783dacae87545469617676bbf3053f0363b8071fe96c7b42ea4e811d47c668b3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample261002-3kl12svfpc
SHA256 783dacae87545469617676bbf3053f0363b8071fe96c7b42ea4e811d47c668b3
MD5 e869c3e02f342ee2b1f8158f20401182
SHA1 ad120f0e22ef04be79edbe6f802c29aadd8e6acb
SHA512 d3dab5ee294ee445cec5cda4238d8cad606ec993ca5819b77d2f8b10fd1b083c44daae13b0887a3c60b6e9303c3b187e679e0009f72b500ce6bfb1b6bf085712
SSDEEP 24576:R49H6vNwaWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:R4p6vNwrKNcd3GGJlic10x
TLSH
T15935BF0277F9A134F2F32B31AEB952555ABBBC629D35C60F2394190D0DB0980EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4952	alg.exe
3656	elevation_service.exe
2812	elevation_service.exe
3768	maintenanceservice.exe
3004	OSE.EXE
4784	GameInputSvc.exe
1180	GameInputSvc.exe
4816	msdtc.exe
5396	PerceptionSimulationService.exe
5752	perfhost.exe
5304	ReFsDedupSvc.exe
124	locator.exe
2612	SensorDataService.exe
4980	snmptrap.exe
1716	ssh-agent.exe
3756	TieringEngineService.exe
4144	AgentService.exe
3336	vds.exe
3324	vssvc.exe
1252	wbengine.exe
3540	WmiApSrv.exe
4792	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	alg.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ba47e3424b315ee3.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1180	GameInputSvc.exe
1180	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	820	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	4952	alg.exe
Token: SeDebugPrivilege	4952	alg.exe
Token: SeTakeOwnershipPrivilege	3656	elevation_service.exe
Token: SeTcbPrivilege	4784	GameInputSvc.exe
Token: SeBackupPrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5304	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5304	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3756	TieringEngineService.exe
Token: SeManageVolumePrivilege	3756	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4144	AgentService.exe
Token: SeBackupPrivilege	3324	vssvc.exe
Token: SeRestorePrivilege	3324	vssvc.exe
Token: SeAuditPrivilege	3324	vssvc.exe
Token: SeBackupPrivilege	1252	wbengine.exe
Token: SeRestorePrivilege	1252	wbengine.exe
Token: SeSecurityPrivilege	1252	wbengine.exe
Token: 33	4792	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4792	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4792	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
820	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
820	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
820	2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1180	4784	GameInputSvc.exe	97
PID 4792 wrote to memory of 5980	4792	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_e869c3e02f342ee2b1f8158f20401182_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:820

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2812

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3004

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1180

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4816

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5752

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:124

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2612

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4980

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1716

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3756

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:3540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f08bb5f02cd83ae7123bb831e71d4ea780d96e80dac9c5f09b566e0a4130611
MD5 bf12e9e4bb1fdd0f25f0a2175d262705
SHA1 076db50a3e1f91ce088191d0d5a58c1131189f36
SHA512 da69981e8ea0918b020e05a5d41d40296e2a9431a1c5f16bacaa9f4280bc703261d9873c0e87d80f47fcc55b82317e1c629911cca70012a4e564d890ea230227
SSDEEP 49152:ib+632BuPkFKRrdE6oh7stBhuXjfS4LWxneKNcd3GGJlic10x:E3q6gjBlY82Kic1K
TLSH
T139D59D03F29900E9E06ED178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 c15da1c6c825a145ccd6914a8b9705c733436085f9ef4ca8acb21ca0263ba55c
MD5 549bf95e23c0c32ba59495b9f21467bc
SHA1 6c89e1af010469901a3abab4b41da70af7e7ed72
SHA512 cad2fb2e5ed20c5eb74f4a788790e2ecfb00a156f67816c448de5814d808efc4d6f28110be29d9c9b973542e8f5e25e02c78747031932c1bf7fee206ecf5ff21
SSDEEP 24576:NXYdJ9czA1WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:g9cJKNcd3GGJlic10x
TLSH
T17505022827E449FDED6B813CCCA28502EA73B8554360EB9B03B4D9650F633D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 47dd9882f0092fc8ea123e1203f7efd796b3c6ed8b585e020a84180d79a084d4
MD5 3bf267324b0ccf0d5fedff2ccdf0c2f5
SHA1 f566fc95235786cb95a88e945bebd4e0991115d9
SHA512 739d85ca1e12ccec692dd81bdebb4843c1cf3ed106ebf942367c90b0fe86a47166f0e94521df22434c937a73be2ef3705cece00f90fef31b500a2bfd067f789b
SSDEEP 24576:z03ed2X0hDiOrM1WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:zL2X05fZKNcd3GGJlic10x
TLSH
T1AF45AE26F6788335D073C0B9C5D2A68EED72308657308ACB4295D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8647e32753de784b287fc35010116d25d4566af00b8c6a1400d67b140bb7821b
MD5 1e67a49ad085f0baa8882b15c1b11dd8
SHA1 d54886bceb58531a4053c1687e0ad73e7a40c620
SHA512 e8935ed8c67ec3d0fe75ad9296321990b8a309261905303f1f3bf858c327a8759b833e6d240ac2545bbcb6fe93d66c46379bda3ed035c6efa7b3fc9b4f3360a3
SSDEEP 24576:BeD/ezSC6vUyD/aqgrvW/6q8wyulWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:o/ezSC6vUzPvuHjyfKNcd3GGJlic10x
TLSH
T187756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 21f7e6404780c6d2a6f3de807ace708ef737c847bf1be9c83a7e8f6eefe75b55
MD5 dadfe831ca25436851972f6afdebd0f1
SHA1 56976c1a0de0bb4ead7f344863d0cefbfba4877d
SHA512 735cbb0d6b86437d4f3d31c977000645f9aca2ca816152c1522192e34ce819f98a138f8fa3751817097cedc0ad1596adbbc758ed0e8e2874942488e8e6c30a67
SSDEEP 24576:Jab9PyWBR2fC+dBWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:JaMWBR6C+SKNcd3GGJlic10x
TLSH
T190559F66F674C335D073C0BAC4D2AA9AEE32344257318ACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 52dc1d7ea87520dc85b85e26bcdd94271faba29ae28977d3fce5fded85aa0d35
MD5 63e8e2b2ae4ccd4cf28c836998f4adc7
SHA1 97047596a0e80eb5a2df59895bb2db8d49e5982c
SHA512 b2dde70f1408b3db15dfde34b0b480db958b9ccc7a833e1ff322e2c43d4a85154d54171c828a6e79cbf16bd5595aab42d49b826a6251ae82090ec48c7c23adf8
SSDEEP 12288:Ab9DJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:Ab9jWfiNmsILdbhVGZGJfNic1VF2PdIx
TLSH
T1D8D423210F3DE37DF79DA079BCAD170B2993B82660216CF18428E5994DF04D8FA7E951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 2e9d7dcf2e3c3c14bb751dc4c3ffe5421d4827d273ab22a412834f4338dff957
MD5 3ca2f87bbaf24184f37ee94311ec43b9
SHA1 7d1a8099daba173dce6635be32c8df159f2878af
SHA512 d13bd4becce98860cebfe0bf0722eae76dbdea39d68195348c4de13adb2f51369474b2a6d731345a537701c8ee8030622dbcb6735be2d1b5d248a2572f187078
SSDEEP 24576:UJIUNWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:UJIUsKNcd3GGJlic10x
TLSH
T18315C03BAE38FCE2C27E98795A918700A77274314B61A7CBD174C24ECE235E45E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5fd569a910c65d9e3234e89ed1483f2d8a5ddb4464180f7be3ad26cadf3e2cf5
MD5 179e6efba77eb6c1c58b07175e45b452
SHA1 bd07252c473f4f941139a4de7e2ab84a8e412072
SHA512 af49c69b844c63003bad7add225d51c11a49513fe4b3f19cbf977142b40147f513b44b39623584980351870ac62753a9cec2f0870f58389c907c52b8f6f0f435
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5JxNRV3THT:nQvGAdlCEL8c/bRN15CbY82Kic1K
TLSH
T154367D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 5d95fe35874ee321399e91ca88e41236eb82a90b7296841d447685be5ae9513e
MD5 5fd790b11e8990b5c1b86804159feb75
SHA1 b35d83c8c211fdadd31462eaec94bb42d5495de2
SHA512 1d66afcb52bde3aa1ee177b6ffb790dda265b07b08290d1a02f43869a6cbdc19a750c2c9de216f7a6b3daec0051f1ef6a8cfb7a171067ca42570f9c9faad2dfd
SSDEEP 24576:jmewsAj2WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:alj/KNcd3GGJlic10x
TLSH
T13A15E031FF74E036D7BF0DB62B26C706146DB9204B6119C3E3A88A9D49702D2677AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4f1be64851c972742ed41c25214836d1c1afa5ce545c57633a18cd36e850ee91
MD5 f8b10d624c2b588b1ce16127df148220
SHA1 87b4889f22dccb869442a6c5381658cfcd2b4919
SHA512 911273b6a5113688a5a38a7fdd4cdb426492b502a8651fa9cb3220fe5593b1c906e2ffa876b9100789b379976d8efbd0b0e6473fbf8361e76d1638b8fa90604a
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHz2Kic1K:lUEtQevvqc2W1cpV2XF32liQ
TLSH
T1C1474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c3c44434df9a5963df99c3cc44c8d0ca00c1e2d3fed011c0cfb00d2a04584f59
MD5 deca65ab3f622765c2c9e80ed212c269
SHA1 05fc912d81903a13706793931d0a9b2a365a9672
SHA512 d08b562e010d3bd762976eda13c237a705f6d68d6271fb3b672e37e28e910719e1e7df5cbe3d1dd80c577381fb7638e54ac82e7749b64833169c7d190dd56883
SSDEEP 49152:G0bRquA/m2yL5zMfFiV+XenmE3/zTKNcd3GGJlic10x:5oq1VjnmoY82Kic1K
TLSH
T172D58D1976B8C2E4D1F6C37886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f0a9c9fb008cc6c80776f49ff145a7ae05f92c48f5555b7bb39a1eba4894845e
MD5 35123616b2175bc52dcf757b902b587a
SHA1 1d506bb1defff36a11372748127eeac8f312e0c6
SHA512 b8025ea2bfaa10b787af939f412c68a2aa8b5eb29ce91af8e4740bb979531c6a6a1f6e1e4eb16a028e8f9a022ba8bd2d0623b760af1cf5dfe8984391733eee3b
SSDEEP 24576:RAhGLvOFoiwtA5l7S53zWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:RAM6Foiq5KKNcd3GGJlic10x
TLSH
T11145AD81EBF955D4F5B7AA78A9B68171EA76BCA65E31C20F1160C11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 1df7ce11635617ec56b1508e07861f6d700413f36e852f43e09e6ce43dcc0848
MD5 2491f6be22f748912ac866a77db621c8
SHA1 af5b0e187a4785dbcbf4a71beda86a7599196cb2
SHA512 4e6cc0b3b4efb09f026f8c5ab4397490e2ed3d032958838049146aee182d3e0ac7d0adc4e2b340d47ca897118565a652586983a61087502560d03c0e1cb2b09b
SSDEEP 24576:uwuuOWcWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:uwVOOKNcd3GGJlic10x
TLSH
T1D405014627A85CFDE9AB913885978136F7F3B8122621DB1F0360C65B5F73261BD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 0f7861627655a9f3f4952bf07f09f87be17a5f4928614c4d6c107acb975209b9
MD5 d2c7bc255f2cd1d83e54a28f1b1b41a6
SHA1 22840be6a25d57d9a181ff1ced90231532cf9f69
SHA512 c393234841d18b21118b20698ef705db337ba99beaecc40657034159a540365658f8b30b18cc45332f8bdd973046f1580b112719441970c9fec8a3fd1a2f460c
SSDEEP 12288:QRc1IqnNJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al0:CcuMhWfiNmsILdbhVGZGJfNic1VF2Pd4
TLSH
T115E412561BB8B2FDE2AB903DDCE50606A7B37023233257DF452482990F72AD56E3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1500eaad54b1065b25f596086547ae1c3193a80647483b051e232ea7cc42ee49
MD5 dbbeacedb74f41c3d4e09123487448f0
SHA1 5ba9176952283f8455d25b6b89134ed1b979b38d
SHA512 53f611c1ad58af01592cb9a2cee549132e2bf3d5ebb48a911c996b6ddaf4d50b68910a206f220c9a18f85d8eb91ae71c33873346a7c41c0881cf2203e14871ce
SSDEEP 98304:6QRQyi36YOcP8Lvw2gAf+PN3LY82Kic1K:xQyiKa+X+PNR2Kic1K
TLSH
T1C5667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 dc3cbaa68bbaa76a3de1c7443da059b36e212b99811a0e74d53d2cb077b86f14
MD5 ccadb9f09268eca207ce1e6e9b789d2e
SHA1 1dbebbcd6c1b63caa25aae202f4003dd816e5718
SHA512 6360acbb382e1a39e466c78ed585fec5f6a7ce847a536ba97397185a6837fb0866aeb607634ed45294107703997b312ddec9a6667ac961c3dad6d70a48f791e6
SSDEEP 98304:6QRQyi36YOcP8Lvw2gAf+PN3EY82Kic1K:xQyiKa+X+PNK2Kic1K
TLSH
T176667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bf89e253d54be996a0c7acbe2250949fb707eb476ff1f79f2ab4ad51c2d43825
MD5 b372c2ef74bdbfdc5feb6bf6d808045d
SHA1 e6046bfd601204621d27c555f7dd64c3aa095d49
SHA512 28de26564b6e13e4499216a22a7433e445e6ae8d4dbd7c0bede43fbe831b50d03d54a5891f0695fa44b1df85cc85e59d24f3077700ef34acb4da1feca070c4a4
SSDEEP 49152:a68Qg55nhMeWu7PNU3/1/KNcd3GGJlic10x:IthbRc/lY82Kic1K
TLSH
T14EB55A33B2F600A9C44DE1769F4A872196D27C758FE0E7DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9df1380e9934c4d5edd24492872a0137a0269ba5c4c1c352f0f264dd7efc6bd1
MD5 6b69ebfb4600ebc9be26e6348f565de8
SHA1 cb70f570da1c9a443a9aa393521ee9f7a6f99e3d
SHA512 bd3085ac567a69e9aa85d0712d7e676be85422ed9465565fd30eeb0403dba12a952dd5dcdf0dc4ee7b8ad80aeb2766a8a028331a6385bb853dd1975738868c80
SSDEEP 98304:my5112gYy5azzVv569nLKnhZeY82Kic1K:XLIHAWhe2Kic1K
TLSH
T11E168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 906179df61ade56346bed61c7f82c84a55ab0bbc08d174bac007ed2e4308a5e7
MD5 ef3ea77d981b4242ae150b59d299abf7
SHA1 f439392f9ffd43ba217f885f6c1862500dff2fd8
SHA512 a72c48a8b4310b4447188efe83793c79d3f471f9ae0c544a69e9b788fd03947ffb4403d2b825afcb184d6de23bb2cde9e52807a560d5f4e873357659eaa5d6de
SSDEEP 49152:uD+taZ3usBWOBr4tEGp0bqx0z+n217aau1glIKNcd3GGJlic10x:iu6JmTxd2dIY82Kic1K
TLSH
T1C1D59D13F6DA01E8D05ED078974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ef94e55be410335a40fd12fba43db2151c785b28fa5c7737f82ce2ac5ba731b9
MD5 afd178246b640d27c9b9f5b1b02b1a40
SHA1 b5545c04097107bd474688cec5bcedf92a0caf21
SHA512 d3a2784235309448b9a978763fcb2ead1ef97560bc9586f9c5ab78b95f9a83e5c5fa4ee25d75e485f8b656741362bde09fe337e63c1a116c77e8ab87ddebc047
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xUKNcd3GGJlic10x:cmifPbRZY82Kic1K
TLSH
T1A5B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 151f111f385e2c7eeb4cadd64d51fe750a192b8402f1cf4ed3d43bb70b8de94f
MD5 919c8c07bc1c902b750b184d94690d67
SHA1 3e49ddf8f95e21512dee696022ac7df89575a13d
SHA512 887603f10edfeaa426110101115b71e0124531099967cf95cb07067791ccb671dd8cace8516f737faee2f24412ac4df1c2ca8d0d052d30a01c57020f5040f001
SSDEEP 49152:tSuZQIY0Be2K6RVtOnks6NMHqdKNcd3GGJlic10x:j5dKoi61dY82Kic1K
TLSH
T1B5C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 105487af63312a038753c2f73a9b129d42352f8e9255f2957b94f4231151a400
MD5 31664bf2668c5070d668783b5541b7a0
SHA1 aa3dc9dc4d0441988a2312989a96b5e4790263cf
SHA512 24a73dfb1da48881242094c44f54106aaa75537b1347e231e871186c212b2e7654d018df89b847da7a51c8ebfc834cef5fd8878610cbaf9d1a0ea77961fbad97
SSDEEP 49152:BhRSn8EApI0figTgiDn0AP5wqKNcd3GGJlic10x:oX2iyph7Y82Kic1K
TLSH
T137A5BE13F2D901E8D05ED078C7468632EA62BC160B35BAEF0A50B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 5d411a17721eaaf15b3a13574f1c70ee12c275bc9d51b2db36865bdcf20e6df9
MD5 e905ee19784c8a834a62abc5a9e50a81
SHA1 77cd0a34f638b6b08513b7955c7e53ab2e201f4b
SHA512 ab3bfce243706699d8e81f9b827300a9e2ce9db03bcaac30a00f865c73f0729a0112c4cd78e9d487e082c4d3e742ea3dc4af63d3b968fba83b408651396b32fc
SSDEEP 12288:s4sJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:s4mWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T1ABD423210F7EE37DF65DE079BC99074B3997B06770222CF1C52C90550EE1898AA7EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 d6923b997997eda471643982bd21b4abdb6abace09ce7fe3a32c80cd0c8c8ca6
MD5 af6b0a4af7f0fc8d8eb4b07b6b8f01ef
SHA1 b73059255ef830db7be57a24931c24c118aa4b2a
SHA512 b322e3c5a050d1bf49e02257906fa4e3c7750ee53abbed7ded52528395473d80947e13a58aab9d6e88f98d85142b5d92f590164b6b762e33c54e7bd8e7763542
SSDEEP 12288:q/wJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:q/SWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T185D423210F3EE37DF65DE079BC99034B6993B02770222CF1C52CD0950EE1998BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 23057cfdb2d84ad803f23c3018d09589a14b6773fede38a5b1b4c727657cb14a
MD5 6161be870795c4612168f710a64fac14
SHA1 896fbe4990185f28fbc411643b704e40824b82bf
SHA512 081ea6c6a1d071e2e3bf693e1cccf41be98b552f5955685ee03e51b43bf1c0918567f0fbcbcfb8253d0c8c5747be633122bb6a6f90c8a1cbc27ca94d64751c9b
SSDEEP 12288:kpwJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:kpSWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T17BD423250F3EE37DF65DE079BC99034B6993B06770222CF1C52CD0590EE1998BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 ce26e143eb74e43ab0e4d3b6ed0bf6fe90e366d03ee8dc26c61d4b159697d4b6
MD5 a57618c27bbc27d279e343ca0cd29df8
SHA1 157e31aad6c8d62acc63ef382eda6b5b8b9c5475
SHA512 925f3d476c7b82f3a76979e6adb5c219da4655d489a0c2c83e6640f58c18334f9fcf533501565f449cf479cdab4245732bc62281c8ed9f4fa9f9db773c8f6710
SSDEEP 12288:Ol+pJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:f1WfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T170D423210F7DD3FDE56DE079ECA50307B6B3B46660326EBB852444890EF1698AA3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 ecb387ad3575b04ddfb3797682b22e877da0397f9cea098f12f25716c0475475
MD5 47a62441a256095c45a898ebc09854c4
SHA1 b147d86fd32150f072fff7d3dd75519c007684f1
SHA512 d7c11f17dfec476bcf3c2fdd0884be778f3d4cffa569daa9870a532220cf524512da31551e4236ad22f6592992213cc094616e69943f9f30ec0e95622cbc3182
SSDEEP 12288:TluJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:TlEWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T1D8D423210F7DE37DF65DE079BC99034B6997B06770222CF1C52CD0950EE18A8AA7EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 11fde0824cce8b1a1a4dc76c49479e274c51d09193136ebd195d8091596804cf
MD5 7422e0b28646f7d69798a0d771b5b5a0
SHA1 eed7f51c5876aa6cbb87b4e6081eeda1041d5528
SHA512 d43eaf3dbfe10d6122d1fdb20c7a11ccbfd435eed07479f7789b43acd958237d54df75291c1d666ca6942abc11b02973c044cacc71f6881fe2683ccf578c06c2
SSDEEP 12288:gGJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:gsWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T17FD423220F3EE37DF65DE079BC99034B6597B16B70222CF1852CD0550EF14A8BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 4b28aa10643d6d7d070a0df5d5272d3469a0189daf6921825987420b7819b430
MD5 eb75eef05b175af24b8059d25bc8f1cd
SHA1 55fc112cb5624f47c63deaa0ab7e6579d59f2d5a
SHA512 de6881230a63fbb088fe1eed82f0c203329f7530e87ead6393def993b5154ef5bfa91914270632630cfdd52befcde8662f0130adb46133ef00e7f110bae37fdc
SSDEEP 12288:tLJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:t7WfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T14ED423210F3EE37DF65DE079BC99074B2597B16B70222CF1C52CD0950EE14A8BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 d1d5bf5debcd23eec45d420bf71eec3e8d30634197b34dea20c6d17dd346eb2a
MD5 aa091fb6168ddd3632cd3e423f2be16a
SHA1 dfa0a9c085c4159236df4f4e25151eeb540685a3
SHA512 7a527b4e6d6714649d0e706738544254a3e2b68bae82b565bb252ecbfe6d5d76bd75e875a23d40d0b8328ee21de77da7c39c503f20cd55bdfbc49410938a46d8
SSDEEP 24576:RZM9zM9SnsWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:RZM9z+OKNcd3GGJlic10x
TLSH
T1351502A5776459F8EC6B813ECC554906D6B2BC1A0670CA1F03B8366A0F733A11D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 6b9585f7ab7ae5f0dd378d22f18e98662bb0fafc2d1e088811dc736fc78f508a
MD5 aa9a7b6b17ab9e4a3f58dc93fb3306fc
SHA1 5cc16d30c0aac085d88ff9e35e9c1b7dbaa48af6
SHA512 b1d448b67f78bd7ae1aa925f7bdaca8a37ae0da4ebb93bd73c5eebda247ac5757695ada9c658c15e7de2cf7fa72152b8395bb49ba300085a2f826fad3e7980d3
SSDEEP 12288:IcJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:IWWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T103D423260F3DE37DF65DE079BC99034B2997B16B70222CF1C52CD0454EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 037e4019cbbe493c82a90311d9b0301327d405b7eee6948aecd2bba676f16bd7
MD5 417480e80c44caa8036f5aaed6ebadf6
SHA1 b55a659a04a29e914d7fd55963a2cce105956c79
SHA512 8e86f38d379e881bc8e01a3ce56ed010dc40d8b18757623813a67cccd6e44b9d4a765d11a92378fefb9adce688cb7eb63997d14c86012a44c403df4c7fc54722
SSDEEP 12288:mKJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:mYWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T108D423260F3DE37DF65DE079BC99074B2597B12B70222DF1C52CC0850EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 8a01d13393bb373e08f35aa4837dce0c0739a27553b5c6171dd7367933bbc4e5
MD5 7433716fcf14fb00ffccf2bccd2e260b
SHA1 1fca2215774f2b92d1455a1810bc66cf492e4c10
SHA512 04d79bddac2ad9b1951b5fcfa934659ce110605d13a89dd51894d9fe4d697c59d671d728bde0ca3ce2be5ae5d1fad77beb63629a7bde371f92f605b87e3aa619
SSDEEP 12288:mFPz5LKyJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al0:wzAQWfiNmsILdbhVGZGJfNic1VF2PdIx
TLSH
T109F41217277971FCE17A9139CCA60A07F772B43613209EAF436446761F63690AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 c76d2300c4d540c912d15dddac302469e51a0ac704297d1891252eb7ad489f39
MD5 0180de9ce8c5c62c29539fbd1c7cce44
SHA1 f9527a8033e91f241259fe10eb7957b1ac97acc7
SHA512 132664ba8adfe25f217eff0c24573adc65e64a6b4d1f245c0a11ac0f8c6b2af8705e427bd448b0483d32789dbaa363aa8fa7a44201ab4844fe2d5b698b99eeef
SSDEEP 12288:AAJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:AiWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T12DD423260F3DE37DF65DE079BC99034B2597B16B70222CF1C52CD4580EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 eae10d541da63c4ec1b99ef77b3a9266a904b04dcb91f2b98cad5ca457dac7e6
MD5 567f692117fcbaad3c3405c7583f49ec
SHA1 af6b86e91b2be1c818a24193f654778294284d20
SHA512 53ee68f79f8da28e7415e614d33861b85673b4be9e4f020902ecc9396e2e52edd8d964972e5a6639906ee803da0142f80cb4f6258417477c3b686023899cad32
SSDEEP 12288:M+J9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:MUWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T1A6D423210F7EE37DF65DE079BC99074B2997B06B70222CF1C52CD0550EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 908102de85b6bf8b4e774074e5db2ffdb063155d9cb0884b73c6c0fcd3cb769a
MD5 d5bd3fe1dc94d337e801e2f270339823
SHA1 7c344b37a87371a529f99800a4af2e6049183a6f
SHA512 ffde826a27bd8c71f212313d907d1ea2cbdeded0dbc179ae648400d2ca539ffd5968b6b54184f8afa17918a6f647be8bb0f94cf3a67a6928ca97c73c58500e05
SSDEEP 12288:7FPz5LKiJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al0:pzAAWfiNmsILdbhVGZGJfNic1VF2PdIx
TLSH
T18BF4121727B971FDE17AD138CCA50A06F772B43613209EAF436446761F63690AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 bf2141f39cb0923e1907d54ffbdd0d12f21a5683cbb2abfaff7a240c5a27847b
MD5 a4ddebb90b8821630e25412a7c4b6bbb
SHA1 4bbf9c68eef9d7b4bb5f755ad54c91c8d235f2f1
SHA512 339940c436d8f105faa857eba0e3a672643d0e963ae2db11baf2d3d0420f50b48a1262c29ba5b1353f1db95f35c021813afef589bf750ee5a099991c7f937bb7
SSDEEP 24576:sTvaLX3z0zLSWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:sTyLXj+KNcd3GGJlic10x
TLSH
T1281502A5776458F8EC6B813ECC554A06D6B27C1A0670CA1F03B8366A4F733A05D3EFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 c20ab744a49e198a9a59f9d46b734b6b3dd75d20685e8fd3a75e822cfc4d338e
MD5 f51dd8ab368551265e8b261f9256be87
SHA1 e32ca9337777d055b54738d2181c3801bdd0bf17
SHA512 f63dcb0b8d9dac321d953b33317fb6e19a33c8bbc077a5a01ccba00bc3ae28259e386959c7c585f22747d19bcb99d2b41cab902363b40e742a67d34f0df1305b
SSDEEP 24576:F3xdBCHLy7mUdWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:lxdBCHLya9KNcd3GGJlic10x
TLSH
T14935DF90B7E811E8F0B7D635CC764502DAB67C5A1A31DE8F03A8655A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 242ac46fcc13806783bc379c4f733605c150fd8cc48c5d99d91f71a2afaef5db
MD5 b20024ae7d5b5457755313a1ce32d911
SHA1 e429603c6dc3535b2ac377151237d8411f275240
SHA512 071bf8929fc17007cc89f718f0dc65386603c5f64ea90b69818da0372f03094bfe2cc237e0fdcc361b9b40365abe4ff895f9a73989f46c404282ececb99e6e22
SSDEEP 12288:uNJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:uhWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T1CFD423210F3EE37DF65DE079BC99034B7997B16B70222CF1C52C90550EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 6f1b166d6e12cb83820475b4d45f52b38a97b92fcead8bfe64d16b60cce46033
MD5 dfdb50d16226b521267bd9de15843a5a
SHA1 bcb8d49fd375f656d9affc11e75f58b6f63e1508
SHA512 4154b2813257ca33f9440ec59936ce83be9f52336c0de290d0309d62ce45f47251620e94576d5d4a45a10e162a9af5f47eb5018dc3ca9da228f9dc3e98118b1c
SSDEEP 12288:4fnJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:4nWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T165D423210F3DE37DF65DE0BABC99074B2597B12B70222DF1C52CD0550EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 5db78b8d8dd0e4fd8b998e5f35906d8ed3670e6c68733da70e7273c92e9a0b8a
MD5 4696b3fb71bae1ddb9c147a55d97759f
SHA1 43feb5d1c3e682c6936d83883ba03a9d0fecb80a
SHA512 762cf025e8bde7d2d2b2e35dc29165b3e7def248538057f5f8fea5a3cd01ad1af92bf914c74d5098d853bd751e40fb43ea15857a7419ac22da6211a6478978a3
SSDEEP 12288:V3J9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:VfWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T1CDD423210F3EE37DF65DE079BC99074B6997B16B70222CF1C52CD0540EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 6ce8219c7ebb31458f77fc6cced8bb5980626765daf5328ee2caab53c845409c
MD5 a29ce2564f50789b78f3daedce116d63
SHA1 0c8e67fac08c436d59acd8be720e22a708717ef4
SHA512 ecd903c332c262af6e4e286cf3471c9e694271c3b2d9c0439bbfd4b064e5e90fff586e06b0fc36c867a955eb22ce217eb72be95c0ce8e67ec0358814394064ec
SSDEEP 12288:iKJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:iYWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T1E2D423210F3EE37DF65DE079BC99074B2997B16B70222DF1C52CD0540EE1898BA6EDA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 c80e5c7df7d00ed05338d8efea4185e22d209574587c6b5dbc10824da60fac73
MD5 fb8963d44bc263f70ab01feea496305a
SHA1 d090a8ab8dfe1e223b2ec5e47c0b5f44d1a28db1
SHA512 5be1da092193679ec8851e2b7673cf365ae227eaa6ad827a250a5742ec9766144d8fdda22a41aa36aeaa10ab89b3d6efec1c7a1aa84c7f419089fa3e75ae6e3e
SSDEEP 12288:rGNf5AJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5RQ:u5iWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T18FF40119C76852E8D06EA179DB550642B3737C2692F1D7CB42D0F53E0FB2590AEEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 6224e9f8af1a9940ed11d185637a91b9ae9314a7010b4ebb9c18759c2c5bdd28
MD5 2490b25fcdc89cdb6195a169786c6c3f
SHA1 663bf18632ee830f66127176b0a6a233e63c2d8a
SHA512 ddc30b5bfcadcd4ab9764292232ab3c853876f327b9f4318cc18d456024416f9cd7d2e65eead49421a5a32753c636896194f3584f349452e9eb16d77296ea06f
SSDEEP 96:BQUZEll4ullrDWd+LRTXRQXotIVEIVEIVUUZEll4ullJ:BzSll4ullXWElT644Sll4ullJ
TLSH
T12F42ED25BB88F613C83312B548E3E3E9A336F9802A40C743BA45276DEC5D45F5E92684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 077a951529b572b5c3ed421b3d4a22c95a4f1da7e88bfc9cf6ab321e83c762f0
MD5 06885a4ebddafe3c4824084bdc7cc157
SHA1 b52da8b1b2c6ce6492dbe535f98ae7bba474c3a8
SHA512 279cbd30c835c2b1f6eba892ee56092922bea0a00ac6f696be147675ed30d218c8cb456d0a652ab5738b4cab7177542358a218964f430fb0b7e3acb517f6fb5f
SSDEEP 12288:R77R8J9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:BR2WfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T1A9D423220F7DE73DF6BDA07868AD030B3657B12662216CF3C41891990EF09D8EE7DA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f6af403659d6e91a0b1f4e9e2f5f23cd0f504bb946c8b4640f513ee0458e3845
MD5 d4613b4a2511f4ba88ef1b2149e37403
SHA1 02fc82ae272fc1c860538f5149ef1feb9009db29
SHA512 146baa8795f61b56f029da63cd72830a1aff10666f587336bd8eb2654f98d29511f20dafd81cfb53e4a08c5e5ca1a9b135eca7dc2816d273411e90a527e4415c
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bY7WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:Lgb4mBIBhGF9KNcd3GGJlic10x
TLSH
T1D865AE1E22EC02F5E0F9E2B8DDAA4407D6B278161331D6DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 4826f9a6409614979d26f0c6a8db2d4955a508cc82d583e593293a6857c07acf
MD5 c59295aac9140b3e75074da0fad5795b
SHA1 6a37a46302a9d7f64f1bc063d12d40d1ec00d334
SHA512 0975869a78f86d81283bf14d8d26cd16686809fdff84c533dafc086ae0e96d9814aa0eb33c559a64c4b2e6b9ce81db79327b131269db70fd69a147ce84fc05da
SSDEEP 12288:8hGQJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:AGyWfiNmsILdbhVGZGJfNic1VF2PdI46
TLSH
T166E422391BBEF2BCD53DD17DA8A9020779B27062632129FF4468D0794FA09E0BA3DD54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 9490849953776076facf6b65966090acd8f425858554bf058819437f25875ce6
MD5 5df2a38bd3cf3758620dcf582cff9d99
SHA1 74dfb5da63fc01d6353738e5deef74ea49d6c4c2
SHA512 71f735403f37788be029b2cc6b61ce6fccf8d9b9ea3e911183cdb4d23c85e91472f9dea6af1ff2b42063273243e59968b359371aff7082bee4ab085f959db0ce
SSDEEP 12288:QjJ9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:QDWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T12BD423210F3DE37DE6ADE079689907073553B12763222DF3C42C90950EE19E9AA7DD94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 2d918929b18eb5408ebc427601f92b07242d7df289b7cefd9e27045bc8c5230a
MD5 d92cece5026eb8cc40ca1e0cc24b3287
SHA1 3ca92070648e787f72f522cdfd3a43eef4c6806a
SHA512 3716120c2912259d99053c2747dad686e2764ef3af8e021a36cf6ae2a70a72b8ab6bed22697651ed2e833bb68d5515504b626e68cc87ae39955403d24b92ef66
SSDEEP 24576:4zD8O8FpJqH1p0ria7/m6WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:uo5FPqVLa7/8KNcd3GGJlic10x
TLSH
T17635012567E502F4D47BE03889864653F6B2B4261320FFDF06AC8A551F23AE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 f7b19585ceea0f266d6be525fdd9d58baa166fa020f70fb8129c8f2cbbf3e5ae
MD5 968dc0b8c05ff2362d77c5558e1e30df
SHA1 b637ff2d93ee34843fff3fdcae09f89d3b54e7b7
SHA512 d08c7dd17e88b616bbd900436e5cf7f8829149491da96fd847ecf8165d8ae1fd25f6882612dfa9239865c16a68d2a20b3ba3d7841b0bc9a1aaf9e8390db557ba
SSDEEP 24576:XPUr+NQ3WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:XJQmKNcd3GGJlic10x
TLSH
T1AD05F22F27AD18E5E67AE17D89864709F772B462131296DF02A0817E0F63DD8BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 c0ba67c4dec8f6ee95f8f0d9b0c7e8b96246cf5792a81997f4c5c78f0735bb31
MD5 52717ee8a665151766f6a8782e70ba88
SHA1 6a19953fc300d62804026f1b6f378d4ecbce8b78
SHA512 6c5d9f49f8c91f0496ab2e0a6d044b490cb7ea3274131e549bbc414de223bc1b93fe95975d2e9f6058defd04ca764413623c5456a6b07c59fee3e3af570d8f5a
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjOKNcd3GGJlic10x:lG05lO43b/Y82Kic1K
TLSH
T173D5CF6A62FC11F9D1BBD07CD9C6460BEBB23425033556CB02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 06efcd96ca0725d824d7a78e5fe09fd43b011e7266d2cc3a20fdc4e072b6ceb0
MD5 da9b92117d88ba1064e34ba163234f5b
SHA1 7836210055a241dd76a17a3c04a8b851c0aac09a
SHA512 f092c805fe37d6cf9528e40ae84428537be7f5a7058737c2ee59a23f9d1c288082728a9342d33599e73b3668aac8793f7a36ef381c5f3b0cb2cedcf44ff07aa3
SSDEEP 24576:U7a5POZ3dpbWVM50JicR2hG0lasx2+47eidnSWfiNmsILdbhVGZGJfNic1VF2Pd4:Ia5POZ3wJt2pasx2+mxKNcd3GGJlic1K
TLSH
T18C65AF5EA7FC01D5D5B9D17DC583460AF5B1342653329ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4628ded59c1901b67e4cedfee9d8fc774534ba1341d814f854dab982b61b7423
MD5 75c0ecf17b95e57c4b5c6f45ef4551f4
SHA1 1ecd172212b6cccd07d6653d395d546121b33110
SHA512 db53bfb464830f40aadbc4ae9ce75b6bf566778d72041d8ea1505152d12a44bb307593bd46dec0cc0a0c50700051e38e2ef4afe314415b970b307c3a865114cc
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkLWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:5Nc/zEOVHFFKNcd3GGJlic10x
TLSH
T135857C2623E901E4F5BBE1BE89779546FA71786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 d5447b69d3d0ba54768f5678b830f7b4a8646770a26fad1db164d52fe618e88b
MD5 f3a128df6aeec1a70133b258ef7b5efe
SHA1 169a9bfd7840aa0b898422406f80391449a7481b
SHA512 c5f5848d99be1dd195ba29fa7725a37a6947b9c8ed79d1f59b411705337c7597337545fa8cfb6195c1f5822577a76de8d60da5197ba2b080ab00fa962f1bb38a
SSDEEP 24576:UJnJPbzB4S6WfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:UJnJv6SLKNcd3GGJlic10x
TLSH
T1B015E13DC2A810E8E4B7C2B4815A175AFF71347D2B2269D759B4D4343F52EE0AA39F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 29adc8bfbef0c3519bcdc2f80f5b1ea216ae22272ad03653995af6cd19c7928b
MD5 970a02d5d0b42a9766fad5213154a122
SHA1 88d42b0689db2f6a38eb792dd9b43f53db34e44c
SHA512 acbccb4fd26df9e197008f503db7aa5bcc867df6d58eb18396ad2da12e2bdc205c154619480fcc4d44208cd9a9fd6293409a2f30cc06fb87d789e9f27a5abf49
SSDEEP 49152:xCLHGeeV5ijCmlDWDkAKNcd3GGJlic10x:I6Y82Kic1K
TLSH
T1D6A56C05A7EB5284F8F3CAF5C92694169A327C549B34F7EF4A80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 6063739d88a027026dd8c4ee4880df835e5bf0f7d4c864f80a14d96080b32aa6
MD5 b4c075f0bf8ed464f7acd61072719de2
SHA1 d0679f160edc8b1a09d94dbcc35305205d4b0bcc
SHA512 7ab0dfdea7c313e28213424402e4211aedda3abcc2a074447e8042c9ce43866a318b208719a34fa3a3ddd2cdaf838ebadb565c200a5d77069ccbd16cb3387862
SSDEEP 24576:76DIIWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:76DIBKNcd3GGJlic10x
TLSH
T16D05011D277A51F9D16BE03DD5830602E2B2B071932219EF46A8C5B94FE3ED8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 86a71c29502f70d12b4f0d03d57a76f900b2ebcce65a9a41ab755fa916ff9f8c
MD5 64a724b6eed1ed536c183bd26fa37980
SHA1 9e5b65aec834a6ddf72df4a2af61f2d3a6668d49
SHA512 7a871b45c9a5d8c19db7a41faf13c738723b9cc950e0dcd27f93e837029f899f1b58f5dc8451e6078178acfec08d00d58a3caf68224baca1d415188f8b01b8a4
SSDEEP 12288:ZG6ky3J9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5RQ:QtyfWfiNmsILdbhVGZGJfNic1VF2PdIx
TLSH
T1C6F4120007BCE2A8FABD913CACA642465E72BC21672156EF4460E63E1F72BD4BD35F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 b6d156ae2aa187a117d4278d0a28be5e0a34f0aa958734224112b737efe26581
MD5 e2b5bbad43a0fe5cb02fd0d7113ee80c
SHA1 4bcc56e1c9a42c9d001f575e8e2ff622d6a5b544
SHA512 ae9ca4c685dfbd41701703c218af02c6bfe8a011729f9861219ec3f88042053dd495b4c59d8f7e4887975ead78402c666698a994eeaacabd5dfd2804d1a2a5ba
SSDEEP 12288:QLW4J9WfiNmmdtiLdbo+VGQbStlTawufNicVjCYHlViPXE7grpnI4W507al5R9y:sXWfiNmsILdbhVGZGJfNic1VF2PdI4oT
TLSH
T138D423290F3DF37CEA5DE07968A9070725A3B07623222CF78468D5B54FE18D4AA7DD50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b6090de0eb600f62b55405b7482e37224e7ac7dfea1e4536e80c4e36e1258a88
MD5 474c5bc91f04475cb111a04902ca7a05
SHA1 7b4645fc687ddb1329cbe5c04641ccf818236bae
SHA512 50f8732f22fbbdee176ef5c066fb2de033e5c7a0af9d60fb5809a368380f515367e908ed4a9541dabf10363065f4d0187f81bfd0d00002772dc67473ebc7261b
SSDEEP 24576:N5grdoTfaidZ5OWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:vgKTrZ5HKNcd3GGJlic10x
TLSH
T197558D1D67EA05DAE2B2D279D8721483D633B4315372D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 197d50446b36de17bede5cc2268af663e93b193e1335e84fd9573104653ddd36
MD5 6d460e984007d289642ac30df1a21a4e
SHA1 2aca8469421ff18419d69ce67ef807f7cec42099
SHA512 29fe4f9bb0d17fb922d015ca07fa22e625692aaad8de443dc8916fb42f3a434b191ebc1e07899e3d01486fbd681cfa2d9df0a5451d221defd7f952c799113226
SSDEEP 24576:4rcmRuUWfiNmsILdbhVGZGJfNic1VF2PdI4o07Y:6cmRuVKNcd3GGJlic10x
TLSH
T1B705F11E777E40A9E1BBD13C88850606F6B3B031232267DB41A4C77D4EA79E97E39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 9fbaa45bdaf0a76635aec8104ba81adb55735d198451feb4f696fb5d5fb30440
MD5 55e5776404e4a78cc702c7eec7862d64
SHA1 ff8df36f14e1071333be8c7be1ebaa12a99c420f
SHA512 f02bc4270350a276ef98fbee0cfc3ff2d331374287f9a05187d0939fdaf8469773b35c645de0adc1af5709935f3a6fb4005d6acafbd0c9a37ceb7be3fddd1003
SSDEEP 49152:WDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3eKNcd3GGJlic10x:33Upow8sBXY82Kic1K
TLSH
T114A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C178BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-295-0x000001A6BD1B0000-0x000001A6BD216000-memory.dmp

Download

memory/124-368-0x00007FF6942B0000-0x00007FF69435E000-memory.dmp

Download

memory/124-293-0x00007FF6942B0000-0x00007FF69435E000-memory.dmp

Download

memory/124-294-0x000001A6BD1B0000-0x000001A6BD216000-memory.dmp

Download

memory/820-6-0x0000000002670000-0x00000000026D9000-memory.dmp

Download

memory/820-26-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/820-7-0x0000000002670000-0x00000000026D9000-memory.dmp

Download

memory/820-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/820-1-0x0000000002670000-0x00000000026D9000-memory.dmp

Download

memory/1180-321-0x00007FF7DCB30000-0x00007FF7DCBF9000-memory.dmp

Download

memory/1180-244-0x00007FF7DCB30000-0x00007FF7DCBF9000-memory.dmp

Download

memory/1180-246-0x000001B3CA770000-0x000001B3CA7D6000-memory.dmp

Download

memory/1180-245-0x000001B3CA770000-0x000001B3CA7D6000-memory.dmp

Download

memory/1252-450-0x00007FF766430000-0x00007FF766937000-memory.dmp

Download

memory/1252-376-0x00007FF766430000-0x00007FF766937000-memory.dmp

Download

memory/1252-371-0x0000018FB16C0000-0x0000018FB1726000-memory.dmp

Download

memory/1252-372-0x0000018FB16C0000-0x0000018FB1726000-memory.dmp

Download

memory/1716-324-0x000002255FA40000-0x000002255FAA6000-memory.dmp

Download

memory/1716-325-0x000002255FA40000-0x000002255FAA6000-memory.dmp

Download

memory/1716-322-0x00007FF70B3D0000-0x00007FF70B673000-memory.dmp

Download

memory/1716-389-0x00007FF70B3D0000-0x00007FF70B673000-memory.dmp

Download

memory/2612-447-0x00007FF75A5B0000-0x00007FF75A9C7000-memory.dmp

Download

memory/2612-302-0x0000024B7D400000-0x0000024B7D466000-memory.dmp

Download

memory/2612-377-0x00007FF75A5B0000-0x00007FF75A9C7000-memory.dmp

Download

memory/2612-305-0x0000024B7D400000-0x0000024B7D466000-memory.dmp

Download

memory/2612-446-0x0000024B7D400000-0x0000024B7D466000-memory.dmp

Download

memory/2612-303-0x00007FF75A5B0000-0x00007FF75A9C7000-memory.dmp

Download

memory/2812-39-0x000001F93DE90000-0x000001F93DEF6000-memory.dmp

Download

memory/2812-38-0x000001F93DCA0000-0x000001F93DD6D000-memory.dmp

Download

memory/2812-40-0x000001F93DE90000-0x000001F93DEF6000-memory.dmp

Download

memory/3004-59-0x00000175B7AA0000-0x00000175B7B06000-memory.dmp

Download

memory/3004-58-0x00000175B7850000-0x00000175B791D000-memory.dmp

Download

memory/3004-60-0x00000175B7AA0000-0x00000175B7B06000-memory.dmp

Download

memory/3324-367-0x00007FF75DAE0000-0x00007FF75DFB1000-memory.dmp

Download

memory/3324-449-0x00007FF75DAE0000-0x00007FF75DFB1000-memory.dmp

Download

memory/3324-362-0x00000163D9FA0000-0x00000163DA006000-memory.dmp

Download

memory/3324-361-0x00000163D9FA0000-0x00000163DA006000-memory.dmp

Download

memory/3336-448-0x00007FF6BD4E0000-0x00007FF6BD76B000-memory.dmp

Download

memory/3336-350-0x00000193F09D0000-0x00000193F0A36000-memory.dmp

Download

memory/3336-353-0x00000193F09D0000-0x00000193F0A36000-memory.dmp

Download

memory/3336-355-0x00007FF6BD4E0000-0x00007FF6BD76B000-memory.dmp

Download

memory/3540-382-0x00007FF732F10000-0x00007FF73303F000-memory.dmp

Download

memory/3540-383-0x000002237A8D0000-0x000002237A936000-memory.dmp

Download

memory/3540-384-0x000002237A8D0000-0x000002237A936000-memory.dmp

Download

memory/3540-451-0x00007FF732F10000-0x00007FF73303F000-memory.dmp

Download

memory/3656-30-0x000001E6ABFF0000-0x000001E6AC056000-memory.dmp

Download

memory/3656-31-0x000001E6ABFF0000-0x000001E6AC056000-memory.dmp

Download

memory/3656-32-0x000001E6ABFF0000-0x000001E6AC056000-memory.dmp

Download

memory/3656-29-0x000001E6AC4D0000-0x000001E6AC59D000-memory.dmp

Download

memory/3756-392-0x00007FF659D60000-0x00007FF659EF5000-memory.dmp

Download

memory/3756-333-0x000001B08AA90000-0x000001B08AAF6000-memory.dmp

Download

memory/3756-334-0x000001B08AA90000-0x000001B08AAF6000-memory.dmp

Download

memory/3756-332-0x00007FF659D60000-0x00007FF659EF5000-memory.dmp

Download

memory/3768-55-0x00007FF63E850000-0x00007FF63E9B8000-memory.dmp

Download

memory/3768-46-0x00007FF63E850000-0x00007FF63E9B8000-memory.dmp

Download

memory/3768-48-0x00000275451F0000-0x0000027545256000-memory.dmp

Download

memory/3768-47-0x00000275451F0000-0x0000027545256000-memory.dmp

Download

memory/3768-53-0x00000275451F0000-0x0000027545256000-memory.dmp

Download

memory/4144-341-0x00000244911C0000-0x0000024491226000-memory.dmp

Download

memory/4144-352-0x00000244911C0000-0x0000024491226000-memory.dmp

Download

memory/4144-354-0x00007FF7CD410000-0x00007FF7CD731000-memory.dmp

Download

memory/4144-343-0x00000244911C0000-0x0000024491226000-memory.dmp

Download

memory/4144-342-0x00007FF7CD410000-0x00007FF7CD731000-memory.dmp

Download

memory/4784-312-0x00007FF7DCB30000-0x00007FF7DCBF9000-memory.dmp

Download

memory/4784-235-0x00007FF7DCB30000-0x00007FF7DCBF9000-memory.dmp

Download

memory/4784-236-0x0000014D4F320000-0x0000014D4F386000-memory.dmp

Download

memory/4784-237-0x0000014D4F320000-0x0000014D4F386000-memory.dmp

Download

memory/4792-395-0x000001AEC8290000-0x000001AEC82F6000-memory.dmp

Download

memory/4792-394-0x00007FF6539D0000-0x00007FF653D0F000-memory.dmp

Download

memory/4792-452-0x00007FF6539D0000-0x00007FF653D0F000-memory.dmp

Download

memory/4792-393-0x000001AEC8290000-0x000001AEC82F6000-memory.dmp

Download

memory/4816-252-0x00007FF6F2B60000-0x00007FF6F2C7A000-memory.dmp

Download

memory/4816-253-0x0000014C5EF60000-0x0000014C5EFC6000-memory.dmp

Download

memory/4816-331-0x00007FF6F2B60000-0x00007FF6F2C7A000-memory.dmp

Download

memory/4816-254-0x0000014C5EF60000-0x0000014C5EFC6000-memory.dmp

Download

memory/4952-64-0x00007FF619CE0000-0x00007FF619E03000-memory.dmp

Download

memory/4952-17-0x000002A18D760000-0x000002A18D7C6000-memory.dmp

Download

memory/4952-15-0x00007FF619CE0000-0x00007FF619E03000-memory.dmp

Download

memory/4952-16-0x000002A18D760000-0x000002A18D7C6000-memory.dmp

Download

memory/4952-18-0x000002A18D760000-0x000002A18D7C6000-memory.dmp

Download

memory/4980-313-0x00007FF62B050000-0x00007FF62B104000-memory.dmp

Download

memory/4980-314-0x00000268F6920000-0x00000268F6986000-memory.dmp

Download

memory/4980-381-0x00007FF62B050000-0x00007FF62B104000-memory.dmp

Download

memory/4980-315-0x00000268F6920000-0x00000268F6986000-memory.dmp

Download

memory/5304-287-0x000002014F9A0000-0x000002014FA06000-memory.dmp

Download

memory/5304-286-0x000002014F9A0000-0x000002014FA06000-memory.dmp

Download

memory/5304-366-0x00007FF7CF9A0000-0x00007FF7D00E4000-memory.dmp

Download

memory/5304-285-0x00007FF7CF9A0000-0x00007FF7D00E4000-memory.dmp

Download

memory/5396-264-0x00007FF6B98A0000-0x00007FF6B99EA000-memory.dmp

Download

memory/5396-340-0x00007FF6B98A0000-0x00007FF6B99EA000-memory.dmp

Download

memory/5396-266-0x0000013514AF0000-0x0000013514B56000-memory.dmp

Download

memory/5396-267-0x0000013514AF0000-0x0000013514B56000-memory.dmp

Download

memory/5752-349-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5752-273-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5752-274-0x0000000000760000-0x00000000007C9000-memory.dmp

Download

memory/5752-279-0x0000000000760000-0x00000000007C9000-memory.dmp

Download