f37369897c9a1b839c04c720605b3c0bfff05e04f221df09d7a9e98697cee8f2

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe
Size 1003KB
Sample260827-1hmtfsdn4x
SHA256 f37369897c9a1b839c04c720605b3c0bfff05e04f221df09d7a9e98697cee8f2
MD5 1f46981b85ae3524a2e2c0038e61fc01
SHA1 a32f833f53f8c2530f2c97a843aa51ecc90b7dca
SHA512 09b9d958dcaee32739b69907441cc86d74fae9764153cec4019c77163cc68db1ee9d80571c83bf0acfbd7a7fe3261a745d2bfb51476e40f02abd14cdbbc59b67
SSDEEP 24576:RNEHd0EKpxtJFtMdW2t89TMFZ2qrfJdlXbKL8fHz0/LPRRPUoIyke9b:RNEHJKrtJF6/t89TMn24fJz+gf4/LPRf
TLSH
T13E25F129B790D032C17701368E46D7B5A5B9F4B08D210157B7E4AFBE3E702D2EA38B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5816	alg.exe
3116	elevation_service.exe
3984	elevation_service.exe
4332	maintenanceservice.exe
1820	OSE.EXE
5620	GameInputSvc.exe
1620	GameInputSvc.exe
4708	msdtc.exe
296	PerceptionSimulationService.exe
6040	perfhost.exe
4784	ReFsDedupSvc.exe
6020	locator.exe
5692	SensorDataService.exe
3488	snmptrap.exe
3048	ssh-agent.exe
2108	TieringEngineService.exe
3336	AgentService.exe
5404	vds.exe
5020	vssvc.exe
5932	wbengine.exe
3996	WmiApSrv.exe
6048	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c3382d9724febf98.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	GameInputSvc.exe
1620	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5108	2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	5816	alg.exe
Token: SeDebugPrivilege	5816	alg.exe
Token: SeTakeOwnershipPrivilege	3116	elevation_service.exe
Token: SeTcbPrivilege	5620	GameInputSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2108	TieringEngineService.exe
Token: SeManageVolumePrivilege	2108	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3336	AgentService.exe
Token: SeBackupPrivilege	5020	vssvc.exe
Token: SeRestorePrivilege	5020	vssvc.exe
Token: SeAuditPrivilege	5020	vssvc.exe
Token: SeBackupPrivilege	5932	wbengine.exe
Token: SeRestorePrivilege	5932	wbengine.exe
Token: SeSecurityPrivilege	5932	wbengine.exe
Token: 33	6048	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6048	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6048	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 1620	5620	GameInputSvc.exe	97
PID 6048 wrote to memory of 1276	6048	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_1f46981b85ae3524a2e2c0038e61fc01_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5816

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3984

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4332

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1620

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:296

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6040

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6020

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5692

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3048

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5404

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5020

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3996

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f00f88b78e8fa7f153f4efee763ff9e2cce6efc3d24fe618c81f0fca8c6423e8
MD5 06690127090de4ac9da07802ce8a6181
SHA1 f2fc034657a42476e396c1513ae2730ff6ae2c08
SHA512 32328022308a7614eee1c1a242184b780ca6f99cf9413426949eae7d35d6d393e844eeaac569ea76d87d92ebd6037dfee309718713397a4af0eca30bfdbc9304
SSDEEP 49152:mb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnYJz+gf4/LPRxBke1:Y3q6gjBHJqgQ/LPRke1
TLSH
T1AED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 b5060eebca7f8bff3f47a5b87c97f9c8514b4314e5c7bfec3ecccb56f46aa1c7
MD5 e50021e5aca62abc1513752765213561
SHA1 f57f82db7faea49001e320e4c2e7ffafc86353a0
SHA512 24c57588c7a640111011acdbe4c58de1faae6e96bb0e35db7b148e906d1c7c19b9b93d8d1b200ab57b878e24266f2c57fcfbd8560d02d5c6cffe907d0b6a5f56
SSDEEP 24576:GXYa1tczAMJdlXbKL8fHz0/LPRRPUoIyke9b:gtcZJz+gf4/LPRxBke1
TLSH
T1FF05F12977E044F9ED6BC17DC9528522E73278654760EBDB03E0896A0F233D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4a4ce852f5e7f68c871c568fd27753b6cb8d8d9e314bfd9715cd456f82c6fece
MD5 74563771b5b25eaad1dc01d4a8660e17
SHA1 de459816b55909426462bbc4b7727a04e081b69b
SHA512 5617b8b766b9978e2c81aebea14f866aec3f6b26feea0b6dce945b4f78ee58fdf138b6e4c49af0982f07c0e2396fc5fc46355d4826de235f7b1d41cece96a83e
SSDEEP 24576:203eDIW0hmxOrMpJdlXbKL8fHz0/LPRRPUoIyke9b:2JIW0AoMJz+gf4/LPRxBke1
TLSH
T16F45AE26F6748371D073C0B9C5D2A69AEA7130855B308ACB4286D77C3E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5610bb4a9881dc46a582b4ebf81374d112e8cfc2e6f68cda2181fe374ea2a4b5
MD5 d4c05017b80a1b0276d0efb57bbebf0b
SHA1 b7acedfaebef87defa45bac196df869b3669b800
SHA512 bd9e3f1a1e48e103882391ef8dd07fedff182d4e0d691eb57bd520619467da7fbe30c5086da17331ab1319efdc723f333d01c376aff739526855f00829846d3c
SSDEEP 24576:WZP/ezSC6vUyD/aqgrvW/6q8wyuvJdlXbKL8fHz0/LPRRPUoIyke9b:O/ezSC6vUzPvuHjygJz+gf4/LPRxBke1
TLSH
T1E4755D25F5788323D0B2D0BAC5D66A9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 73b240a9782938e71b4fee453ffa04bf93b151095ca69a408156ef8943e91149
MD5 5b0418042aafd0d9d6f1c9d5f814a68d
SHA1 54f28a638d7da9e1e42d8580b238b85c3ca0d36d
SHA512 3ff81ff68682c9ad893ff7b7f0b1146eb2d00e827911f092f22fd54e9e798167a7e814713d63511d7023e33e2117c0cd8ef7b90feec88c9fafde5e0cde4dc7ad
SSDEEP 24576:oAbxPcH8ov/l+dCJdlXbKL8fHz0/LPRRPUoIyke9b:oACH8oXl+MJz+gf4/LPRxBke1
TLSH
T1CA559E66F5B4C331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 1fb2e1fb5192ffbe910130a8c369fd2610bbc30551721784896f34b37dbf6d36
MD5 850c7fcfc36ce5d2de5cf930fe177363
SHA1 b88b21942e84edd31e1fc6c4da97d509e5e2e03f
SHA512 876c79b34116497ed9cbdba8af723524e6c299abb10daa478e7805d8e4337100f2088a06f64f2657b10b3989d588077d65a3fa08f59975d9dfeea5aec2a6e224
SSDEEP 12288:+wEJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:+wEJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T100D4236A9AF1D0F1F3AEC4BAE60F09B3D32824348F541EE9565018EE087676EF644735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 3647ee4e3cabf55c0738fb53b100f2a20d4b4bb3fe6c2c2c8aa55146cbc291af
MD5 f7df0bb45abd8bc8214660d15604f5c7
SHA1 3a22bf0217692b265b075a162b4dbce4570c233d
SHA512 5d53ee7f05ebc9a2d8a2382887090c444e1c41028d5a98d414e21ad9b31867b220a1654068798b6be749bd2dff225e65c16b995643bfc3920aefee21ee1059b3
SSDEEP 12288:heBNUbTVO86UDJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrf:hJIUDJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1BD15CF3BEE38FCE2C27E8CB89A518640D77274304F51A3CBD164824E9E236E55E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5f9420e31caf3daf70bee668d189d1e9399e816be3480b198575dac69412fde7
MD5 6dd2d7c5b2d95ab2047bcd624582ed72
SHA1 5f72d094387f2265ff3fcf9c27f4e462c4be5ddc
SHA512 1e7b85dd464f59a2a3d08fd63646811713e38d9eecd8de7844f2e675dc957e4ead8ad75a10522692a247ece9de8f8d1108200a6918987b7f3a8364fa703b07a1
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJI9DN5JrNRV3THe:5QvGAdlCEL8c/IRN/5CQJqgQ/LPRke1
TLSH
T1A9367C656BF880F5E0A7E178C97A85B2F7B678120D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 6dd7062c28d91c234f9065f429c0583f564eccc8317598e4984b0609b1728cec
MD5 28e64df1cb1cd06afcc3429fc4982997
SHA1 a9b26bbb34638daa7127df4f4aa3561f5b5820a9
SHA512 d94881f63f993920ab4a7891bb0226d04ab9cbb1415f5803b55ae081c733654d1bb664636b10d8c5527960f98501eb9f8bc72fc9054954c3d796d222790cc17a
SSDEEP 24576:CmewsAj2JdlXbKL8fHz0/LPRRPUoIyke9b:plj2Jz+gf4/LPRxBke1
TLSH
T1F515E031FEB4E032D3BF0DB65B26C726542C79204F611AC3E3A84D9E59702D26776B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 929464c7eab97add9e6b52d168d3a6e22fcfa44d76aa8445ab89f624db24e6ff
MD5 9e7d8f4993306ee4b14c64806e6854e5
SHA1 c9289a1144c714509353c5a790c24e3d5b58954e
SHA512 a88e36088ca7c5dfa3029681b3a03101053c4ec05f2a663ebe9a2fd5a7cf9176a1d1e2abb74065387815bcc02de9041efd2836629c102a526a3c01e8aa189f5e
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrJdPlbuJH3/Ll:DUEtQevvqc2W1cpV2Xrz23/Ll
TLSH
T162474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 55fad0efbcc44f6bf08a3230d616020b854be95747f6c33ceb54db878c496dc7
MD5 a268144795cb4fe1538a8d2cc961bf19
SHA1 c2c9825ba6ee1471c7814b32cb2b754022b96f38
SHA512 1ebc32baf533020d5d4e7ec7a8a7f2d33a50e432a55b58af23be8db145532b945ea0ee8bb6f150f9b93eb34af0e7fd6dede09e852c6cc48c8e838535c3b6462d
SSDEEP 49152:xibRquA/m2yL5zMfFiV+XenmE3/zvJz+gf4/LPRxBke1:+oq1Vjnm8JqgQ/LPRke1
TLSH
T109D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e940bc5215fd0c1d1769cb77d51161ec5fd2b66dd7f5c42f3f7c01f549ba4d25
MD5 90cf935903a446ed6b307c88095ad196
SHA1 b3c44ced967f014e039a9c19bf4c867af2d1a932
SHA512 bba2c4ccde149501ab99846a31a87a6f14f1de9a9244ec7d36580e10727c778a9889eec797b25ba0a28267ce8eb9dfe575cde8984d2bcdc2bc704ac977d22d91
SSDEEP 24576:bAhGLvUFoiwtA5l7S53UJdlXbKL8fHz0/LPRRPUoIyke9b:bAMAFoiq5kJz+gf4/LPRxBke1
TLSH
T17D459D81EBF951D4F5B3AAB899B68571EA76BCA55E30C24F2160C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 828KB
SHA256 21cd4b543499f86c43a09e799b423b164849ecc83e0711f17027e4a60f2b4b90
MD5 5e89baff5470ba0c3872c537a9eb4556
SHA1 57493191576a31b08e07bd2b0b97adff455bdf7e
SHA512 ff21bfac02bc35d69ca5a4beb0526008b05c5a88927196bba4b5f2a5d718842215c7b48ee41435a4d9b87b0112fd21f430aeaee6daab75483e2237d7c0e08c56
SSDEEP 24576:LwuROWIJdlXbKL8fHz0/LPRRPUoIyke9b:LwGObJz+gf4/LPRxBke1
TLSH
T10305F14A76E448F9E6A78139C6478532F7B2B8212B20DB5F1760C65B5F33321BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 678KB
SHA256 b5ecbc988a74635afcf2844c63c7c1e5049416fa97d2873a23dc162707290385
MD5 d30bc362b4a3f70ff5f92b9d6c02eef0
SHA1 4fa9ec609f18fd79f530f2caee64b1746e63989a
SHA512 33fb77002c4e01df9fa499c0df20baa4c0977a4f6d7aa0ae2bb62712eeee89001ae507be240fdfc9ff514d8934ef955ebce221a8441dd43323009efd70757646
SSDEEP 12288:b9c1I4bJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:ZcuIJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T147E412AA26F0A0F5E2ABC17DD9960A72D33530314B7447DF166005AA1F73BD6AE38731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7e261c2af0c433e74aef0fc25c1405ee1fd695e9a625009fef66126ea1ff20a7
MD5 d0e7c56a30934a6a4154b1891a3ae81f
SHA1 ecd393853a352e3517aff3e2b98f33b3ef62585c
SHA512 1d237addad02d635392ef165ec9d2ab00aceac09807fcb6bdf1907bbbfe394d76bc3683164737933b6f755ed66e3a340121c402d65b535525c6a94eb4f43ec75
SSDEEP 98304:rQRQyi36YOcP8Lvw2gAf+PN3YJqgQ/LPRke1:aQyiKa+X+PN9/Ll
TLSH
T1B9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a2d27252d694da146887b9794ce7e89110d9f546c22e1a706b2a1add232f6516
MD5 58da5e343cc6defbffb62690aa17265b
SHA1 c78f6c9675e01722f252f9f6f18253acbeafe575
SHA512 26ef21f49333d7be278be042f238439d2bd2939bca76643f2a6ff0329da3fbe029d18b318e60b7bb085f836f0b466ab382a5606c9a023ad5f3aefa24f45d35d2
SSDEEP 98304:rQRQyi36YOcP8Lvw2gAf+PN3LJqgQ/LPRke1:aQyiKa+X+PNS/Ll
TLSH
T13D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 90777780ce43300c7ce676adc1d8f475bbd3294b9e783c37577436c4bd98dc18
MD5 5b178b4c471af2ac54b70410addb07ee
SHA1 d32d8825639bdf84e5ebc06f0a23ac1cd3a42810
SHA512 16da72648bdc3fd98d8e88e11ce6fb496fcd8f772f940ffa51b1d8ccfaf02ca2e1ed7104378f7d0dcd0a5a56bbd8f534a63a9617364a89d3ab22e23b3635ff62
SSDEEP 49152:G68Qg55nhMeWu7PNU3/wJz+gf4/LPRxBke1:kthbRc/wJqgQ/LPRke1
TLSH
T114B55933B2F200A9C44DE1769F4A873196D17C758FE0E7DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f7fa39c60bb23802fd76874535cd6063fa6ea6065b840f468605854d9453ebf3
MD5 740afa3513df8ee5e8f212f176753dbe
SHA1 fc165a0d1b223693c2ac2b187e7379aa0148af46
SHA512 a1cfe8be7d3081dff33ed558d37563dbee9b92a69378e76a2fef7407391072ec3111db46bed9523827a7e86d6c54015ceaaea07cd92f636ee642ac0a39746e20
SSDEEP 98304:9y5112gYy5azzVv569nLKnhZ+JqgQ/LPRke1:gLIHAWh5/Ll
TLSH
T1EB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51d8603b4232c0943d845724da80dbea5701703d20213b5c993f19ae82c5e272
MD5 4951fb3240edb22b72fade2a2a5e1c0f
SHA1 af55634e79536b43001c9572910153e60fe23fc0
SHA512 9413bf77d78d36fac427a3dcb7455b2669a24acbd18ff3457db239bb3392d2a79b5cafefffc5705ee823432c726c33177ddc937bc34feca69547b2acc2415efb
SSDEEP 49152:wB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl6Jz+gf4/LPRxBke1:qu6JmTxd2d6JqgQ/LPRke1
TLSH
T11FD59D13F1D901E8D06ED478974A9233EA62BC590B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 732c99a7ec10c624171b30dc96fffeb431db2575588d9fefcb8f0dbbdf8f6da9
MD5 381b29138ab470755b3bec9ef4bef2d7
SHA1 756329b4eb4b885105f01bfc24100525fabaceb2
SHA512 f2c17e547b45e487cf3ff5120aa300dd805db59699c7c64958ee247d81782566ab558d758f9789d5dd168e17d2a7e88ff877afd992d25239eebea1b61e22755f
SSDEEP 49152:g1hpsNoJpF1A6UU44CwH7R4x8Jz+gf4/LPRxBke1:gmifPbRxJqgQ/LPRke1
TLSH
T159B5BE13F2D940E8D06EC17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 48aa626796179cb419ad12c6b116c299baf57db38fa7945e0ec0f95a603d6242
MD5 f074a3ce6959a7cd9ab296918f4335f2
SHA1 11a5823097d1e1aeda4821437a7324e674baee19
SHA512 2cc9e6e8e6d26d57425416e7312c9b276b242b19bb825c89ac7f28c265e635f0062e88613df9d6d425287665b32b7338e4787001681b76c6c7b0310d912f5bfb
SSDEEP 49152:qSuZQIY0Be2K6RVtOnks6NMHqyJz+gf4/LPRxBke1:05dKoi61yJqgQ/LPRke1
TLSH
T19AC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c50c95c4ea7a2ce3c3965900b630acd4448a8a654e6c60e0d29539f8f3cd4429
MD5 8b5cf17300c0b0d98f74920ec9d8e666
SHA1 639dd769c309e91a5f7f888406bbe53080bdc33c
SHA512 7d7854562c9763310e0e90e4e0841e4266ede53ca8b6cd4a345ada1841c000a022ea7f82ef214eb11ba7227700034915ad0520aa4e7c5d679740748bf30e079c
SSDEEP 49152:qhtSn8EApI0figTgiDn0AP5wQJz+gf4/LPRxBke1:LX2iyph1JqgQ/LPRke1
TLSH
T139A5BF13F2D940E8D05ED178C7468632EA62BC150B34BAEF0A90B6561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 ea66e88bbbf7b59ffdd50621a80395c13bbb21a098baf0b7782ca67b2896fd6e
MD5 fe3991b4dd1cfc4c2ba27feeb5eb2f6d
SHA1 edbea08f393fc7d51e5a784d202813f60fc5cfd0
SHA512 ad5f47f4bf950979cd18bc369f077d77fb24f4fbe6b654ac9a105d91b5139d1fff875f28b737a0df5916b4a8228b033a556ed08eaf7fd5534c923c8f10a28676
SSDEEP 12288:MSJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:MSJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T104D423AE9AF1D1F1F26DC0BAD60B09F3D22C20348F541EF9665014AF197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 7516409e5c8b6de8db3bf7a5512f8177a9db1c7b0f0da250819913e982feb4aa
MD5 efc86562dd8858a24a1e49e3967dc28f
SHA1 7c6b9374780c014f0d61da16961dffe56df8a828
SHA512 b53b5b773c88974aa4ccc2d98d697944dd9a797555743cc0934a78f9f192e152ce95dd13beaf31e8dab620144c60b0a64231b5fde808439106a7c640347675d5
SSDEEP 12288:K1YJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:KuJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T155D423BA9AF1D1F1F36DC0BAD60B09F3D22C20358F541EF9665004AB197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 024ba74fe53f11ad97ae02166f58be347e9a1634e16c32e5c53a16ba72e6d532
MD5 a598fa017c751b720634e598a182b388
SHA1 785eea5829977a150416cc5f3e552ee7ad541821
SHA512 7f1d70c0d7b4784a73ab42018a3974de2cc3bd5be616c9925c44617d3f01551b1d4ffb8ab8e269bb552d732cd8e0babc88172a3dd10298a5b85f7dfa09476d23
SSDEEP 12288:E4JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:E4JdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T117D423BE9AF1D1F1F26DC0BAD60B09F3D22C20348F541EF9665014AE197676EB644738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 622KB
SHA256 4f077617f034208abcddea5204aa917d003fb62d184889483f4ba2c2379c38a4
MD5 8168b4b93b81e9c47882debe94b2fc49
SHA1 e82a97ac51fa27782b7e1dccc24bacfb3a995bda
SHA512 de45aed5f2b7c90bbe20619129aa6c271cb35225dd6d6c7d214ebc2244c7a4fb062a75d69e67e8c5753efe01167144961ca6ae37eaaf49968e351e2f549871ab
SSDEEP 12288:5lbJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:HJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T18BD4136A6BF1D1F1E2AAC0B9D60B05B2E33834748F645FEF6740089E0D72769B954B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 aa126fc32d17ddf4a808b5bdd0e5c6b0a36a9e5248b63773bb330a65e89b9901
MD5 dd59b3493e9f4092fd61ee38d5f4e4df
SHA1 9e85c123038d6f169048d2eaf5cb10d8200cd740
SHA512 2e82e8b171ec2c82b75a2e0fba641af3f5f5fbaea6a681d71ece8f92ca93fa8f98e526b339af87c13e9773ab1a98270d974579a648fa69fe1068c09a9ea43559
SSDEEP 12288:TOJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:TOJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1F4D423BAAAF2D1F1F25DC0BAD60B09F3D32C20358F541EF9665014AE097676EBA44734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 b8da3a61870f248afa7e28d12d78f8c391ea3427148fc140ab75ae0a03416c0d
MD5 fbd8544363e55d8ea04966e230ea0e34
SHA1 4b01a718eb41eef8ded07f1825694475bff1f3ee
SHA512 bf4416eb98a70e3b951e7b993f4cef2eb4d2b45ac4a333eeefa2ea3064b6b90021c931ec789feedba095df385b29fd034fc82a4fd1ffbd170c36feb808c8fe4e
SSDEEP 12288:QUlJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:QyJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1CFD423BEAAF1D1F1F26DC0BAD60B09F3D22820358F541EF9665004AF197676EB644738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 7337d6e694daf87bac06058800f3daf6020a19636d31be9357bcd210b45d1750
MD5 41603dd91050d3aacbcc3f979efefa7e
SHA1 3880f816f97fd33c0600fe8f1bafbf3b6851c8f0
SHA512 7c54321cb4bff2dc598d82e3df19a5917efa5bedda6a3a33180f7dabb162920409bbf502036ee12efe0aad7effe660d38999fa11e585ccc32dac1966b78ae89d
SSDEEP 12288:bslJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:bKJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1B6D423BA9AF2D1F1F36DC0BAD60B09F3D22C20358F541EF9665004AB197676EB644738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 863KB
SHA256 1c045fe20d0f80994b05f6f79140c2563d353acd5b8cef3640c94e5071464087
MD5 56668a863b0d5dfb4e1adaa686d5879f
SHA1 76ca8cbb30fbf573c983a2b7c5bf08a727ec7a4a
SHA512 54ffb0c680df6fb3b83e33b519f15344dc3f16c0a615ff4bb98524bb1d3c13fbb1db38c7cb407d27b1f61b7076216eda43d268261908f07863b9f1d65159ba90
SSDEEP 24576:HZMmzF9SevJdlXbKL8fHz0/LPRRPUoIyke9b:HZMmzXbJz+gf4/LPRxBke1
TLSH
T15D1501A9B3A054F4ED67C13EC9164922D2B27C390B60CB5F13A4366B1F333616D2DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 01dffc09afdcf7a2d71c3c7704ece71ac88a3a5e537a3677731c891d2490dce3
MD5 b0e34d3b825f2b882091446fb7329860
SHA1 7b2d5798660743fd9c92e62c364e710aab222889
SHA512 c36622655179d1e1729b85e601f3b677dd82c1e6078abd6a22c73757a8465acfee426e070490cfbf396e34ba15c4ae055a9daaf7a1e28fd8c1a0b799c8fa5e12
SSDEEP 12288:ekJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:ekJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T121D423BE99F1D1F1F25DC0BAD60B09F3D22C20358F541EF96A5004AE197676EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 020748eedc5be6ae1d7ad63d2e35c174da1c6ef679943166b3c1095c3deb3f08
MD5 ff3cf956f95847b48c757465e8c80611
SHA1 4df928200743f5145c853fcffa8330377be334bc
SHA512 60d943b9929efa7978c89cc0d006c3cb3b1794d52768d8407aebbad7652d549153eae416aea77d7d1fafb9baf46e9cd7ea9fb4b8120c18600738732192e8ac8f
SSDEEP 12288:AKJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:AKJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1DCD423BE99F2D1F1F26DC0BAD60B09F3D22C24358F541EE96750049E197276EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 2fc087d5a6308b3580b82d3938afb90f4c8d67bd65bbe5c75d56f2f8fcc25777
MD5 276de72b35e978dcf6bcd673ffecb806
SHA1 acdfcd885c922b6fdc2a37d5624c4cd9442bb245
SHA512 38aaa0d173fabe5edfd491d4118a4493ededd669f4a6322aba4742c479d1c795a011945220262355ffc87e7660f2a5647cb50b53fced2e1d3bd96533e54f6495
SSDEEP 12288:8JPz5L8sJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:yzysJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1E0F4025B77F160F5E17AC179C9560A62F33574314B208FAF176006BB1E237A5AE2AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 48d82afc0ca4b04ebe13dcc6ef26ae4b4703d57257919deabe24dc4a0d3d576f
MD5 d6be486a30dac62d9210a5e500d8de5c
SHA1 a623cbffcdedb9f4da07632e459f2ed158bbd96c
SHA512 d2045c65c613b5237c7571348ebd0ddff288259df220a63565cc75181452c16818a553211c5478069cb0839bdecb009d6b351d1dbffafc4d28e2520b35cda40f
SSDEEP 12288:GqJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:GqJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T10FD423BE9AF2D1F1F25DC0BAD60B09F3D32C20358F541EE9665004AE197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 97d32fc1d50613462d4008a3b25b2af4730bff3c182f20c275c4a7615bb30bff
MD5 2839c3c3e6ab11f2e6e762f74ddf39ab
SHA1 281e9527229b53e3fe58ba3d77e3729c33368aa8
SHA512 3dc64074f50fefb37126334868b091b176881fe1fc5db1e211f59f1a62e6f8ff54cc8429e7dbdd683aa7988602625d3ab8857edf5c2cdf41cfc1d859f1214e9c
SSDEEP 12288:2bJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:2bJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1B2D423BEA9F1D1F1F26DC0BAD60B09F3D32C24348F541EE9665004AE197676EB648738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 cc3515efb8b2a383f63ed5df62eb24212ffe7c6bb6bb17137be6bd4e674d2edb
MD5 6fac5b2069c29d4427f50d1bd0f51ef3
SHA1 fd6d69b23f46537e4c025bc2cad6b1f9668a9b7b
SHA512 94badb158a715a989883e014066ed7c1df4a715f83ccce0e6bc1c1850be91c1c27bd47f89eda54327701c77b8313b427c172003a78aecc2a2029382038d1a3c2
SSDEEP 12288:1JPz5L8qJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:TzyqJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1B1F4025B77F160F5E17AC179C9560A62F33574314B208FAF176006BB1E237A5AE2AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 863KB
SHA256 babc02d8bd807ee11a1a7f54645e06bd286449d462922cf671705e74ad3e7bd5
MD5 4228f19063463f67665c3995c511268b
SHA1 e935eb262278b07c1693f0dae4c25e3e772ea1fd
SHA512 fc58d3b7138efcb1fc7fd19642656bf95294d121ce02e70b49a4e4f538765ace80bee9a6714d2a373c9f4600713081c100575dff4ac0d552e081e0cc20626059
SSDEEP 24576:KTaaL93z0z+24JdlXbKL8fHz0/LPRRPUoIyke9b:KTBL9ja4Jz+gf4/LPRxBke1
TLSH
T1461502A9B3A054F4ED67C13EC9164922D2B27C390B60CB5F13A4366B1F333615D2DB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 153aefe2329fe11acd5d3c96357a8d06b6dbb4ff852757fbeb7de15d137f0474
MD5 871b166d762c737b1cced3331ab7bb2d
SHA1 7d934b1aee5e18c9270af74c57f622835bfc8cb2
SHA512 8f14f258a72b9cbdf3cd0d1df9e189d3689a573cff0b11f670c21bd21d4a378dee0ea0e884c35857cd09130ab60477199464ce4c169db0c0daa6e779509b0284
SSDEEP 24576:f3Ad/CAmy7mZ3JdlXbKL8fHz0/LPRRPUoIyke9b:vAd/CAmyKFJz+gf4/LPRxBke1
TLSH
T13535CF90F3E410E4F1B7CA75C9664522DA767C695B20DE8F03A4255A1F33BE19E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 a884165f4face6057fba6f97a3d7dad194ddc121a839daa162aac7bb4014dc66
MD5 2385f8a0589259275ed3fd2829217d90
SHA1 125aaecc49954f19d3a8e49db2e07038fde5c20e
SHA512 8cedef847cda4bf8fd747fade0beff4e9e8b49f4e830affa186f405a5a3ea66cd0034ced7e60692d2e6578f83ae6857422e01cadb7cd9f3d048acfad86ba5cd8
SSDEEP 12288:uUJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:uUJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T15ED423BE99F2D1F1F25DC0BAD60B09F3D22C20348F541EF9665014AE197676EBA48738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 01c0bdcc8274d253b81e33abb98d1a88c0295adbacf795286089b0d605880464
MD5 a8c0392f1ab86d7047e016cf175f93ae
SHA1 f228b53946ac0a4e17b4a1c40d71b32f0284a766
SHA512 ae0561fcd1dae8dd60657f3fbb2aa7200635cbfcd799f2a44a838fcaecc45ac36d64cf611a6bd717c69085f4e235c77d6777e5ba4a0f5b1a42cb018beb95af9d
SSDEEP 12288:2WJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:2WJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T10CD4237E9AF1D1F1F26DC0FAD60B09B3D32C24348F541EE9665004AA197676EBA44738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 4f9e8c76e00c3eeebf5c46e73b2938e3de0cc5cafdf4836b8855164f2b027f4c
MD5 c2f20bbd80cf8be2210173ce21a63a24
SHA1 6cd141e37211ab9797db02b48cf46a9bbebdebd4
SHA512 ba8fa9a222dab0c8bece574a8138bb9fc142e6ee67abe72b4f24dacda53cc9009f94c4ef7c6600c1ad27c3549fb59345979b8a796d2ae998640899c468d78802
SSDEEP 12288:fcJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:fcJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T109D423BEA9F2D1F1F25DC0BAD60B09F3D22C20358F541EED665004AE197676EB648738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 c976c6c72a10186b1b63553c847856c9a9a3e21ff360d71613679b1435322af1
MD5 7a64684ff17a4418cd973e5eea9be629
SHA1 bac2ddf4206db90913d47d67191abf444d06d216
SHA512 09ec4bbc734b96a0f0b4b95a977bab722b16dc087e016149f1c70c331511026eaff7e80f24bc71a16ab40ea177b964340e20bc9b0503e02664f145d42dc36da5
SSDEEP 12288:gxJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:gxJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T19ED423BE99F2D1F1F25DC0BAD60B09F3D32C24348F541EE96A5004AE197676EB648738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 ab3a67e6400a0abf6ca1655a4daef144f119e58ba689699818b86893c09b5c5e
MD5 3a343b5e71d4310ebea9c0383f201a2f
SHA1 63e55e4763c35ed6fcd311b89f8051fda71f7098
SHA512 1d38d3a6b805364bc272eceaf7c390cd1238f63d1c829ee4a9e0aa4c24f36b8f17ecf0316b2f27496ecc6b8667c7e9126ed94032000325f86a13da842abe110c
SSDEEP 12288:qTsfiJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:diJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T13DF4F15AD2A481E4D16E9179C7060AA1F3373C348BE097DA63C0F47E0F76694ADE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 cfceed02b827c317e874f77ec1d2a5e4c1edb4794c9a3bd956dfc3db07027ba1
MD5 36fb4b204f680329ddc6bf6a4fc86715
SHA1 0caee6e608ec75d66393342f804a06829b4c2236
SHA512 491b11ab83efde442f6df4354051ae555b7370c8c589a0e243e8b56dc3e1bb1140f595a675e366fad96886c1f2c37752e513758dae89f29193aaad260447c7c6
SSDEEP 12288:KI7KJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:fKJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T10FD4227A96F1D0F1F2BDC0B9D60F0572E22C30348F545AEBB64014AE19727A9FE64729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ba3d84d9a076db8170b60563bc2a8762ed938fc8476c2b8aa706d39a0c7a8eda
MD5 8ab9346542e7961f4056ba0cc6c25279
SHA1 366b7c77506f86047c0d9d0feca955a6f8bbf071
SHA512 b948eb889040955dcc070826d514682017bbc40edc1acaa7d632e0992c9998eaec8122c1724ade6bf6266b6e3934fc3319f4faaae8881c52604ccbaccb498d70
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYOJdlXbKL8fHz0/LPRRPUoIyke9b:Qgb4mBIBhGFBJz+gf4/LPRxBke1
TLSH
T16A65AE1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1251427D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 fa5373d3ec0f2f7ad6dea6bc32c5e7548552781f4b5f872d325e400ab1ef06e6
MD5 fcf63a0f7b2aaaefdbac85d4671bce65
SHA1 31cb23fb92ccce6928aadfdec38b5e0abc5b9729
SHA512 24a45eab8059d227bb9c01abd20fc1c8112f03a74d993c4915661ccad5b2a4d842b15268f39317d6d33da7c320b69ca3acfc1e8c5dc1c8ae2605c9c6fb95fa76
SSDEEP 12288:PXG4JorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:/G4JdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T140E4127E65F2E0F0D27EC1B9D51A05B3F23430708F141AFF599094BA4A667E9B638E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d1bd4de5c1e3cea0352ce6b28073853800d38e0ae2b9817c634fb7f524a341a2
MD5 ba08fbb32b68b283ccae2f1b0d8fccf3
SHA1 a24ec636a0e72d553705cdcdfcd0f92b32d09321
SHA512 2612198fbaf2d84257553d31bb6f139593e8e8023b0eeb497ac8573d3e0453b05ee9796341ec8fe8987f05d7ea9731980e83d0b8b68336f6e3046c5904225612
SSDEEP 12288:dNJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:dNJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1A3D423AA96F1D1F1E2ADC0B9D60B09B3D31820348F541FFB655014AB09767EEBA78734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a9a7a2cf8e9d36b61a63521f225f77aff0d7136885fe33b6fe8d330426da1f89
MD5 eb1eb2d8ed4319222ac12431d779f523
SHA1 0127f25a13f10f266ba3a22a350d89bc1ec2d646
SHA512 5864836fa67a43abf97322651767de5df8db8b1b2010fbfa37b1c53dca3c86338a46c078f158065d96f82ee5ebf0d6791eeb4de46c80320c9082d05aacc83bf6
SSDEEP 24576:5P58W8FjJqH1Mzria7/m3JdlXbKL8fHz0/LPRRPUoIyke9b:1+BFVqVra7/UJz+gf4/LPRxBke1
TLSH
T17335F16566E101F0D07BD038CA4646B3F6B1B4250364EFEF07A88A561F23BE55B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 d31a5e2084bc5f7167e87faea8bac76fae154025435562c466a041dfd639284f
MD5 58e5404b70bf3e9bf53addd98c3a11d2
SHA1 5a333fb680e511a74b8773598ce589380a55129e
SHA512 3ca5642a752e987379d03f7f0421f5d290afbf1f104925c4f0f2f9d19d78e12ebe347e35daa1f832ac2044a0cc059875f9fb4b3d949800c4480ffcc0519cdd92
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDJz+gf4/LPRxBke1:FG05lO43b+JqgQ/LPRke1
TLSH
T1E7D5CF6E62FC11F5D1BBC17CDA864A0BEBB23425032556CF02A486A91F27FF4A57E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 96bc6c7383c90b49514658245f990f5bebfaae3ecc291f015e5976a12ab38b71
MD5 cdca10723de5364f2b348c156c54461a
SHA1 224482c57227ad902fabbc7ffd2afe4b2d6d85d5
SHA512 6ad0e04c6a00c7d3a9b33fab847c4e34ffc03aeb09608ebd8881e94ab2ba188283cde70356282bcf729240bd1c21d08e3fbaf6a446e7a43cbb4d07c4cbc38763
SSDEEP 24576:Tda5POZ3dpbWVM50JicR2hG0lasx2+47eidnoJdlXbKL8fHz0/LPRRPUoIyke9b:xa5POZ3wJt2pasx2+m2Jz+gf4/LPRxBf
TLSH
T1CD65BF5EA6F801D5E1B9D17DC5834A1AF5B1342153319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4b3e7e0b983b5ae035a2b4385afc7b509e4377745a5a34b5631fa7e2b2624012
MD5 972defbec39c5eeffdaa58d1ad7d229d
SHA1 eca8da81828eccb56d61b4c186ec627c2f040390
SHA512 0ae8ddafab4b6017eb8091347eb4ab8b5dad978add9c8a6d1cd731a56ca48251718c84b660baaf136a28628835c4d0bf839fbbdc720a63d86e1b8d8f0a62fa9c
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkKJdlXbKL8fHz0/LPRRPUoIyke9b:tNc/zEOVHF1Jz+gf4/LPRxBke1
TLSH
T11B858C2623E901E4F1BBE1BE89679546FA71786557308ACF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 189a7bd28b22131bcee30c358dfbd60b7f6adb902c0d437703d63304e332cb67
MD5 cbb8620eae950ae4e3f1b4544ef7287d
SHA1 212643202193fdf8a9b35737c7c3dfda7a47542b
SHA512 35cb275d59911fc9e5e0f73d1dadded0560f10c64bdbc2185dac7a7e14c3d4628584f4e67b85703c1688d4a18b422d07dd0210e2b5aea20711ec2ca240905f69
SSDEEP 24576:7JnJPbzB4S4JdlXbKL8fHz0/LPRRPUoIyke9b:7JnJv6S4Jz+gf4/LPRxBke1
TLSH
T1F515CF3DD2A810E4E4B7C2B4811A1A66FE31347C2F2569DB59B4D4353F12FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 46765f907d4dbf21739d55b09ddd350c14c15d7e3fcddb55acc28196204ad89a
MD5 da16c890254b2b9f99d513b1e37fe6ad
SHA1 a02d8418c0e983fd98e4d0844ea79d48415fde61
SHA512 b20ab1276ba8f6a51d8e79f42467982f0fba79512471c1898190e371ce6d52023293a163cb1d7d6c158f6de15dbf6452063bc6d59d5198617a1887581521c1cc
SSDEEP 49152:0CLHGeeV5ijCmlDWDkeJz+gf4/LPRxBke1:PUJqgQ/LPRke1
TLSH
T13CA56B05E7EB4184F8F3CAF5CA2694169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 aeaba79bb442330b506b8373800fec571eed39d480859d0bf877e765ef34f06e
MD5 6384ce30b0b405c4679ff6c614d3d492
SHA1 1957b25b20ec1304e794d0d5b23b5551886b8a93
SHA512 0103908bce25abb6fb4ba4fce4269be5ed7f2fec1a57059d56cf3216f407358f84dd3da7b0ce61e150dc5a246b3dfccb3d5fdc0f5d95792fbda78438af318ac2
SSDEEP 12288:P1Hck6j5ZI7QJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgA:L6DIkJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T1C9F4F16D63B650F5E16BD07EC6830562D2B270708B511AEF0A9484BE4EA3EDCB93CF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 82bed5cee000faa985c5fa9db3e8c167c137b817d3257e463fbb25278ac705b8
MD5 fb39ec8710c9844d6fd83820969fb2f3
SHA1 21cb0de222cf7275a141d114d31bf8d39b418f20
SHA512 07964bb3a95644e24193813ac61a6f651fd3edd3e820ac67d891885754d40b6f4564f55fd5db4147869ff74858dc2471eeac944b3bc921840182813419a9f7e9
SSDEEP 12288:NG6kywUJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:0tywUJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T18DF4125963F0E0E0E2B9C178DA1741B1DB3878308F105BEF6690A57E1E327E9B934B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 7a686a210d3d8b31e6e00607ab6da43c7d55ef1cf86e530f1d89af977d72164b
MD5 b444ce06520331f51540f1b9ade2dfff
SHA1 f80c250e4e247fac46d32d23da4f1d1306840653
SHA512 1690e742fee07ada1ec70a9b319bc0132b2a0bf0d047cc4cf1182bfc954b9894f993fc38d6ae2eebbf5aaddbdd52428fa523ebada39c9d93444da82af6964144
SSDEEP 12288:yqGJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K9b:TGJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T141D4237D96F1E1F1E269C4B9D20B09B3D22830344F541EFF659054BA0A767EABA34F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 6d18d635ec3dfcf83c562f78307dce6a7083ea636c21f4443d03e3372375ce3e
MD5 92436c4ed8a99d011584f9bc45861299
SHA1 2ca51a777b482e1cd3d3e740addacd595066ae17
SHA512 f1e1d92efb3b255c72528c15e25de294b8feb28de903ca9f473a69b9bc2c82ed725a2df374bfc9b9e9223bb0877f9198ca76c0dd8f9676ba48877a7b5f712444
SSDEEP 24576:XegILoTfaidZZQJdlXbKL8fHz0/LPRRPUoIyke9b:OgHTrZZQJz+gf4/LPRxBke1
TLSH
T135559D1DA7FA05DAE2B2D279D8221493D633B4315771C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 1d6c496754db2212a9f1c4e413091a87829f06eb53e10601db7330525bd791e9
MD5 bc84aa78556914ab0466c1fd758bad04
SHA1 8a3285b1966a2719ee48ea6bbf27e7415a5913b1
SHA512 f03188e6c859cf35e505019b534e80d21608c301f376d24920a7e94612c2d5ee1173d177519dc12881fc00b97e869f8bcfcfc8affcee0c5a19a113a93121e4ff
SSDEEP 12288:ypJcm8CNWJorL9+lLpXbK5Wm/8DKK4wkPUhVz0Q1d6LAE1RlqEPUo8rCigrgZ7K1:yrcmRWJdlXbKL8fHz0/LPRRPUoIyke9b
TLSH
T15905F15EB2BA40F1E1BBC17CC9460562E27370305B116BDF42A1867E4E67AEDBD38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9ca10fa53bf9fffe9c4a398ab0b4d4308ef3ccb62124d26f6e662fe7badd7de2
MD5 bbe0ad3cce0e0ef8d17c33af2d78d69b
SHA1 b99c7353c9b323ef9ab095f6956c239b37731249
SHA512 b5fdbf85de7d50d4ae78094e34884e20af2dd53b28a2d350466fc9d5b8c8ed1108236e7c09fce4fc7b7ce658b5a606e1d8fdf62869a0b2a9680fbc8ee24ca058
SSDEEP 49152:JDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3UJz+gf4/LPRxBke1:a3Upow8sB5JqgQ/LPRke1
TLSH
T190A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 79e48e50d2a732bf3a81a718f92eed7928a32092c8d4cd2ad50ea4cad7182a18
MD5 a57485349bfba6d43b944fabe619ec73
SHA1 66b4ab267dee738c4a57e79123754a85f7879f18
SHA512 2de1a687334086f7f11a861f912279b851b6e322877c4513ce342fb21827b80f5f7f94e27e4e4073c4654ca1ac722c4929f8befcbdaab3402566375a6778b28c
SSDEEP 24576:PPUr+NQnJdlXbKL8fHz0/LPRRPUoIyke9b:PJQnJz+gf4/LPRxBke1
TLSH
T19E05E12F66F818E5E67AE17DC6464629E3717472071196DF02E0817E0E63EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-354-0x00007FF6302F0000-0x00007FF630439000-memory.dmp

Download

memory/296-267-0x00007FF6302F0000-0x00007FF630439000-memory.dmp

Download

memory/296-269-0x000001B9B4040000-0x000001B9B40A6000-memory.dmp

Download

memory/296-270-0x000001B9B4040000-0x000001B9B40A6000-memory.dmp

Download

memory/1620-247-0x00007FF6BC910000-0x00007FF6BC9D8000-memory.dmp

Download

memory/1620-249-0x0000023CDCC60000-0x0000023CDCCC6000-memory.dmp

Download

memory/1620-248-0x0000023CDCC60000-0x0000023CDCCC6000-memory.dmp

Download

memory/1620-333-0x00007FF6BC910000-0x00007FF6BC9D8000-memory.dmp

Download

memory/1820-63-0x00000231BBCB0000-0x00000231BBD16000-memory.dmp

Download

memory/1820-61-0x00000231BBA50000-0x00000231BBB52000-memory.dmp

Download

memory/1820-62-0x00000231BBCB0000-0x00000231BBD16000-memory.dmp

Download

memory/2108-450-0x00007FF748550000-0x00007FF7486E4000-memory.dmp

Download

memory/2108-334-0x0000029BD24E0000-0x0000029BD2546000-memory.dmp

Download

memory/2108-335-0x0000029BD24E0000-0x0000029BD2546000-memory.dmp

Download

memory/2108-339-0x00007FF748550000-0x00007FF7486E4000-memory.dmp

Download

memory/3048-327-0x00007FF67CF20000-0x00007FF67D1C3000-memory.dmp

Download

memory/3048-449-0x00007FF67CF20000-0x00007FF67D1C3000-memory.dmp

Download

memory/3048-325-0x000001DD8F990000-0x000001DD8F9F6000-memory.dmp

Download

memory/3048-326-0x000001DD8F990000-0x000001DD8F9F6000-memory.dmp

Download

memory/3116-32-0x0000018BD6CE0000-0x0000018BD6D46000-memory.dmp

Download

memory/3116-33-0x0000018BD6CE0000-0x0000018BD6D46000-memory.dmp

Download

memory/3116-34-0x0000018BD6CE0000-0x0000018BD6D46000-memory.dmp

Download

memory/3116-31-0x0000018BD6AE0000-0x0000018BD6BE2000-memory.dmp

Download

memory/3336-345-0x000002896CFA0000-0x000002896D006000-memory.dmp

Download

memory/3336-350-0x000002896CFA0000-0x000002896D006000-memory.dmp

Download

memory/3336-343-0x00007FF6F6010000-0x00007FF6F6330000-memory.dmp

Download

memory/3336-351-0x00007FF6F6010000-0x00007FF6F6330000-memory.dmp

Download

memory/3336-344-0x000002896CFA0000-0x000002896D006000-memory.dmp

Download

memory/3488-445-0x00007FF7F7BE0000-0x00007FF7F7C93000-memory.dmp

Download

memory/3488-316-0x0000021B8EC90000-0x0000021B8ECF6000-memory.dmp

Download

memory/3488-315-0x00007FF7F7BE0000-0x00007FF7F7C93000-memory.dmp

Download

memory/3488-317-0x0000021B8EC90000-0x0000021B8ECF6000-memory.dmp

Download

memory/3984-43-0x0000011E9E990000-0x0000011E9E9F6000-memory.dmp

Download

memory/3984-41-0x0000011E9E990000-0x0000011E9E9F6000-memory.dmp

Download

memory/3984-42-0x0000011E9E990000-0x0000011E9E9F6000-memory.dmp

Download

memory/3984-40-0x0000011E9E760000-0x0000011E9E862000-memory.dmp

Download

memory/3996-383-0x00007FF79FA20000-0x00007FF79FB4E000-memory.dmp

Download

memory/3996-385-0x000002C9631C0000-0x000002C963226000-memory.dmp

Download

memory/3996-384-0x000002C9631C0000-0x000002C963226000-memory.dmp

Download

memory/3996-454-0x00007FF79FA20000-0x00007FF79FB4E000-memory.dmp

Download

memory/4332-50-0x000002C078280000-0x000002C0782E6000-memory.dmp

Download

memory/4332-51-0x000002C078280000-0x000002C0782E6000-memory.dmp

Download

memory/4332-56-0x000002C078280000-0x000002C0782E6000-memory.dmp

Download

memory/4332-58-0x00007FF6849C0000-0x00007FF684B28000-memory.dmp

Download

memory/4332-49-0x00007FF6849C0000-0x00007FF684B28000-memory.dmp

Download

memory/4708-255-0x00007FF6C7250000-0x00007FF6C7369000-memory.dmp

Download

memory/4708-342-0x00007FF6C7250000-0x00007FF6C7369000-memory.dmp

Download

memory/4708-256-0x00000208C44E0000-0x00000208C4546000-memory.dmp

Download

memory/4708-257-0x00000208C44E0000-0x00000208C4546000-memory.dmp

Download

memory/4784-290-0x000001A684F80000-0x000001A684FE6000-memory.dmp

Download

memory/4784-289-0x00007FF690F50000-0x00007FF691693000-memory.dmp

Download

memory/4784-378-0x00007FF690F50000-0x00007FF691693000-memory.dmp

Download

memory/4784-288-0x000001A684F80000-0x000001A684FE6000-memory.dmp

Download

memory/5020-452-0x00007FF689C80000-0x00007FF68A150000-memory.dmp

Download

memory/5020-364-0x0000021616A10000-0x0000021616A76000-memory.dmp

Download

memory/5020-365-0x0000021616A10000-0x0000021616A76000-memory.dmp

Download

memory/5020-369-0x00007FF689C80000-0x00007FF68A150000-memory.dmp

Download

memory/5108-0-0x0000000000230000-0x000000000040D000-memory.dmp

Download

memory/5108-6-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/5108-1-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/5108-7-0x0000000002990000-0x00000000029F9000-memory.dmp

Download

memory/5108-28-0x0000000000230000-0x000000000040D000-memory.dmp

Download

memory/5404-360-0x00007FF62A920000-0x00007FF62ABAA000-memory.dmp

Download

memory/5404-355-0x000001B25B910000-0x000001B25B976000-memory.dmp

Download

memory/5404-356-0x000001B25B910000-0x000001B25B976000-memory.dmp

Download

memory/5404-451-0x00007FF62A920000-0x00007FF62ABAA000-memory.dmp

Download

memory/5620-239-0x0000026A35130000-0x0000026A35196000-memory.dmp

Download

memory/5620-238-0x00007FF6BC910000-0x00007FF6BC9D8000-memory.dmp

Download

memory/5620-324-0x00007FF6BC910000-0x00007FF6BC9D8000-memory.dmp

Download

memory/5620-240-0x0000026A35130000-0x0000026A35196000-memory.dmp

Download

memory/5692-307-0x000001CCF05B0000-0x000001CCF0616000-memory.dmp

Download

memory/5692-448-0x00007FF620690000-0x00007FF620AA6000-memory.dmp

Download

memory/5692-446-0x000001CCF05B0000-0x000001CCF0616000-memory.dmp

Download

memory/5692-392-0x00007FF620690000-0x00007FF620AA6000-memory.dmp

Download

memory/5692-306-0x00007FF620690000-0x00007FF620AA6000-memory.dmp

Download

memory/5692-305-0x000001CCF05B0000-0x000001CCF0616000-memory.dmp

Download

memory/5816-67-0x00007FF7DA6F0000-0x00007FF7DA812000-memory.dmp

Download

memory/5816-15-0x00007FF7DA6F0000-0x00007FF7DA812000-memory.dmp

Download

memory/5816-18-0x0000019AA8DB0000-0x0000019AA8E16000-memory.dmp

Download

memory/5816-16-0x0000019AA8DB0000-0x0000019AA8E16000-memory.dmp

Download

memory/5932-372-0x00007FF77B690000-0x00007FF77BB96000-memory.dmp

Download

memory/5932-374-0x000001B4CF4A0000-0x000001B4CF506000-memory.dmp

Download

memory/5932-373-0x000001B4CF4A0000-0x000001B4CF506000-memory.dmp

Download

memory/5932-453-0x00007FF77B690000-0x00007FF77BB96000-memory.dmp

Download

memory/6020-297-0x0000014166850000-0x00000141668B6000-memory.dmp

Download

memory/6020-298-0x0000014166850000-0x00000141668B6000-memory.dmp

Download

memory/6020-296-0x00007FF72DC20000-0x00007FF72DCCD000-memory.dmp

Download

memory/6020-382-0x00007FF72DC20000-0x00007FF72DCCD000-memory.dmp

Download

memory/6040-282-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/6040-276-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6040-277-0x00000000008B0000-0x0000000000919000-memory.dmp

Download

memory/6040-363-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6048-393-0x000001B1BE790000-0x000001B1BE7F6000-memory.dmp

Download

memory/6048-394-0x000001B1BE790000-0x000001B1BE7F6000-memory.dmp

Download

memory/6048-395-0x00007FF72BEF0000-0x00007FF72C22E000-memory.dmp

Download

memory/6048-455-0x00007FF72BEF0000-0x00007FF72C22E000-memory.dmp

Download