f735cc3a67e28e3e4235357f95ff2f9b536994cf0879a767cc1bd92fc08e6148

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260816-ev6lfacr21
SHA256 f735cc3a67e28e3e4235357f95ff2f9b536994cf0879a767cc1bd92fc08e6148
MD5 79fe8a90aae8beef0682ebb7ba508465
SHA1 dfbb880f17bfc778a583eb2186e4ade1c82a3136
SHA512 4fd8587227a795d3a6366f58c2a1bd976eabf04aac5ea7c2203fcd9dfc173c29edbfa15b7d2c03ab0ca92366fa12f937a62f03956a009ee87b604930b007cb4c
SSDEEP 49152:wDD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL49Q0rO4H+CfvJZY:ED0FZs/U73MQ+fCi6AeeA8uxV1XEtntP
TLSH
T189B5BF33F594907AC93313314E9D636C76A9BB710F36428722E55F2D2EB05C36A297A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5552	alg.exe
2636	GameInputSvc.exe
3004	GameInputSvc.exe
5664	elevation_service.exe
1800	elevation_service.exe
4288	maintenanceservice.exe
6000	msdtc.exe
4276	OSE.EXE
5176	PerceptionSimulationService.exe
3244	perfhost.exe
6036	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7d78fd4ae05f6396.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	GameInputSvc.exe
3004	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	2636	GameInputSvc.exe
Token: SeBackupPrivilege	6036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6036	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6036	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6036	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5552	alg.exe
Token: SeDebugPrivilege	5552	alg.exe
Token: SeDebugPrivilege	2636	GameInputSvc.exe
Token: SeDebugPrivilege	2636	GameInputSvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
1032	2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 3004	2636	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_79fe8a90aae8beef0682ebb7ba508465_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6000

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5176

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3244

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 142d35817ad696172905aa99c37331386ee8fca6a5c6e947cd78b8747da1ca34
MD5 ecd0edcb423ad32da3dedcc0a0681f3d
SHA1 c7278bf0580612ca7af59b3a84f245505d498b23
SHA512 edfc945d2c9dae98dafbb361e01bd589996f515a901f6ec8e5364c614bac19cd74d7c12dbeb7c907d97cabfb61243b5e13ceef3beb2d203e94b29ce8124fd45f
SSDEEP 49152:fb+6Q2BuPkFKRrdE6oh7stBhuXjfS4LWxnDQ0rO4H+CfvJZY:dQq6gjB0tntvn
TLSH
T122D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 aaac5968f3a3e740f02ccfbb97b455fbfd9eae984d3a30174f96160406c965f0
MD5 65e05ebc8bb60fee70e0b0189db6be4a
SHA1 0e66cafdd5aa71492cd7ea2b5bdbe7ce4b3bcf7a
SHA512 3c38ad36336b83dcfd5b5420875375f024a870e6d3fbcde02530ca91c5c608fa640822d9a71c3cab61d6f27393e81d6e503e7ed190268466e03c6c818152944c
SSDEEP 24576:jXYyc/czA6QJGfzOO1HTXaCfL1Ru0OYXJtVIFm:q/cTQ0rO4H+CfvJZY
TLSH
T1D5050124B7D509FDEC678179CCA28502EA33785647A0EB9F03E48A654F337885E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 80f6d5ad71c6097413e3d9860205f89653c45008f3fa4b94dc010d7dabbfa962
MD5 3c8b16ddc67075ad59cb2f438e9633ae
SHA1 435d1da75f1c2a9b45b32559ca29204299b0ae2b
SHA512 f4253d9b89dfa868e1b630fa6567ad0e84583cd940e7e84af63d807f281aeed5693831bf668aa25a4caee49b1fcd726dd893f48a0e3e61ec026204c26f8d7db6
SSDEEP 24576:B0SeTz005/yOrM2QJGfzOO1HTXaCfL1Ru0OYXJtVIFm:B+z00hPnQ0rO4H+CfvJZY
TLSH
T16C459E16F5788335D073C0B9C5D2A68AED7130865B308ACB4296C77C6F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f130de6b8778d606d01fc8821313d7c4012f3bb787d04bfa6434b09308a490a8
MD5 05364a14f86699447a18254825d794cd
SHA1 8317fea319d2f0e35817413cdaa0dd3012a508ca
SHA512 6b573eb1c09c5759a4cfca352c7f0af5e932fd0753ef5781325991c272263004021fb0a91d6549302f0a885d13078360cb66d543528b5ef9a0db3c7b4af05b9a
SSDEEP 24576:eus/ezSC6vUyD/aqgrvW/6q8wyugQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:a/ezSC6vUzPvuHjyfQ0rO4H+CfvJZY
TLSH
T14B756D15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 e2e29b6567b9bf1f62c56566a0c92537ea59c4081630787d17f83b713755f166
MD5 e1aa71fb504e5b8b674fe685d3bd178f
SHA1 c0a2d392cfbb8973e172d92e3f9cafd1cd2c72f6
SHA512 081d94a64f7a5ece90d3ccc51e6a804d1865cbfca6934417a4d4c4e5192a8e607b37635de4ca03dd571e6fbc9e09238a1fbf42ef1d7afbb816cbff42de593f5a
SSDEEP 24576:9AbkP2Td3v/l+diQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:9AlTd3Xl+IQ0rO4H+CfvJZY
TLSH
T16055AE66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D736731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 cef6506a16e5c4f950d848389dcc65dd352e1e5d10f474299dfa7b4cd2bfbf79
MD5 20a5cec72d05f2139bce2df745cc763a
SHA1 a2a652d07073e3702d07951090d862545bef4eae
SHA512 477ba3c59d0dc399ea62201768d7d2fe35e2fdb2e14e765ffc6696a4b81a81ec070a89e9c12fe257db37d1b7dde97ee545f979604d1965928040343963723360
SSDEEP 12288:AXdZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:AXTQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1BFD42342DCCE369FF1CA8572A89646CB48642F7FC7C92C2C11A65F89CFB5A41F70461A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 56f0f827bc1fad5d294cdbcd78d18ab707ac32001e581fc8dd0f12f8c2f3baf0
MD5 7ec074137241a64a4c87f5e558814be6
SHA1 3c28a1b5addfc986fd37d93ad57d74165a90b718
SHA512 0ff31ceaa9ede9a4844f112be2ce3a80fd5424e8dfb1add5efaa70f93d638766e1914719f48e561b628b8133301fa8477c748227e0db28f4a7609573d6a795a2
SSDEEP 24576:RJIUAQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:RJIUAQ0rO4H+CfvJZY
TLSH
T17115DF3BEE28FCD2C27A8DB95A918640D77278314B62A3CBD175830ECE235D15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 e582bc0e8547da6170156cb26544db735d6e8f3e72d8994629fa049ea7b8595d
MD5 55fdfb8a6f35dee11ddca1d88e3fd191
SHA1 650ef8266b40726c3b64a838728738c694bdcd76
SHA512 64aafe36e3c55c5b5fe4e92839e2cc554f0e90d4d77692d01e5c618c3f951ee59391bd83c5b3cbe0d31264fda607a050b13ba0262c9ac4b10092e39845d946a8
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THx:VQvGAdlCEL8c/9RNw5Cftntvn
TLSH
T1EC367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 c4b0388a8316e4b1bf8cfab9f1ab29ae2566a4432e84cd86bd7e798b04fde730
MD5 c90640f6fd41daa83045c456d420bdf3
SHA1 45ef43095b0866fca6129491a45fad30812d4070
SHA512 648acc58cb5a2123b71db0466223ab35b3330a290d7297f442d81459824c5a2c7bf77e46d26bf68c16f7181242261d3b0da03feab18104bb6ef026596319a193
SSDEEP 24576:TmewsAjePQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:qljePQ0rO4H+CfvJZY
TLSH
T12C15E031FE75E036D2BF0DB21B26C716187C7A214B9119C3E3E88E8D5A702C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5480f72f6ae8c954d4d74cab139d1b39fe47d6de97372aca0d36d97b9c458ca6
MD5 faf9e3596170f5c9ca46a96d20fcdbe5
SHA1 91d4409f0f96c29546604f0e6a93a8c291a23553
SHA512 fb9249e264b6ac3e10eeb1feb42d9da6c86d31a0023bf0f265c29c223e0f7801eaae6e25ace21ea593787cf0f646d05e3a687db88fe02f84583cf44039dbd822
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHntnx:HUEtQevvqc2W1cpV2XF32ntn
TLSH
T174474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6fa0ce4d60fb9e45e82170a59abd0a17419e3583472707e5164e4225d58f9320
MD5 0f416badce05bb30a26e5b9161220097
SHA1 0d33d03f5686d81154b40100aa9f929d3693a512
SHA512 d24b12084ebc6f10bc27a6f0eb0a547fbc8e059309f2adbe2b8d0b27dae7bad46a864ef13db5b422c75b8033ea0fa07a1f21f72c62c3a312fa50f49a367bbc5b
SSDEEP 49152:ehbRquA/m2yL5zMfFiV+XenmE3/zwQ0rO4H+CfvJZY:Koq1Vjnmrtntvn
TLSH
T15BD58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8797cabfc7ae7a03936a0c90b5d28c0e726a3e74666514624a03922e1adf9a83
MD5 216e7b9dce2f07ee0a9fb9562ddc81c8
SHA1 a10f133ed7c1b32f7a8b53d2ea552a6b3be999b3
SHA512 31f56aea2ca23543eefc40b722096610b5f44c8c9e634f2947f0133ccf0ceab4a05acd4eab86e0842a62ac6f10dbb68d78341ee3d9bb2ee02e08d26863f317a0
SSDEEP 24576:RAhGLvUFoiwtA5l7S53NQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:RAMgFoiq5dQ0rO4H+CfvJZY
TLSH
T112459D81EBF955D4F5B39A7899B68171EA76BCAA5E31D20F2150C21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 5a91f9a8f20e3e9a206157009fca3b0c2b6b8fb1f753e38c1ce2446925745d5a
MD5 e81f1e97393055555f7da4088cebc7a4
SHA1 4825467062cbcf6dcf354659d722626c3e9978de
SHA512 d1cc7c6af32abed0160c855fb86f42ecf8856bb815b48eaf5b38cfbfe737af05f760d6ec910fc11a1ca2e3f70891933825a15d50c1c09bb0cd7417deb9f59431
SSDEEP 24576:QwuuOWQQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:QwVO/Q0rO4H+CfvJZY
TLSH
T16E05F14676E81CFDE5A782398597C136E7B2B8162A619B1F1360C74B5F33311BE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 e48e51c0555f6f1deab11d6aa67ac57b379bbb01de7be6a54817c38ec26adafa
MD5 8c90105433a8b103305303678273e375
SHA1 4b98ece6d50f7c6081d65a90ac0436858eb7c0cd
SHA512 b8b381e0c5addad1efd808f7ac972d2f6b7c512e5b38840d9e52aecba93628ee1e129f2f0fc595977d0252f9dbe8412f6777a85f67187e35edc27dbf935f6e38
SSDEEP 12288:MSm1IoGZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:tmuVQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T177E4128275D831FEF0978279C8E2464AD771386B57B603CF126547895F73AC2AE38722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 537e9d73fee13610b5689396f70571431dff02be4a633fc6455b50cf0df27d8d
MD5 c557aa580ea6949de3aac6467c3ffd96
SHA1 805f906d323b3bec404e476d97e0de35af2a14b1
SHA512 ac9d6762314b43332b41b4e795cabc34a56ab5e6d36c14ea74737665407329a0c75f8d748f091c82f7e2bcbf41f87e3f3392dba963d31e9df2a0fb0be2fb7ac1
SSDEEP 49152:Iji770WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U/:ZQRQyi36YOcP8Lvw2gAf+PN3gtntvn
TLSH
T10E667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 826f44647daf26e0632d63ac4de3f03189f9a7f5d534e3e88c749cd4e1c0d525
MD5 94d39ebd467f80ea7a1be50ca331426d
SHA1 067f3cfd084192c224e7dc1fa2ad7dc444b2ecb5
SHA512 a5c9df62c2e3b6764333d440f291feac8b428a6eeb55d9912f11c2b7e15154e309b4797f48b28aca371d5bf9a12716376a74e8962b2010d2247e2254a67bd57d
SSDEEP 49152:Iji770WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U9:ZQRQyi36YOcP8Lvw2gAf+PN3Gtntvn
TLSH
T183667C13F3A501E8E05ED974CF3956229B357C4B8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7994d03536b84574e6e5f5745a3247fc9b7f24497d2a6963c64acdb8b09d3847
MD5 fea5f7c4d572ce4d07aa037c3fb348e2
SHA1 20f1d14733fdc2a823e833c4d422153b282b169c
SHA512 f4f88e8126692db7f5a7f717ae3d5d8e0151dba984291cea8e8ab1d58a9d7dd75de3e767e93606be3f88722493aa1ee110d790dfceb7b3fb5a14d03bb1b23019
SSDEEP 49152:e68Qg55nhMeWu7PNU3/eQ0rO4H+CfvJZY:sthbRc/etntvn
TLSH
T12CB55933B2F600A9D04DD1769F4A872296D17C758FE1E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4e253263d1c22c5ac4f703fd71333c40b0e4155adeea195de231ca0929105ceb
MD5 6360968b3bf56cb8e4164cb1905f0416
SHA1 4cb7bf65c12da7fe6e843743c0a7298e64e84f25
SHA512 1910baf76404384bd78844ea70484b3c8a15b7c0b742a8e3c877f68503688a0bcc2772637d23db427e8827cd5d1c1d9d07ef75ce10ad9d2164a9f3eb30ff3378
SSDEEP 49152:p3aNC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99d:+y5112gYy5azzVv569nLKnhZPtntvn
TLSH
T1C0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 22cf7e6498974855d1b2213a21d5b4ffca02003845345c928521b85bdf3e872f
MD5 0c1f448f8ed03a4ce60f5392989f3667
SHA1 1f15a2b93122baccd40d170f94c2a4a5b0bd1258
SHA512 c607715f0a928a37e1397088d4a53edaf0b1679a9fcb2939a6694692ea039f5567663f0696a2d76bd3879a7cfe176c8bb3589d41c8644c4b470f82749864a630
SSDEEP 49152:Up+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl7Q0rO4H+CfvJZY:qu6JmTxd2d7tntvn
TLSH
T1D7D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 76d1b5c0593406efc2fcd2b025241753d238dbf0c99e2dca19a8e1eba2f7df24
MD5 8aeb5692bc932e899ec391a3866a3c7e
SHA1 e977dd7393f5b0a22041638766b118d94b05e6bd
SHA512 9768feb6755ddab1aef629e75966578dbdb0a6b38863d46448708a908eaef11e5b5c24299e9a9964e8bebc6b9ff596087e0b99140ea52cb77167ceb3597b99c8
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xtQ0rO4H+CfvJZY:2mifPbRstntvn
TLSH
T102B5BE13F2D901E8D05EC17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1b42d4657223b8b0ca01ef9e99f2840fb9a454543a4ec92c9f6cdef405cc7f65
MD5 ae495a83c0884d5bd76841a7f59c200b
SHA1 184b86887bb6a5439047f24418c469f8b07d9247
SHA512 ccbd8614710bce08cc689cf0cac0e7c242b33927e13853ab48906bb9935ad0cb5337d79d1b6af9d10738e2b0df0072bf6755fe68e8e11be242ce5cecf5ecd9eb
SSDEEP 49152:qSuZQIY0Be2K6RVtOnks6NMHqtQ0rO4H+CfvJZY:05dKoi61ttntvn
TLSH
T138C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6745a28b730ad6368b9818ef7d5762f489040c452cea8446a97b89d0fe1f431a
MD5 e2868e15f7379b450f4a6b2ce634ca66
SHA1 817b4fcfb7006e93a7e4cc74e2d87d45e1a84838
SHA512 f1b515d90f8708543d2845e4061899fda14085b4b3a9f66a1161d8bd623a359c9e5003555aac82ee97d863e9ea3834628e6e17dd8d8bd8a102bc021c21c0c86f
SSDEEP 49152:DpkSn8EApI0figTgiDn0AP5wPQ0rO4H+CfvJZY:/X2iyphmtntvn
TLSH
T1A0A5BE13F2D901E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 3ebfc2647d783b03d8807aa2d78780a8e31532f0f69c3f876b51cf07710e2571
MD5 96101793b1735cef4d39a016b3fb3011
SHA1 8f0793ecbe1e3f31512a5424c7b31b833aeeb6ba
SHA512 ef7c265da92b46347100af1343a427d2a32ae27f4d543f126c9a0fa27eef98e6850f263dda749331199383a2a79431e8a4a08177b30cd34c066095c3d41c6abf
SSDEEP 12288:IXZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:IJQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T11FD42342ECCF369FF085C5B1D89642CB48682F7FD7C6186C31AA4B458FB6A42770865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 4a348fdffede819d223d5135f4618b182fc3cb3b3cc10c677f64aaf52e6555d1
MD5 30564a8e06c1c6272fefab175d73c212
SHA1 f4628d79da5258b740cfaf64f21731aadcab08fc
SHA512 2988145a529c27bd062286628d4d3a977c7c8098019afbb487b587828158835557e8012a1ecdc208454c10057f6c5d6f05eebef414832b47910ab0db04331e76
SSDEEP 12288:2EZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:24QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T103D42342ECCF369FF085C5B1D89642CB48682F7FD7C6186C31AA4B458FB6A417708A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 37f2f58a708d860536f0861fa39225681c22a6d193eee500b35b8b1a0d7e2ea8
MD5 2b9a8599469db803773336918852ff27
SHA1 e4fdc3e7be1da5c875c0e3818bff5d0299a10192
SHA512 4f90009ab4ffcf2c272f1fc1d0647f7e747caf22dad53015744286f19a44a7d121d754da8f20bfb16f39fba387e75cd0bbb30c47afbc6eba408d320ddab09559
SSDEEP 12288:gxZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:gHQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1D2D42342ECCF369FF0C5C5B1D45642CB48682F7FE7CA286C319A4A458FB6A42B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 a6ee9932c9a4c10244d5f6e9de85f83a8a8d1e9c8b394916c2fccac963391874
MD5 9b379d36a75dc440910500b1944ae1e5
SHA1 347ff129c7549c5ad30c6f6d57fe662cc04c866d
SHA512 dc6e838ec60436b4d777f987f1d97638c6107362626bbd8e65045d5a36b66528e6aa006dcecde3a2df1400f9f5cd1ee366c45f98a93fa884ac657653d291a1da
SSDEEP 12288:5lhBZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:lQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1BDD42342ECCE21DFF0C6C671C862428795B47E7FD7E62A6F22510A494FB2741BB04B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 17ac14b4d96ef621842af128fdfce64b3a4d9921c437ec083dafad70204c6945
MD5 123d7b086364461de691ee8c6e2dd7ff
SHA1 fbd0c8788324826580362aa04c38b523686b3f87
SHA512 82a3274317010242f81766fc0378faad4c2118aa970408ad4673f36db119e8beac4a70a77bf7a8346271ef7bb696ae0380cabe06661081838301c50789955cdf
SSDEEP 12288:P+ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:PuQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T191D42342ECCF369FF0C5C5B2949642CB48682F7FD7C6296C319A4B448FB6A41B70866D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 33bcd8cfbae2b9c9f24cef62dbc82c83e486cf7078113d25ca59a640f2939f09
MD5 d6d46581f9be67dc07a55cf9884647cc
SHA1 388698241ddcd06ed879f61cc470b3aa815fb188
SHA512 935ba2eede1fc7b13e75f306ad1d7bfc8b7edad9ef3e5f1ecebdce908a91e00ca37d90a93dce93e6b92fb7b34d6da8590455ac6841d496ac320bb4b3c1c61daa
SSDEEP 12288:M1ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:MLQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T187D42342ECCF369FF085C5B1D85642CB48682F7FD7C6286C31AA4B458FB6A41B70466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 f84dc92e6a08f3b070cdf86d5bdab97da5a1b38bf3f27aba6799e29da4f82f00
MD5 6663092948364f2b3a4301cc9fc644b4
SHA1 8707ee1980c7480878dfbcca64ff14037b9690ae
SHA512 c2ba8f11863cad6d40e361fca35a574645f26b720efb463ed60d1c2eba9981c93bdfb3e4a3b8138edc594f1ee42d9b28ed26e8bb06d0daae00e4673c27ce47e6
SSDEEP 12288:lEZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:l4QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1A2D42342ECCF369FF085C5B1D45642CB48682F7FD7CA296C32AA4B448FB6A41B70466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 0249f09da13b877e18cbdcd82d75e4343513f65aa0adc51845678cbb196a44da
MD5 155241f98228a2ea01f03599a77910dd
SHA1 0c72cd3e5c265e8d1f7fa94d887f875e0f5f4b51
SHA512 85c5801e4a738dfdf47338a9d8fd550cb15eb7fa33f8150c1323e441a8505573214187466244647e0ad4ad9d472290335647f0189500e12688370f6214904d17
SSDEEP 24576:RZMjzFpSFvQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:RZMjzPGQ0rO4H+CfvJZY
TLSH
T187150291B29018F9ECA7813ECC558906D6B27C6A4BA0CA1F13F437575F333911D2DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 e6e337337c0cc5b38c3ade8eaf1f3bd813fbded176cdc7e167e8a50927bfdda5
MD5 c82473adba187ceaca64ecbb9bfa1fcf
SHA1 ba18290fab46bf5b3198452a01497005fcaf409b
SHA512 97b8cf1f66af7ad898830b741c34bf210b284e8dc44f4eb89f1ae161fcbc172451f282be9ad1066d9d47d6ac890ddc236bdb75385f58b8790d370512cf277131
SSDEEP 12288:4gQZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:4VQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T156D42342ECCF369FF085C5B1D45642CB48682F7FD7C6296C31AA4B448FB6A42B70466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 9c126bc7eb9c68fcc7803e64523c2135e37cb049ad8552013884622d166fabc9
MD5 65a730845b1eafeef020456ec51b699a
SHA1 8a0bb5b05f2b0a2580cb5ef45e5525c594ff918e
SHA512 add32c7aa10c02793aee76089d58da0948ad012dd9f3a27ae46c08b949924baf56d7e7d25f616d6f758e62c7df674aa94653cbec9931d9500878cfde1e37f938
SSDEEP 12288:2/ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:2xQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1B5D42342ECCF369FF085C5B1945242CB48682F7FD7C6296C31AA4B45CFB6A41B70866D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 eb31674b8bb0663eb750ad4f0b2ffa222b1df3174138a0d32d8bd220ae1e1a56
MD5 bdc071bcac4969b365c7746d762c343b
SHA1 d6fd679f33917f53abd37b8c1d372aa874e28dfd
SHA512 c8b97c60771381c2075a53eab2577c0e19857a81e5e196213a668c66fa8c0f14294c8d1b248957da9fc9f0184e564741d997028548f8928b15babfbd40e5e0e4
SSDEEP 12288:D5PtvL0MZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:FtQAQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T191F41243B69631FEE0668235C8A20A47F775783747A05E6F13A407765F33781AE2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 c234692404d23626fa94b4f28b351ee1e811698f4c26b89d7ca806b4377c6381
MD5 a0dce2dcf199e29fb33f331659f4180b
SHA1 20d0ee02c30d637a66839eca501af51bd17ebe0f
SHA512 2afd712739d71b01478410e261109d429c837ff0e54879650c40d507bc7d129f4ee8e1883398426864ee5e0f9417cba407b2a4a314bdcdc92146a86824a96fac
SSDEEP 12288:Q9ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:QzQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T154D42342ECCF369FF0C5C5B2945642CB48682F7FE7C6286C31AA4B449FB6A41B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 f6a7229aa4d523108be6934ec3098801107f7be389c13a731c141da8013c98b3
MD5 e9e82ddd697d3a5c104b4ee2ede08481
SHA1 2400f7f3804a0e94a7ed1ba1e149fedb1af91d1d
SHA512 d9840731d1098c59444632554aada3a18261ce8f5653b4a9b8c93be2d47906cd88e494dc7fc0a08eeb8138ef0fec6d90e49c10a316280173536442edb6cd41f0
SSDEEP 12288:gqSZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:gqyQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T19BD42342ECCF369FF0C5C5B1945642CB48682F7FE7C6296C31AA4B448FB6A41B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 566325a04c0e673c084dda12429af36f5a0ce220c542e43725966375c41c3b84
MD5 8290ee37b5fca25de4a39c3d642117a9
SHA1 44bca2d44d208d471db5e66d1f392e45ac209fc4
SHA512 b48331e576ef315ae7497025061bdb93fcbddeae264f32ccb05178b39637ad3929ff3acfd6607206e71b61b5b639819fa9948f162bc6c97e12e9315f42a5d5b5
SSDEEP 12288:O5PtvL0UZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:ctQIQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T165F41243B69631FEE0668235C8A20A47F775783747A05E6F13A407765F33781AE2EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 2e90d65f12e2571ea2b7535bf50ba8204a5ac75eaa5b286c6a980b15d8e9536f
MD5 5b6fe5de07243b851fdb721b94d6c92f
SHA1 742325607f69efc49befc4d33cb6c9db5500045c
SHA512 5c999dfda5d47196c068e50b9c8c4d5740f97ab0b047024cc602d40f1df1317b9dbe49861af06c715f44609e5006413e11c805ff104cad342d49df2bf60e9a78
SSDEEP 24576:sTPaLl3z0zpPQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:sTSLljoQ0rO4H+CfvJZY
TLSH
T1A9150191B29018F9ECA7813ECC568907D6B27C6B47A0CA1F13F8365A5F333511D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 04aa6974ab0c06ca070f99090f2b25907f3d0889e6cfd3dc40d866634a804a7f
MD5 2308e9261d4b60f60e6e0ad8db419ed6
SHA1 43c8e42dac2c6d1d063b45a9d143fb5b32f601d0
SHA512 0f6b8c911aa1ba4f3048477f4d9d399d04f542a05c21bd430f486bcbe90aadc559f1b5c53a055c6a59e0d3b9dad714137996155bc8f4980c17b251fc86d4e15d
SSDEEP 24576:C3wdzCHhy7EitQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:kwdzCHhy4uQ0rO4H+CfvJZY
TLSH
T18735CF90F3D410E9F0B7CA3589764502DA767C6A5B61DE8F03A4265A1F33BD19E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 1077055c2499260311f6071563674c1940d624467bfb5fdbdfa20149b30c8ec9
MD5 2f1a84040758516eba66dff8f1762bde
SHA1 6e368d96d5717987a6e6b89731c60f6177e3a46b
SHA512 11b51106372650ab24da478e1ddbb5514bf5475e72c0f11507b53b48271a6894d0720114086170198b458cf20d41acaa03583eab74e3e0ab8cfe3ff94d0b6424
SSDEEP 12288:qRZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:qnQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1D3D42342ECCF369FF0C585B1D49642CB48682F7FE7CA296C31AA4B458FB6A41B70465C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 ce18ebbd59c0ef67a9ab4c77b5b4030ee5947c74a671527dacd48f60f4e57b4b
MD5 1dc50a3fc0e163c04eec55e9d828b9f3
SHA1 1fd9f589bccb0185b126ad418f9cf8df4e27ca48
SHA512 60804667becc1f4bc3bfd61878af67003e990412b33ec99a907d84c7e61ff9380fc342ed8864548746d08b8568877b79c95a66e316cf98244739608f352b60f7
SSDEEP 12288:4BZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:4XQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T196D42342ECCF369FF085C5B1D49642C748582F7FD7DA296C31AA4B048FB6A42B70466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 929ce65c1d3ae9f075367af99f8b9e8a1248f9852240b40da31a16ba819d5623
MD5 9bf625407064263f84598f9a5222b4fb
SHA1 6cea8741c9f56c5497961580cd45b6a23d85516b
SHA512 6e1b7d5f83d23d2a77714aad3e812c749525b74c064f38830f0bdfc7474a450ef9b96c362f275f37e181144d552aa3cf7f63396f5e149daa39449055f433f097
SSDEEP 12288:ZvZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:ZhQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1F3D42342ECCF369FF085C571D49642CB48682F7FD7C6296C31AA4B448FB6A41B708A6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 dc2a48a76b27d570a09c25c53a31b4f6c93595a938eb298112cfe7b0f74acc06
MD5 7454b5ad006988986af4cd151ae77d74
SHA1 889a662e6ad6b898d75238c0b31865672e4a0018
SHA512 290fa6e26957845e449d6c41189f39c3b8205bb5a9ec279c443216904aee97376331fcc8985b96c48ec473dec215ff478471e1bbd50cb6110f5cb5dd567bce26
SSDEEP 12288:C6LZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:COQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T125D42342ECCF369FF0C5C5B1D45642CB48682F7FE7C6196C21AA4B448FB6A42B70866D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 7e7b49e15a284527d2b90cc6d3269a261a2691ba4c116ddffc788a5ea8ecab34
MD5 5475293778691e1c695ee5023698c65c
SHA1 fbca6755a6a6ec7c435e98d7b2c868b8b5aac5c7
SHA512 8be0ca57720b02c9fb931386a8c44b40bac1611493cc6fae4dd0e4c0fdf872f0fc11cfcbf21db176f7ae5cc2a561dfec35f4ce98d1452552f928dc322eec6120
SSDEEP 12288:QU+ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:Q7QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1BED42342ECCF369FF0C5C5B1945642CB48682F7FE7C6286C31AA4A45CFB6A41B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 7f49f83f59ed7940e113efd591a82829aa595bd1d7966a7f321c996fb02e9351
MD5 b30dc63b8ab68f628c6a115580f1b124
SHA1 a97915dcdadbecb1be8b4bf65902508ecd1e8e49
SHA512 ffd418dad4b8e6d1068d56590a67ba72f6eaaa2ffa042f250bbaf86c4fdcf4c8fa8670316d508a879f40333764dfbe5e80bc9e77697a33144d490d7a31eceb48
SSDEEP 12288:zZZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:zPQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T174D42342ECCF369FF085C5B2949642C748682F7FE7C6296C316A4B45CFB6A02B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 08053a615aec097fefa3e66dd21e7b6ebb49caab8366e7a0b78d4d46feb26d14
MD5 376e9f9b019fad22be6308bbd55967d3
SHA1 bf17e4757a05daa719cfaebd32f5164013fb2d46
SHA512 52c22e6261ab2da59982133c711fdb550764f4326b4c2b3d5fa7ad59a75e8291e640f1b7e55c4858977a9896ba6a21e8d1c6c2f4f0a177ef25c7eef84b302ff7
SSDEEP 12288:idZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:iTQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T119D42342ECCF369FF0C5C5B1D49642CB48682F7FE7C6292C21AA4B458FB6A41B70865C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 36db3708040e815cbd013bbeb327f0e3826c1c2053aceef1a4a8011580ff484c
MD5 41a5f7f14f94805579c7d0686da2b4e8
SHA1 fff8cb452370a9ae028613e0301af55fb0bf58e2
SHA512 466321608255e99e7462a5b285f5671043f163d2821529509a0ad314e602ac9b5e8df66035c57dcf7f2b975f8a50141da57ba17661588ec817ae34d7b3ee8c64
SSDEEP 12288:zrZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:zdQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T10CD42342ECCF369FF085C5B2D49643C748682F7FD7CA296C21AA4B458FB2A42B70465D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 178fef2de50fb1eda93b603c065d6b99196a0c74d9a1db9478056117d0c59bc4
MD5 77e6564e1d1ed01cd7f996753048cbee
SHA1 8b2ab279206b76a478aa8bb8de4888cb70700e56
SHA512 bdfdcf346faf3b7a514ea77b38525b6f0c9d498ece9d6a3023ad3555579518bc40f350088e7ba07fb2033b0c805c1349df19c2290b95f4e0e5b15f268a0cffe1
SSDEEP 12288:rZZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:rPQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1CCD42342ECCF369FF0C5C5B1D49642CB48682F7FD7CA296C21AE4A448FB6A41B70865C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 2e3d4254284816a307d26c5acfa8727c2ce5c6e4cbe0ab7d3852835fc2134b7f
MD5 63117a3d698eba306a6c7e50146984f0
SHA1 03bd21a839a5467c099c9ed8aa0b1590f1a3dbdc
SHA512 5a00f13a982daa64e4d5fcf0ca4802b63d98c74962e4499740d6264782223b4284d8b224f20f33a03a091b93a161b1a63fcfe2dce307d846839d0bd050e461e7
SSDEEP 12288:X7ZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:XtQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T191D42342ECCF369FF0C5C5B1D85642CB48582F7FD7CA286C21AA4B458FB6A42B70465D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 602KB
SHA256 63a5585eafdfe81169563b53159700caaa008a56e42bb54c0bebefa5eac45391
MD5 a80e501fef46b3edfe299e000f60d673
SHA1 2310aa6979d4dc2fbd47504cd067e7de3e84ccf6
SHA512 f17ebcd9fb752f962bdc1c0212b4e87a6c9f7d665fd9a9d8174ae0f49b82734502b6caa7f8d8298c4107299844639f781ecc34f4c68c68bf002794fd69069450
SSDEEP 12288:phZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:p3QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T14CD42342ECCF369FF085C5B1D45242CB48682F7FD7CA296C31AA4B458FB6A42770866D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 602KB
SHA256 a3795f1c8dd244c020fd6448a060177e37aac9788c58a05a25ddb814554ab665
MD5 06c71cab537731a5861a395a926b29e9
SHA1 e3e3d10c4853b78987da93288a741ffc842e854f
SHA512 01bacf95d2799ebd89ffd2a2593a3e8ae15af1da72f44e9a64dcdd21fc535ebb3d085b287a4a21557f4dbd57a2aaba2de6b3f6bdcb88c341ad5d8a8cc065de2d
SSDEEP 12288:WIZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:WcQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T177D42342ECCF369FF0C5C5B1989642C748682F7FD7CA296C31AA4B448FB5A42B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 602KB
SHA256 e6885913a13980152c49afcc259bfbd071f02d515d99c78d0c434bfcf32531f3
MD5 7de9e6e600cab82076ec78fb5414f552
SHA1 552f8749effd1c338e2747bac34015df0319e3cb
SHA512 38fc377434a8df5329ea4b78a880471fd2b1b5d3129313a57e8fb80650450717aa3dee63a03c0848d1d5af552162b2212a2f1832edd44b815ebad92eb8c3ba71
SSDEEP 12288:JNZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:JDQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1ADD42342ECCF369FF0C5C5B1D85642CB48682F7FD7CA286C21AA4B458FB6A41B70865D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c7ddb4f3b669b23d98eb716dc7578174fe11f88872f81780f15f6699f66c2ba3
MD5 5075739219fb86a396cb65d18b847bd1
SHA1 7d9ed377a564fff4b945859458d599a838da3309
SHA512 c4832be436b064fa0f455eef2fdb5399d542248c30618dacb2451a9e3130523fbb940406855fc3de7b75e187c101f53e0c6e0547180fcd5aa69b64f47a85fd78
SSDEEP 12288:+y+2fhZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:+k3QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1AFF40146D18812EDE09E9175C7564642F7373D6A87E193CE22D0FA3E0F76680AED9B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 8d323a993efa8a1eb7d29ac30566c49fc0d182ccfc836f4d611721c8f660e296
MD5 24afaa8a02f70276b42488764417a218
SHA1 7a895e35af7157fee8742ffde4023ed9223b9922
SHA512 3f8468c5ff922bb1962b49823927a6a7ccb1c0aef27b5815f7c22b39128fbafb4376badbf88155ff56369be021024858420a5899601027a7ee8f6590b45b34d0
SSDEEP 12288:sF7wZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:AkQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T12FD42352E8CE3A5FF0DA85B0945A824714283B7FCBC518AE71594B899FB1E81FF0471E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 1f0c4315d618fb9bb24ead347d8884e2b48ddddd492fbe5cc5eef4f5031e1d12
MD5 b53f9854f36696b3d4f00bb369465cb3
SHA1 10ef994ff7fc0bd1aab2996d199ce2d5e7afdf33
SHA512 f2593998a220f340533c91f96d17d664f01c6dece127bf852ff8cd14d5f953674ec28be1e6779c5ecd7ff2fac0d633160d8830aff30e0f0cf88cfb7261c984a8
SSDEEP 12288:OZGRNZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:WGRDQJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T12DE42326E8DA31DDE07AC2758462418778703A7B879529FF00E58679CF75AC0B73CE58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 fafb9b025958c840583ead0a775fa26298a726ddae93dba228e5d2adb12ee3f8
MD5 b6ffb9de707400635f1ca15e222d81af
SHA1 1e6255117226c29b9321b15a47d86cdd245d03de
SHA512 dafe2dd0269d837bdc494794feb2c1731280abfd296989c20281641eb4d745ebf6711f5164a47df5dbe9e4cc304cee6c0860bc03a8f2f0c9301a7f5e7f8dfae6
SSDEEP 24576:1PUr+NQVQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:1JQVQ0rO4H+CfvJZY
TLSH
T19605F12B65DD18E9F67AD17D8982870AE7717866035292CF02E0817E4F63ED8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 912fd4e7af6bc46e6cfdee43bad33f62b66006fa8bd88920bf364b3c2c1c2adf
MD5 f9128abc37d7dc547e7a4303c98876b1
SHA1 99532c9bcc9d117c92298dd97b4cd48ac1a6184d
SHA512 4587d843ead364bdb0aa36cb98eb3f541ca506b113876b430511e4f36d04201320dfc2e9bfd6fd97311562bb25c16b4ef7b5913b028316340c9a1dd334a2d596
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEQ0rO4H+CfvJZY:OG05lO43bdtntvn
TLSH
T102D5C06A62EC11F9D1BBC17CD9C6460BEBB23425033556CF02A486A91F27FF4A67E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 925896853b127753f02d7c6e932e73078a19b252e5cd7972a2e37f87528e85aa
MD5 74931aa4a929fc9e9876fad3f9a831f4
SHA1 eff5699d6c9060940edeb7f661c8004abc583c9b
SHA512 3d6e663faef8ca5d07d37ecd84edd6709a1d53e01f433c4ec1215d74c957ccc664bd79c353d1d0c28a892b4b3ad8605d790fc6d47a49895e1af8a8f137b8122c
SSDEEP 24576:66DIAQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:66DIAQ0rO4H+CfvJZY
TLSH
T1CA05025D72AA21FAE0ABC03EC5830542D1B1B576C75219DF16D4C5B98FA3EC8BA3CE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 53f22590ce2a4133f9b5454d18b6f6b1d5ecc7121212a852d29685970be6fd5e
MD5 be33b87ae969079f131422e694efc226
SHA1 baf535ea17b15fcc7dde7e111e366604a5552766
SHA512 485f02f1a53901acb12758df2da12e71e739075d15f77ae08ecf3fd2bf7854589fde25924af2d8aa8c231ebc5e3d9972a667fe2ef306ea46bfb1a0ad11594fdc
SSDEEP 12288:2G6kyaZvYJGfzXeO1cqTXmgCdQ5FL1wDeuHL70OYyKJtSsIF4h5J:fty6QJGfzOO1HTXaCfL1Ru0OYXJtVIFm
TLSH
T1AAF42201A6C831DDF1BA4274D96382868E347D369B9116EF21E1D72E5F76BC0BE30B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bfeb3754898ec4fd331ca1d2488e872be1b67fec34f6c2ad108982774ae4cbd4
MD5 3602ebc12553855ed4dfa74acce6b449
SHA1 8f9088439500df9c5c2deb9886540941c6cb5d94
SHA512 6e4fa24037917b1e5021be572fb70c693e8deaa1d75e469d383f8262b7be0773031d3fd8151b68ecdf4bd083cbb4a57a37e5f3a44034cf39bcb2db34b1c55d3c
SSDEEP 24576:ETkNvNnaFeYhJNtmZBm1QJGfzOO1HTXaCfL1Ru0OYXJtVIFm:ETMwBtOm1Q0rO4H+CfvJZY
TLSH
T12D55AF6EBAF806E4E1FEC6B5CD238512E6727461073253CB5290C13E4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 4f02be937d3e95451d0ec8da9ee6de44be6ecdbb8968bed25c9a8ab8e72a03e5
MD5 848af440f829cf2cd80eb38505a6741a
SHA1 e3d67cbfbadd72b60f757fec48875407f6f1f3eb
SHA512 3a91be7ad4da902974f008f41291c1d997f5453b3e8aec1827b70f43419280ea2a4e2d0cb4b8e61644062bb1dbeaf6afe2b54820a5a8e4963a34f03d365963dc
SSDEEP 24576:M6UqjpkQJGfzOO1HTXaCfL1Ru0OYXJtVIFm:M6UxQ0rO4H+CfvJZY
TLSH
T1ABF4124AA5C834EDF0798270D866825744747D7717E629EF31D8867A8F32EC0A63EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1032-7-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download

memory/1032-1-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download

memory/1032-6-0x00000000029F0000-0x0000000002A59000-memory.dmp

Download

memory/1032-0-0x0000000000FE0000-0x00000000010D6000-memory.dmp

Download

memory/1800-54-0x000001C1E4960000-0x000001C1E49C6000-memory.dmp

Download

memory/1800-53-0x000001C1E4960000-0x000001C1E49C6000-memory.dmp

Download

memory/1800-52-0x000001C1E4780000-0x000001C1E4833000-memory.dmp

Download

memory/2636-30-0x000001F5254B0000-0x000001F525516000-memory.dmp

Download

memory/2636-28-0x000001F5254B0000-0x000001F525516000-memory.dmp

Download

memory/2636-27-0x000001F5254B0000-0x000001F525516000-memory.dmp

Download

memory/2636-26-0x00007FF634070000-0x00007FF634139000-memory.dmp

Download

memory/2636-117-0x00007FF634070000-0x00007FF634139000-memory.dmp

Download

memory/3004-37-0x00000263C2A50000-0x00000263C2AB6000-memory.dmp

Download

memory/3004-38-0x00000263C2A50000-0x00000263C2AB6000-memory.dmp

Download

memory/3004-36-0x00000263C2A50000-0x00000263C2AB6000-memory.dmp

Download

memory/3004-35-0x00007FF634070000-0x00007FF634139000-memory.dmp

Download

memory/3004-129-0x00007FF634070000-0x00007FF634139000-memory.dmp

Download

memory/3244-108-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/3244-138-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3244-103-0x00000000009A0000-0x0000000000A09000-memory.dmp

Download

memory/3244-102-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4276-87-0x000001C5C26C0000-0x000001C5C2726000-memory.dmp

Download

memory/4276-85-0x000001C5C2530000-0x000001C5C25E3000-memory.dmp

Download

memory/4276-86-0x000001C5C26C0000-0x000001C5C2726000-memory.dmp

Download

memory/4288-60-0x00007FF6CEAD0000-0x00007FF6CEC38000-memory.dmp

Download

memory/4288-68-0x000002175A320000-0x000002175A386000-memory.dmp

Download

memory/4288-70-0x00007FF6CEAD0000-0x00007FF6CEC38000-memory.dmp

Download

memory/4288-62-0x000002175A320000-0x000002175A386000-memory.dmp

Download

memory/4288-61-0x000002175A320000-0x000002175A386000-memory.dmp

Download

memory/5176-96-0x000001B17EE10000-0x000001B17EE76000-memory.dmp

Download

memory/5176-95-0x000001B17EE10000-0x000001B17EE76000-memory.dmp

Download

memory/5176-93-0x00007FF7705F0000-0x00007FF77073A000-memory.dmp

Download

memory/5176-137-0x00007FF7705F0000-0x00007FF77073A000-memory.dmp

Download

memory/5552-18-0x000001C83C910000-0x000001C83C976000-memory.dmp

Download

memory/5552-17-0x000001C83C910000-0x000001C83C976000-memory.dmp

Download

memory/5552-16-0x000001C83C910000-0x000001C83C976000-memory.dmp

Download

memory/5552-72-0x00007FF6EF120000-0x00007FF6EF243000-memory.dmp

Download

memory/5552-15-0x00007FF6EF120000-0x00007FF6EF243000-memory.dmp

Download

memory/5664-45-0x0000021704320000-0x0000021704386000-memory.dmp

Download

memory/5664-44-0x0000021704190000-0x0000021704243000-memory.dmp

Download

memory/5664-46-0x0000021704320000-0x0000021704386000-memory.dmp

Download

memory/6000-74-0x000001E7C5AA0000-0x000001E7C5B06000-memory.dmp

Download

memory/6000-75-0x000001E7C5AA0000-0x000001E7C5B06000-memory.dmp

Download

memory/6000-73-0x00007FF7DBB80000-0x00007FF7DBC9A000-memory.dmp

Download

memory/6000-136-0x00007FF7DBB80000-0x00007FF7DBC9A000-memory.dmp

Download

memory/6036-260-0x00007FF744910000-0x00007FF745054000-memory.dmp

Download

memory/6036-123-0x000001D7147F0000-0x000001D714856000-memory.dmp

Download

memory/6036-122-0x000001D7147F0000-0x000001D714856000-memory.dmp

Download

memory/6036-121-0x00007FF744910000-0x00007FF745054000-memory.dmp

Download

memory/6036-139-0x00007FF744910000-0x00007FF745054000-memory.dmp

Download

memory/6036-258-0x000001D7147F0000-0x000001D714856000-memory.dmp

Download