0ea379774d4016
MD5 82e528ecfa79797461de42d6159c56ef
SHA1 944f46e01c0a6c2fac3cc2ab5f15ad007f412055
SHA512 e3c8234ceeacb0cbc3117683c038a29d9ac7fdabfe9e722d87e09c3b63cb7b518bee8b672b3d5ad1df5205e1e880c03753e1778403d5dbc7f71c012a6bb995bd
SSDEEP 49152:Qn3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk9h:3y5112gYy5azzVv569nLKnhZHEc
TLSH
T121168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c5f56d5d83c9757761a316cb8fbb5e492c464a5348018a12d7b1c306d1ea124
MD5 a09b90f225b76b70ae0184d4bab56f9f
SHA1 e89aa821a7174f27fc28a8c0278b982043a3bdf2
SHA512 40998cbf506d94a968838d5e968bfacdd4a80ab7d613b35d00ec292778f5b1facbea9aaabc713644f53a09c0e29fdc2d42d25fd485722c84a21925aca1b8c855
SSDEEP 49152:BkB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glNEr1Wbjq:Au6JmTxd2dNEc
TLSH
T145D59D13F1DA01E8D05ED578974A9233FA62BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54b29e9d7cb385c1dafe1fa4d5c36ae6dbe8b6d27f9cd3bd0b502ddaed7ce1d7
MD5 10bd7f5da6f802924413a4abf997a7ad
SHA1 bb6bc2bc4c1cf6bb7d9fedff1da724cf6d81c7b8
SHA512 604c3ecbe49709bc20196d786c5529bd55e2daddae1d71180df16f898d8bc9687231c68f9f83344db5f00e63c0bb6602c43a779d5d813c23338789725ceab412
SSDEEP 49152:gD1hpsNoJpF1A6UU44CwH7R4xCLW8SXq0OqYW:WmifPbRXSXq0O
TLSH
T14AB5BE13F2D900E8D06DD17887569632EA72BC460B34A6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2ca5571846610bdd237cff90efa51635f77ba1d234ccbb5811c16c64adefaf3c
MD5 77dddbc189cc8d996389903095cee0d4
SHA1 778fdd26f9e5598577baca69b27dd7987e9970de
SHA512 41d384db1c074023f41ae98aa364e20e0a840572452a328c7823334b58c059792017b1b559c4a1935aab6fe3561c59e729c5c9c0f7d577cfa5cb111db775e9a9
SSDEEP 49152:acSuZQIY0Be2K6RVtOnks6NMHq9LW8SXq0OqYW:B5dKoi61HSXq0O
TLSH
T178C5BF13F2E940E8E0BED6748B669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 23a780b21634fd7014f19757184f80486456c2c0a4fcc9557ca6051bf9e2e0c8
MD5 e0c611d55cd9da71535d5661b6c8205d
SHA1 8c9aff1abc9f6c575712cf479fd54d9e949fb06b
SHA512 2b584fb1609dd714485779c7924ddfe35b6ceeabafb33eb7460a09d995aef6c889967a7a04fb068a5393e15d72716666b14d4c509f0da6d1a1ac264e7ddb8ab2
SSDEEP 49152:KUp6Sn8EApI0figTgiDn0AP5wVLW8SXq0OqYW:5X2iyph4SXq0O
TLSH
T132A5BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE46B3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 e0249e06bbde90aa0b7d52c89f86e307f79f06508d21f1f730cd46f57641d892
MD5 1429c338754cfd623d9cd7ea12ddab0a
SHA1 9791563a27cb8f6ff0e5b3d33ca048b772bb5031
SHA512 2a74b1abe9284c43ed9e7e63975c046a6854c49192589b80bad503bca8bb5b0acacb4e1a9ca11d08074020fda04e6631eb6681c126a3206713c487ef7e808e55
SSDEEP 12288:xfSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:xRLW8StHWxkS9VF0Og+qYl8hY
TLSH
T12AD423B5097391ADC6150E7A7EB6CED395781DE63BE3CA2FAA5005116E31B0EF064CC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 bd593eb661c46988b2d31dfd64dbb186bac259a9982fc6a43425cbfcb081a7f7
MD5 5accbe7298ae16fe7b1b849e26931489
SHA1 ddaf1cad79baa93ccc23e07301e2dabbe00d861f
SHA512 189c7f4d2c526e57519149053be05a00b181fba4f099867c830cbd2386d300e6f5380f877ed25d1232a63b35a34004b49e3cd330ded0127448c707582bdecd1b
SSDEEP 12288:LuSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:L+LW8StHWxkS9VF0Og+qYl8hY
TLSH
T1E4D423B5097390A9C6190E7A7E77CED385781DA63BE3CB2FAA5045016E71B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 312259880e5494632d9d6f32f6fd55e7b0e8ff64a0bb5f968f7b476ef7a74ce5
MD5 b62571d29b22ff19fbdc98bdcdec869c
SHA1 bb9c325cdc5d5addda30952a05cc9085dadf75ee
SHA512 aa16a40ecf9155b0dde9fca9aff8f7e74b67c6799dd04d21092eb9e17987d2e26149aece5ad78fe8b659e55a59d3af1fe28e6bb8b18a694861dfb30ccd967fbd
SSDEEP 12288:VLSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:VdLW8StHWxkS9VF0Og+qYl8hY
TLSH
T191D423B5097390A9C6190F7A7E77CED385781DA63BE7CA2FAA5044016E71B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 61697b573576397225ce2b40abab13903bf6930723c96d69a2d681567dbf861f
MD5 24586b4e3fd81ac208f1a0a378514b11
SHA1 47f1144f91c5bbc503268fb7d1cd600b7f68e476
SHA512 6ceff9762aa591c8c46a6ebad8ff6df904539c62b25ea89bd07c02a717d4c252fbeb2dd12075eb6df1e76ce1454bd19e7c5d4b56b43c5fb018cc501c6c962cba
SSDEEP 12288:3lsSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:aLW8StHWxkS9VF0Og+qYl8hY
TLSH
T136D423B51A6350D9C5264A79AEB7CDE3D2B43CE56BB3CB2F9A0009051E71B0EF074E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 d80efed832450ed2b37de5f020f9ec8deac2f83373444e1a0465c79884af4a56
MD5 609861b3200efae07faf3b315360631f
SHA1 d92cf70d936b21bcc047350be111633a6a4906a7
SHA512 5f4b416b732b0857ae672bd05d384638fc5a82b5e8be2a4ad7b1b6dff9cc15c411c7d0c668a768e7df2f876b9e6e7152ca718a9bfdc212c8555b2afbc2eb9785
SSDEEP 12288:EHSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:EpLW8StHWxkS9VF0Og+qYl8hY
TLSH
T19CD423B50D63916DC6050E7A7E77CEE385781DA63BA3CA3FAA5005116E32B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 d5c8bcc8e15a33dd883581b58d664aa796e025cf32c149f9bf866e38f7660c72
MD5 18aec6a0bfd5a9f6f36bbdb1e793840f
SHA1 0f8c6d59e81dd3a54c4a8dfeebb278d810c51382
SHA512 fc10ce56e7d80d2310736f4713047430892ed48eb91bda799933301adfffb940381882c933beefde9756b8c768e82b280770cecb5749661ae8f7980b21a701ec
SSDEEP 12288:PDSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:PlLW8StHWxkS9VF0Og+qYl8hY
TLSH
T175D423B50D63916DC6150E7A7E76CDE385781DA63FA3CA3FAA504901AE31B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 e6b3c764394884fd995d9780d43e2d2068c3ce9a12334b54a84c2d1b7a1f5ac9
MD5 76a3c26a997db9acd2524dc987b56acb
SHA1 3b2c0c34b433dd00a54ff22f61d9fca710b668a6
SHA512 0374c5e857a38faab4964d0981148bf2c97dd89fc7fcedf7f0c0179b6e89874e0c2aa2e98cf3a67f2d9c07a0c2750b8423a5445a5e50229515a6de0cb4796999
SSDEEP 12288:Q9SJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:Q/LW8StHWxkS9VF0Og+qYl8hY
TLSH
T12DD423B50D639169C6190E7A7E76CEE385781DA63BE3CB2FAA5045017E31B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 9012fa8857fdece0ad29e4f34b0d8564c7e33bf1ed83a29ac028df3c989f4b22
MD5 27b6ec6a45eded8e1826b477d9a2dfae
SHA1 8e6046a6f06cce26420e4e666acb677a037088d3
SHA512 b98c92d4c1a6aa87b7d7fc031df808ff9803bedb5eaf48c33972c46eaaa680ebb2ffddc73587ab41d0bf5bbb9202724a0b96b27332aa669468b3a0b880e7cf3d
SSDEEP 24576:RZMczFVSvlLW8StHWxkS9VF0Og+qYl8hY:RZMczfgLW8SXq0OqYW
TLSH
T1211501A573A118F8DC67423ECD658D52D6B27C6A0BB0CA1F03A426265F333616C3DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 188de728cb4546c05a1474723cba01114080837e2a78fafdd0bbe8e4dc0eb127
MD5 07cf0de00130732512685c1ab6f2c3b6
SHA1 6b8e1c41ba384e6ab3d325ccbe0ff161eb2acd33
SHA512 7a2f9a5712ae98b871ce38393c768165baefa87c916594612a11f9d61dc06bc590d84906a9b217bba9a5ffd94ad65912ac7123b3b8b79e5f59d04a585b2b3cec
SSDEEP 12288:76wSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:7zLW8StHWxkS9VF0Og+qYl8hY
TLSH
T102D423B509639169C6190E7A7E76CEE385781DE63BE3CB2FAA5045016E31B0FF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 8b046f6f3538cfa875b9ebf6478c00741f0d5c8071eb20296e8096293f70a851
MD5 079929d583c9d46007e1d70bf659e6e2
SHA1 66e86e6f24cde9c3e9056264fbb9c43a10800695
SHA512 48abf5aea670e3310a8ec580a98ed83d002aa4ff0d5719fe48e36578d322319fa347a751e7cad38ba0845be9709ec9f5b28952722e2214b9d1e8ef8902ff90b7
SSDEEP 12288:JjwSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:JcLW8StHWxkS9VF0Og+qYl8hY
TLSH
T124D423B509639169C6190E7A7E76CEE385781DE63BE3CB2FAA5045016E31B0FF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9bbeead9cd610992606590efa3102cad90cac2cb9faffdc071c3ab883b67ecd0
MD5 ae7c90c292fe1ac2c590396d56f6af90
SHA1 12201873b883ebc7844012ba434d7ac0e68748de
SHA512 e6391a8dcfe91fb165158ef91dde6b4d77aeae5fa68e6a1950fdedb53af1692af32504ccd53f6c64af0843cdc564c840985a4601c57b3a4cb8a1d51c36acc37a
SSDEEP 12288:1lPz5L1ISJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:XzjwLW8StHWxkS9VF0Og+qYl8hY
TLSH
T188F4026726A230F9C12642398DA24E42F77578721B71CF6F57A006362F33795AD3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 e6bdbc1a91566f9b751338c09c3641a930575911c21284df10fe409c337dc88d
MD5 c67fcb3df53f196fae78effa5bfa47ee
SHA1 8f94f3ded92bf6a8988801f5f4b4774979a72bab
SHA512 92c8c5fe27784f979fc6971811d8edb85ce9d8b0c0ec7df8930b42a68bc424a53134ea5d81e82d4f1f78ade02e993dff27dad51eebbf2be5b76d94b8cfd949d5
SSDEEP 12288:jMSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:jULW8StHWxkS9VF0Og+qYl8hY
TLSH
T168D423B509739069C6190E7A7E66CEE385781DE63BE3CB2F9A5045116E31B0EF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 40ddf8e7208f6e0bb4c2aa5e07fe1927b8c99b380676c783c16f75d8964a61d4
MD5 65ef23fdd82bbf5fe4fa1d65cc2fd531
SHA1 9dfa453fbf86c29bcf5b52f4a00538e0dc245dd2
SHA512 73eb4d0d7f0260154856984beff9cd2569fcea25ed35d351de62af5c2ed21f033748790008c16e2e5b1ca14b7dbb5e71cc9c58c0ca4b3dffb2293850401e484a
SSDEEP 12288:/eSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:/uLW8StHWxkS9VF0Og+qYl8hY
TLSH
T1AED423B5096391A9C6190A7A7E77CEE385781DE63BE3CB2F9A5005116E31B0FF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 9cf817155781d5bb26f3e30b3e762483c3521a0867f73de98bf62aef4239d9d0
MD5 bd77526aa63c1032c8a8e782ff4ee00d
SHA1 d3e728aa502210a5a8386452ba42dfb48613858a
SHA512 c6a14cba5e36a5bd92aba8fe1747ff7da761e4f08922e87eb92b6fa90514b38fbd7c77034bcb0ad1748a99fa69f84a53dc6dac919588600b4c72da639f55e7c1
SSDEEP 12288:olPz5L1L1SJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:qzjLLW8StHWxkS9VF0Og+qYl8hY
TLSH
T144F4026726A230F9C12642398DA24E42F77578721B71CF6F57A006362F33795AD3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 1239ce52e73a9fd3a92a0fb5239903bbf97e132e68d3d5112f1ead1746857401
MD5 e959579063b9f36b15ca5e36b2b5d5e3
SHA1 f091d3b3fdade6c67f1551005b7dbc6a42778d1c
SHA512 3b0cf737c5625eb42a4149d976323224c205e98a160ddbfd766b724492e04924754aacebbbfaf49735ba39d1b76844d4a9889af7cc8a4410497c3638b2059da1
SSDEEP 24576:sT6aLg3z0zWnLW8StHWxkS9VF0Og+qYl8hY:sThLgjfLW8SXq0OqYW
TLSH
T1B21501A4736118F8DC67463ECD668D52D6B27C6A0BB0CA1F03A436265F333616C2DF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 b47620d0d0bc1847782c8e4215d57401b3c88d49108cb90e61220ef35ce12578
MD5 acb6915d2e6d6def508e96d0d2c6ac9c
SHA1 dd8762a194e0adc0479273d3e676a50e9cae0497
SHA512 12c3af36aa082894aa4a901260a2e4ce00fc3baa0e0f55c49a72c6b54a03d03855d9ac58311485c7387914b07c9c70fcb372c7884ff34fb42021c3e27596a512
SSDEEP 24576:y3adQCHKy7BjZLW8StHWxkS9VF0Og+qYl8hY:UadQCHKylNLW8SXq0OqYW
TLSH
T15A35CF90B3E414E8F1B79A358D768512DA767C9A1B71CE8F03A4251A1F33BD19D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 9e3eda184ac361a8040ea49a0e7865cc928021ab6ccc0ab347787e49f1bd6a30
MD5 27f0b83c13f39c0b841ed29c1677375f
SHA1 772e70181f4bfab3199df4d0865e2fe30dfdf9b2
SHA512 d33b82e69fa2e8c3b765f398584c9f1b3b5a882427f5b1cefa50d3b49f9336efc1d7ffce6e753bfa369aeb33fbdc5fdb988537eb3ad453c73bf3df6860c55336
SSDEEP 12288:znSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:zJLW8StHWxkS9VF0Og+qYl8hY
TLSH
T11AD423B50963906DC6190E7A7E77CEE3857819E63BA3CA3FAA5005016E71B0EF068DD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 8ffc927534b1fe4319398c9fe14d549e2f17d5b85cf568a816bdbbcb3cdbe0eb
MD5 8138f9be9e8956f7ecead7b01e281545
SHA1 4a89931c7d7b5cae69f6d44f6137712b74c1cbee
SHA512 b0da044f7f1949cd082cf451bef786c1ae11081ab91f257f06754775efb6872d27d743e3ee129f6f290b4b3895a83554962dfbbfed4c563908e48361cd09b169
SSDEEP 12288:vxSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:vTLW8StHWxkS9VF0Og+qYl8hY
TLSH
T1E8D423B50D6391ADC6190A7A7E7ACED385781DE62BA3CB2F9A5009116E31B0FF064C91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 153d626260b17b5ce0b4b984228901504efe597227251e77193c9986d89effe5
MD5 ea648b3da1ac831259cc56f8602bd400
SHA1 61a3e74206a69d716f35cef454040dc2362e2d70
SHA512 43f36e86834048ec2a7b3063c06735cce8a5ffe41df0cc7b4ff2abdb021130fcff1f466ebbcfedd915b3dc365fd1a1d96aa35224eed1b9aac3d1916133795002
SSDEEP 12288:e1SJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:eHLW8StHWxkS9VF0Og+qYl8hY
TLSH
T1FED423B509739169C6150A7AAE76CEE385781DE63BE3CB2F9A5049017E31B0FB068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 f4ead5d86b4caa0553bcd7ec63e557138c95ba6eb0b98aa84ded5c542eba5b95
MD5 27b862796479776fd8aa1362f3ff3eed
SHA1 8d82e289d56dd8cb6ebb026ef42b4cf7774d5bf6
SHA512 de63030476b7aa94161139267a58217c2b5e00c04b609241ec87562cc94f602cce39cbbd93688cb51feed8309cd045c234e6220f2e826d5a3af8f07183406946
SSDEEP 12288:5cSJGnKu0WLskUP8vDufFHWxJWLScx4VF03eg+fL1oYleph6H6ZQjU:5kLW8StHWxkS9VF0Og+qYl8hY
TLSH
T113D423B5096391A9C6150A7E6E76CEE385781DE63BE3CB2FAA5045017E31B0FF068CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 b74aa0ad1917ee0e9bde159bd935eded2cb00c9c85a696aaa0230a2aa0b876b2
MD5 6120ecfa97ae22559bb17bb412eb0840
SHA1 0ba44549a0631fbf74c9f27d30577fb231cad1f3
SHA512 2d5eb68a3da31f31ff0288b49834e365f815b4d92043d93996fe4cbb774209a24fa9190f2436d5674b865b6b2debf6e0212ba429769e61ff250d8eb11092bc32
SSDEEP 12288:QTsfao+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:fa3JiebITEUWbocDu3
TLSH
T16DF40109D2A842E8C4DE6279C7464602F3737C2583F5DB8B56C8F53E0FB62949DEA643
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c0c92fe2c6576e1c251dc5ad5f05837a3f3256470cbe60617903ef6383c041b8
MD5 13e11ce9b6320c4e21476a54df2d0659
SHA1 83b90632166899d6fe11fb746aad4267f6e3cdbc
SHA512 c64c1b9421bc26bff9af86d7fd9feef4197cb6db42bbef23b78bf8fc71a4945cf9114bf975b591a7e4177b03fb98c9997a2f89d2785a469012ef4348ac2cc0eb
SSDEEP 12288:sH7ylo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:GY3JiebITEUWbocDu3
TLSH
T192D42305837E872ADDD76AB8834B403360A4B6598B3CCF5BA54D137B41E67CCAD7B142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4217cef9795ade32c8c6c939f2217d2712d6e941a7fc363e5396a4f71fffd380
MD5 2926dae868a90d4274e918abc27f5d92
SHA1 ed4ff984164742207f3192396f61ec91aa9e660c
SHA512 2e00fb1c94271cb63f9288fff0b5fbce6a1a20b6b989cd20ce979d54cfa3bdf69c5c06e81e66b3e7a3c5d99b56593b89bf88ff9d6e9ba57e638ed39982ccb0e5
SSDEEP 24576:ggb6bmBIi49WNNFpg1rSvFv7bYp3JiebITEUWbocDu3:ggb4mBIBhGFCEr1Wbjq
TLSH
T1AA659E1E22EC02F5E0F6E2B8DDAA4417D6B278160731D6DF1151423D2F2BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 91a5ec99b8430b92dbe73563fbb2c29bd86c0f0f4812dcb5191c8218dfe4a995
MD5 7330c3b3f9a53932adcac213b7b07798
SHA1 6ce84687ffda37a02eed89a80e639098d8a97f0c
SHA512 9d939394d1227725ee417e7d9a71b7cf2295f0a6fb996bc6c8ed8f0be438ff941aae824b2f35e1b4d37e40f2f487d613592a458802fbedf320306669b3b61008
SSDEEP 12288:aBGp8o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:SG63JiebITEUWbocDu3
TLSH
T18DE4121D62BE52A9C9FB967CC7564023B0F0715047389FEF49CD523A87DA6E8763AC80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 1e3d5a6ab8973d83fef597893e33d0df40fe3cd37e3e88c972894699e4d5df44
MD5 09fd0b3d6b065152b28f97077b9a2dfd
SHA1 ced5e70f7ae4af2f6a1ce2c214d8225831750767
SHA512 596faf7c23d0cabc9af92949b000c516242f22a1ab70f424b71909869d314ef8918f2379a104a71c957adba8d4d135d588dcca76d3a0f1ba8676d508d18b1fd5
SSDEEP 12288:+J0o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:+S3JiebITEUWbocDu3
TLSH
T104D42309527EC76ACEC7AABDC3474023A0D0B649877C9FDB558D223B42DB6DCA53B091
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4147af74fea52d04e947401c0b165363a6b0f8833c4b67231ff8452f2a310215
MD5 738c99bec5d3de165dfe913dc16373bc
SHA1 1a64758ebe5989d9e711c8360002a8ac47c7f04d
SHA512 332526927da22a5a8ac8b5b6d0de0da1ef3a6af2839932ae43384f4bf17eabba7613a40efe472e164eb2fcc9e262c53a45bc44a492d62a22b64f6e74489c1de7
SSDEEP 24576:tWj8m8NaJqH1Mzria7/me3JiebITEUWbocDu3:kIRN2qVra7/9Er1Wbjq
TLSH
T14235F11567E502F1D4BBD1388A864663F6B1B4150374EFDF06AC8B660F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 6cf7f7d063e106b87cde2def5e552c211ff0770556df7abd3b02c8854bc76d4d
MD5 83a8622103febb22b311743b9df5e82b
SHA1 a629fac0cbf97c81a0f7f603b9bac149d3b43a4d
SHA512 b33053de7e6726c0e767e78b141e89797166f94c3260ad3e9245741aef1b90785998fd633436620a32ed0653a18e788216ea94b98b590b27ca93661d79b3b5f6
SSDEEP 12288:lHvUrBFrEjwaQtLo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:lPUr+NQ13JiebITEUWbocDu3
TLSH
T1AD05F11F62AD18E5E6B6E17DC6868619F371B4620321D7CF02D4817E4B67AD8BC3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 ac32080d38d59ec6b2f6686ca19fdb81ffc5acbedef47479d30f561d7d62af7f
MD5 498f3a2bd12b46f88e820b857561028e
SHA1 5c7123848421c13c2d5feb7e2c198ab72040b38a
SHA512 ba6a06e59ded9256a6685a988249a8f32c9719a88db64eaadac2f7f58a27de45be6e3c8e00ddea6d09b7bbbb8214a0cb7923ce0e91f26431c370f807df7349bb
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGEr1Wbjq:NG05lO43bPEc
TLSH
T1B4D5CF6A62EC01F9D1BBD17CDAC6460BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 ab80a6c9cfc05d5e25cff3aa04870fd518f4b221f6c3dc52d040016de14c69c7
MD5 ee595dec291bbf3ed851849c5eeccb37
SHA1 fc4cd208792266f99802548bed88dced3b127197
SHA512 b61a27ee1418e2fa8ee956f159a73f301a1921863468517d013b3f67d86d24653bfbfe8aa5378d05532b1edecbcae52065d501ea87aa743e9c67b508d0948a91
SSDEEP 24576:iEa5POZ3dpbWVM50JicR2hG0lasx2+47eidnw3JiebITEUWbocDu3:Za5POZ3wJt2pasx2+myEr1Wbjq
TLSH
T1EA65BF5EA6FC01D5D5B9D17CC683461AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 25382445e5fe1d7b7ef3b662601713372290ca468af31bd046ae2065c3a1f6c3
MD5 dcf49c5846c4b561c0dcbd5efaf37e1d
SHA1 0f7a6dcebd8b0c305f2458c7561818a56ebc57fa
SHA512 0e29fceab7b7ef546cce31ddc29d80a740cc778ceb0a7ce2d4816ffc62d42e2d7fcec0dc30e993c99a96fa9ffe2f6750eedd7db938c83b648b067e619eef24b9
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7Fku3JiebITEUWbocDu3:cNc/zEOVHFpEr1Wbjq
TLSH
T195858C1623E901E4E5FBE1BE89679546FAB1786513348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 bcf12df87c0dd62284c31000df9e58f6ebc1fedda10223a1a0707b3c04e01d60
MD5 79b6d14e436a8c9948bd1b8ef90170c7
SHA1 ce10912a29d271ae31c62b5fcdde0f7def12e041
SHA512 d09c3ef29c97a1eae54c1429cdb82b04376f2092efd67fa497b607d71ec7a12562bbe3c40946796af0101bb068a8599a02c818b375d251382b94a93c719f5f67
SSDEEP 12288:GOHPJnJP6szeCs6Rl28dD3o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27J:rJnJPbzB4Sr3JiebITEUWbocDu3
TLSH
T1EC15E02DD2A810E8D4F7C2B4821A1656FE71386C2F256EC719B8D5353F52FE0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 4bddb6c2455da99b299da830495c39766f45fba66f637f5eb2e2cc9ab4ce6836
MD5 76f3e131b5d2e237347ac743826f7588
SHA1 fba73a57dfed5876a9b2cc6a4c21b1f7f4e9b92b
SHA512 e4e8d8eb92ddc488c76bbeff44ef61e2d1e9ed2c327fbf46352cb8fa8f404debd86c4e7c1bbd4edcec1965d70305621a7f970d1bf018d2d5e8562a4e7ed04fb4
SSDEEP 24576:7CLHGL0MoeVtFumTijCmlKQWDkz3JiebITEUWbocDu3:7CLHGeeV5ijCmlDWDkzEr1Wbjq
TLSH
T13FA56B05E7EB4184E8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32FD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 583eefb28b7f99e8d10e95e9e08f382a4fcd41512ed9016baeb123fbc940560a
MD5 3596bb9df9ddbc79bdbebdaa5cd02356
SHA1 81e7567aeeee514f7f4d18f4ed42f8658110ba0d
SHA512 85e028d54aa2cabf92b05a057cd16bc482ec4a1b3b8075080b3edf997d502c91ed64d9d0ccfc9d8d65290793f48ded73a651c0f02dba26e0e0a6991323c9b42b
SSDEEP 12288:N1Hck6j5ZI7zo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:N6DIv3JiebITEUWbocDu3
TLSH
T1E505F10D237E01BAD1EBD07DC7830112E1B1B1A587265EDF4A98857E4AE3EDCB93DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 fcc13c1459e332b98a7d8fe7c03badde6b70d38b178297071bbf9657138fcf78
MD5 d35a72836867261e5ebdb67d3df26578
SHA1 faef7d80414f1d60a041695648b822f3fc4739d3
SHA512 b661b7bce9658e91b35d97121eedd6110536ed785e22c3b62cfbe498f731558e037bcb5d0e1dcaee09a5da879bd95f161a21b4fe32931a97a50fcceb311eea1d
SSDEEP 12288:NG6kym5o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:0tyI3JiebITEUWbocDu3
TLSH
T140F4120453AC81A9DAFA5678C76341629A70BC108B348FDF55C8A73F0BB77D8B835B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 f0e46545f0cd60fab1559d8f361cca7424db6fd413b36104063610b05a783891
MD5 cb9a79c79522b4abeb20d64314728886
SHA1 225f43281664bd9e365f493562feb13de7a0ee6b
SHA512 b209a8842d616f6dbe8affea858e1f2fce977d7b60476379f048227bdea3afffe4b3cf7c251acb0c97f3cf8a51dfa99d77e509dd85a504b5f7d5806b452cb9e2
SSDEEP 12288:7DQnuo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:nx3JiebITEUWbocDu3
TLSH
T14ED42309527E836ACDC7AABC834B412390A0B159473D9FEF59CD563B43DB3DCA53A841
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 720c2d07a5dc083a86b90bbd578ae4cb800f2ef540280fbbf627567844fdd438
MD5 ed53c79b001d2857a0192d9399087e6e
SHA1 2b99117f6467f8d37439bd78040e233712f77725
SHA512 d10f6ee44b978dbe919950e763fd906312b456b62e99dd9c97318b77aaef8dc5bbc88d43d8d11fe0db2e049425080c9056f996411565de6c844a13d3929553e7
SSDEEP 12288:hBgIuZyFDK3tT5Tr7aVLIH9lH3c54o+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwDz:hBgILoTfaidZT3JiebITEUWbocDu3
TLSH
T1B1559D1DA3EA05CAE2B2D679D9621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 cdaee6d3facaea9a384c686b1ca7eb6069a13f498f7190b2e1029eb79a0f1157
MD5 0310c265afbf057495d2b3ac4dcf6ded
SHA1 f2aa88c99d72830078c891a5273fb875d9481c8a
SHA512 3cc5fb882be4acb6fd7e10466c7f4d1bc7b37460d96ed75d09774cf44ddb1ffdc79fffd9922e51e61c55304fe0c7850ad601f00021a73f8adb435ecc7f85af08
SSDEEP 12288:DpJcm8CN3oo+Wt+4fx0NbKwcLqAFGUEmJWb8vcJGZcwD60F4r27XZ30+v:DrcmR43JiebITEUWbocDu3
TLSH
T10305F10EB27E00A6D1F7D27CCA464116E2B3703053226BDF0299877E4A97AED7D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 abce2418bafc48bf664cc2d320bc83311a400e8e6e51182387b2048eee7e5999
MD5 1b418fb14e68e39aef58e64b41451528
SHA1 cebafe7f2021157c970cbfb33311a4e5acd9c0cf
SHA512 e5f0bd2ee01d792f9451703e38469dea5aef790742709a6f5891bbc78464a8181430a4ae6772631ffb5d346c14bc9f63dc7a66b945353669ce2d826968f23d0d
SSDEEP 49152:yDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3pEr1Wbjq:z3Upow8sBcEc
TLSH
T126A58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/908-355-0x00007FF62D850000-0x00007FF62DADB000-memory.dmp

Download

memory/908-350-0x000002320C050000-0x000002320C0B6000-memory.dmp

Download

memory/908-349-0x000002320C050000-0x000002320C0B6000-memory.dmp

Download

memory/908-446-0x00007FF62D850000-0x00007FF62DADB000-memory.dmp

Download

memory/1492-340-0x00000192E0750000-0x00000192E07B6000-memory.dmp

Download

memory/1492-339-0x00007FF78FA00000-0x00007FF78FD21000-memory.dmp

Download

memory/1492-345-0x00000192E0750000-0x00000192E07B6000-memory.dmp

Download

memory/1492-341-0x00000192E0750000-0x00000192E07B6000-memory.dmp

Download

memory/1492-392-0x00007FF78FA00000-0x00007FF78FD21000-memory.dmp

Download

memory/1716-369-0x00007FF7B7970000-0x00007FF7B7E77000-memory.dmp

Download

memory/1716-371-0x000001615FB00000-0x000001615FB66000-memory.dmp

Download

memory/1716-370-0x000001615FB00000-0x000001615FB66000-memory.dmp

Download

memory/2144-393-0x0000020C684F0000-0x0000020C68556000-memory.dmp

Download

memory/2144-391-0x0000020C684F0000-0x0000020C68556000-memory.dmp

Download

memory/2144-394-0x00007FF611500000-0x00007FF61183F000-memory.dmp

Download

memory/2160-358-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2160-272-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2160-278-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/2160-273-0x0000000000920000-0x0000000000989000-memory.dmp

Download

memory/2332-332-0x000001DE87420000-0x000001DE87486000-memory.dmp

Download

memory/2332-331-0x000001DE87420000-0x000001DE87486000-memory.dmp

Download

memory/2332-330-0x00007FF6CFDF0000-0x00007FF6CFF85000-memory.dmp

Download

memory/2332-390-0x00007FF6CFDF0000-0x00007FF6CFF85000-memory.dmp

Download

memory/2668-29-0x0000023624320000-0x0000023624386000-memory.dmp

Download

memory/2668-28-0x0000023624130000-0x0000023624250000-memory.dmp

Download

memory/2668-31-0x0000023624320000-0x0000023624386000-memory.dmp

Download

memory/2668-30-0x0000023624320000-0x0000023624386000-memory.dmp

Download

memory/3212-301-0x0000019C3B350000-0x0000019C3B3B6000-memory.dmp

Download

memory/3212-445-0x00007FF6DF2B0000-0x00007FF6DF6C7000-memory.dmp

Download

memory/3212-375-0x00007FF6DF2B0000-0x00007FF6DF6C7000-memory.dmp

Download

memory/3212-443-0x0000019C3B350000-0x0000019C3B3B6000-memory.dmp

Download

memory/3212-302-0x0000019C3B350000-0x0000019C3B3B6000-memory.dmp

Download

memory/3212-303-0x00007FF6DF2B0000-0x00007FF6DF6C7000-memory.dmp

Download

memory/3320-15-0x00007FF7DD150000-0x00007FF7DD273000-memory.dmp

Download

memory/3320-18-0x00000245B2CF0000-0x00000245B2D56000-memory.dmp

Download

memory/3320-16-0x00000245B2CF0000-0x00000245B2D56000-memory.dmp

Download

memory/3320-43-0x00007FF7DD150000-0x00007FF7DD273000-memory.dmp

Download

memory/3320-17-0x00000245B2CF0000-0x00000245B2D56000-memory.dmp

Download

memory/3340-235-0x0000027DAEDC0000-0x0000027DAEE26000-memory.dmp

Download

memory/3340-236-0x0000027DAEDC0000-0x0000027DAEE26000-memory.dmp

Download

memory/3340-319-0x00007FF609CF0000-0x00007FF609DB9000-memory.dmp

Download

memory/3340-234-0x00007FF609CF0000-0x00007FF609DB9000-memory.dmp

Download

memory/3784-285-0x00007FF6C0CA0000-0x00007FF6C13E4000-memory.dmp

Download

memory/3784-286-0x000002BAFE060000-0x000002BAFE0C6000-memory.dmp

Download

memory/3784-284-0x000002BAFE060000-0x000002BAFE0C6000-memory.dmp

Download

memory/3784-365-0x00007FF6C0CA0000-0x00007FF6C13E4000-memory.dmp

Download

memory/3960-292-0x00007FF77B810000-0x00007FF77B8BE000-memory.dmp

Download

memory/3960-293-0x000001F6A48D0000-0x000001F6A4936000-memory.dmp

Download

memory/3960-368-0x00007FF77B810000-0x00007FF77B8BE000-memory.dmp

Download

memory/3960-294-0x000001F6A48D0000-0x000001F6A4936000-memory.dmp

Download

memory/4300-245-0x0000020828AC0000-0x0000020828B26000-memory.dmp

Download

memory/4300-329-0x00007FF609CF0000-0x00007FF609DB9000-memory.dmp

Download

memory/4300-244-0x0000020828AC0000-0x0000020828B26000-memory.dmp

Download

memory/4300-242-0x00007FF609CF0000-0x00007FF609DB9000-memory.dmp

Download

memory/4372-58-0x000001FFED810000-0x000001FFED930000-memory.dmp

Download

memory/4372-59-0x000001FFEDA70000-0x000001FFEDAD6000-memory.dmp

Download

memory/4372-60-0x000001FFEDA70000-0x000001FFEDAD6000-memory.dmp

Download

memory/4420-447-0x00007FF6170E0000-0x00007FF6175B1000-memory.dmp

Download

memory/4420-361-0x0000023C762A0000-0x0000023C76306000-memory.dmp

Download

memory/4420-360-0x00007FF6170E0000-0x00007FF6175B1000-memory.dmp

Download

memory/4420-359-0x0000023C762A0000-0x0000023C76306000-memory.dmp

Download

memory/4624-354-0x00007FF62AA70000-0x00007FF62ABBA000-memory.dmp

Download

memory/4624-263-0x00007FF62AA70000-0x00007FF62ABBA000-memory.dmp

Download

memory/4624-266-0x0000026694EF0000-0x0000026694F56000-memory.dmp

Download

memory/4624-265-0x0000026694EF0000-0x0000026694F56000-memory.dmp

Download

memory/4728-38-0x000001BEC1830000-0x000001BEC1896000-memory.dmp

Download

memory/4728-39-0x000001BEC1830000-0x000001BEC1896000-memory.dmp

Download

memory/4728-37-0x000001BEC15F0000-0x000001BEC1710000-memory.dmp

Download

memory/5176-252-0x000001767E0C0000-0x000001767E126000-memory.dmp

Download

memory/5176-253-0x000001767E0C0000-0x000001767E126000-memory.dmp

Download

memory/5176-251-0x00007FF724870000-0x00007FF72498A000-memory.dmp

Download

memory/5176-338-0x00007FF724870000-0x00007FF72498A000-memory.dmp

Download

memory/5304-311-0x00007FF66E9E0000-0x00007FF66EA94000-memory.dmp

Download

memory/5304-313-0x000001E0E3AE0000-0x000001E0E3B46000-memory.dmp

Download

memory/5304-379-0x00007FF66E9E0000-0x00007FF66EA94000-memory.dmp

Download

memory/5304-312-0x000001E0E3AE0000-0x000001E0E3B46000-memory.dmp

Download

memory/5744-46-0x00007FF7EF790000-0x00007FF7EF8F8000-memory.dmp

Download

memory/5744-47-0x00000137F90A0000-0x00000137F9106000-memory.dmp

Download

memory/5744-48-0x00000137F90A0000-0x00000137F9106000-memory.dmp

Download

memory/5744-53-0x00000137F90A0000-0x00000137F9106000-memory.dmp

Download

memory/5744-55-0x00007FF7EF790000-0x00007FF7EF8F8000-memory.dmp

Download

memory/5824-7-0x0000000002180000-0x00000000021E9000-memory.dmp

Download

memory/5824-0-0x0000000001EE0000-0x0000000002046000-memory.dmp

Download

memory/5824-6-0x0000000002180000-0x00000000021E9000-memory.dmp

Download

memory/5824-1-0x0000000002180000-0x00000000021E9000-memory.dmp

Download

memory/5920-380-0x00007FF7183F0000-0x00007FF71851F000-memory.dmp

Download

memory/5920-381-0x000002AFEB750000-0x000002AFEB7B6000-memory.dmp

Download

memory/5920-382-0x000002AFEB750000-0x000002AFEB7B6000-memory.dmp

Download

memory/6108-321-0x00007FF7B7790000-0x00007FF7B7A33000-memory.dmp

Download

memory/6108-323-0x000001B22F4B0000-0x000001B22F516000-memory.dmp

Download

memory/6108-322-0x000001B22F4B0000-0x000001B22F516000-memory.dmp

Download

memory/6108-387-0x00007FF7B7790000-0x00007FF7B7A33000-memory.dmp

Download