e40eee6ca296f56649975c8fb0c970a4efb9feddaf8084909ee1c1cc1a1738a0

Analysis

max time kernel
85s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
Size 12.1MB
Sample260706-mn992sdx9w
SHA256 e40eee6ca296f56649975c8fb0c970a4efb9feddaf8084909ee1c1cc1a1738a0
MD5 0830d09be1daa08c468c493b0f374ac3
SHA1 55cedeef940db63a5f06a8acaeea79c6d78dd4e2
SHA512 5639803cdfb55661f20766ad491a0092df34f20f3eeddea5433aed3f7ca2299117522d9a8d79ae0582b6e24b5581be341a400be54abec90eb9a914458204c91a
SSDEEP 98304:cpWOOrsnohWUsHG4MBytZtFiMdveS2zwxORe/PS6RHP6xUc3z:2OrVUfPOdz
TLSH
T165D61807FEA184A3F474277E08704A990D27645EEC347EB33064AF63A7DD28125AB797
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
236	elevation_service.exe
3416	elevation_service.exe
3064	maintenanceservice.exe
1124	OSE.EXE
3060	PerceptionSimulationService.exe
2544	perfhost.exe
6016	ReFsDedupSvc.exe
2064	SensorDataService.exe
1656	ssh-agent.exe
2804	AgentService.exe
3944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1eb53b9f59cd5fa8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\ConnectWait.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001634eb8f330ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000147ff790330ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fd04591330ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f74ce48f330ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fde63f90330ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056eeed90330ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e9eca90330ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012075495330ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{11CCEA79-9CD1-4B3E-9403-F0D8FA72401E}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{2016AA78-9589-45F4-A40D-622DF222404A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4288	explorer.exe
4288	explorer.exe
236	elevation_service.exe
236	elevation_service.exe
236	elevation_service.exe
236	elevation_service.exe
236	elevation_service.exe
236	elevation_service.exe
236	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5552	2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
Token: SeTakeOwnershipPrivilege	236	elevation_service.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2804	AgentService.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6016	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6016	ReFsDedupSvc.exe
Token: 33	3944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3944	SearchIndexer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeDebugPrivilege	236	elevation_service.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe
Token: SeShutdownPrivilege	4288	explorer.exe
Token: SeCreatePagefilePrivilege	4288	explorer.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
3264	sihost.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe
4288	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1300	StartMenuExperienceHost.exe
4288	explorer.exe
3104	SearchHost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1516	3944	SearchIndexer.exe	103
PID 3944 wrote to memory of 5164	3944	SearchIndexer.exe	104
PID 3944 wrote to memory of 5932	3944	SearchIndexer.exe	105
PID 3944 wrote to memory of 1152	3944	SearchIndexer.exe	106
PID 3264 wrote to memory of 4288	3264	sihost.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0830d09be1daa08c468c493b0f374ac3_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3416

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6016

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2064

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 2948 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2064

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1300

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 961764b1554a198ab80921841900a63ab022a643a1c9395dbb610140ee96d337
MD5 e87b3a592bb0bea401e39321742a549f
SHA1 659e961b552e715a0679fa0c6aab561e8caf6995
SHA512 266a64a821e2cbf0bf5aefab8bdeab31c6a19ee0a241e7d0959103eb6cbbb4563de0237fd4699166d6dfc4f1d947cd17f142794a590a95805e2fc56166e54feb
SSDEEP 49152:5b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYAxUsZn3zAj:P3q6HjBkxUc3z
TLSH
T11CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 008bcc3d3b490a36a9d74b41b5cc3317cb3eed0917ca3396413008c7d003d0fe
MD5 7647fb44632cabfa945b3e4ec54f1121
SHA1 ececac2aa5c5c915186ce765faecc9ec92e1acf8
SHA512 51114f602febb6a244ea905b3e43a1800902c2fdc73451eaacec47980896081bff34079ed6baa13fba766d3152b850922e7661186015bcc57c677bb5ee48d85d
SSDEEP 12288:Q1XLsswWkxy2lRq2czAHOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:GXYfDtczAHA7Nnm5uqLazZn3zAj9
TLSH
T16265F129B3D009F9ED67827CC9A18501E673B89547A0E78F03A4D96A1F337D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 a3f61e70f2da3166b550cb5062ce0f2e8036afda626c176a7bb4445c65e72083
MD5 45e7a0f31b604ac67d4b3908f657a4cb
SHA1 d216cc6279fa2924566652eaa0de6b4a03ed1baf
SHA512 37ec0c99df27efe98657061886a15c25949104c1120b84625b7177a9cce2c8d912f91b118b6278cb513a62d7e1b0b51cdf08e7e26fe7ffa3ba33587d5057c06d
SSDEEP 24576:t0Le5ji0hmxirMrA7Nnm5uqLazZn3zAj9:tPji0AcuAxUsZn3zAj
TLSH
T1F0859E16F5748335D073C0B9C5D2A68AE97230865B308ACB4296D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8193a221f863dc85c5fc135b53e98fd356d18b3b703e3f0de5b19ee31edbd30a
MD5 741b287169e22a55bedddbde2231053c
SHA1 9525f4dbf330db7ea67cd62c1f1b1151f487f1b0
SHA512 e25ba9879c51c7d3ba57bed65db932dfa37cb6fd28baf32f51b8ede370d7b18c2f29f6649622327cef7428f685ca4a0a62a4b589d8e35115116790e96135c5e5
SSDEEP 24576:Va7/ezSC6vUyD/aqgrvWE6q8wyu1A7Nnm5uqLazZn3zAj9:c/ezSC6vUzPvxHjyqAxUsZn3zAj
TLSH
T133755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 32510370686ccf454e440a0b6cc963023236f92069e3a2a096fdd33aff2a23e2
MD5 78d9929d309d4026a6e919caf609bfdf
SHA1 c1f5ad9135779cbaa02a40ed6f8960facd6c081e
SHA512 dbd9fcd161491d50c796e52fc88bdabc87544724eb88bdc6fae44b448e00116d2bc5b6cf5004bde23c158276bda557b8154ee0f880c0d7db63efe16bf039d8dd
SSDEEP 24576:LVbqPb88hv/l+60A7Nnm5uqLazZn3zAj9:LVO88hXl+3AxUsZn3zAj
TLSH
T16955AE66F5748331D073C0BAC5D2AA9AEE7234415B318ACB0246D76C3E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5c468cf1b2c5989afdb0ee251e35f6e42407957ee8cc831c3062745547e3c124
MD5 322a23ad054ec70d0df7086f134c175b
SHA1 6615b986466564bdc66f5b5d273f9d0b8345d522
SHA512 6f4380196f65a09cd882c9891b0d921cb26d7904d724d80c754e7c9c8ffe4de916464d8f2706e0a11ac89f098320038023fe8e7e33d397e711e1656fffd4fba1
SSDEEP 12288:JRvOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:JRvA7Nnm5uqLazZn3zAj9
TLSH
T11A45236391915237EEA78BB1B72098C0A0C6CDC498E0574D5B30FE4F1D7DA74CE1EAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 90b9524800a2f5fd928d725c370eadc1b45dfebd172725f4d4de073e69369a4a
MD5 1ebcf335766935dc2aaab25e35d8454f
SHA1 f696e9f101f95277c5595a9306fcedb7b13979e1
SHA512 aa701507e56c01114ee9c2bac50cdb347dedd926f2be2e9d13a3239139bb73b9d498505b29a5a0635ba4a06f1f37f0f8a92ba85d8980e89e9662dbda8db6ea1f
SSDEEP 12288:/eBNUbTVO86UcOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:/JIUcA7Nnm5uqLazZn3zAj9
TLSH
T17065C03BEE28FCE2C67A8DB957518640D7A278704B6193CBD175C20EDE235E04E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 58f2299ec60ed69dce3a456e1097ea551ef8ce7800e86c199b96bf9a4e72fa66
MD5 8140570c84a364f43526634db9aafd26
SHA1 80f74750f2c50c1706073fe32bb3096e738f4d04
SHA512 370b66911acfb78d0264384c6526cd1aa82c6e7c73bad1c75f372c8e22f40e4d97cc4f0a22df4cea4009209573a9e862bba2dca2402f02867613b6c499c1afec
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:9QvGAdlCEL8c/yRNw5CmxUc3z
TLSH
T1EE266D656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 894cc3daf1e600610c80376c02a0aabcb514f5627e7c7627e92aeb01eb9017f7
MD5 33b102740b1ad203ae2b477cce2d1cc6
SHA1 788b88674bd6ed01df422780ea50fe26f04bda7a
SHA512 661ecf89c9bfd2823aef9d50120da60fd0265390add520b1454ce628b16d5de906e7c98003efa43bd3ce5295767096ba5a0df5bc5967918b0ce87f18189025a1
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAjeOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzX7:MdewsAjeA7Nnm5uqLazZn3zAj9
TLSH
T1F175E031FA74E036C7BF0DB22B35C706546DB9604BA11AC3E3A89E8E59342D25736E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 53f1eaf0355c1bf2c97bd80812c384193b927fd2c3799b215baf5adb0df68e50
MD5 eb8edfa9ed64933d434ff09741cb0ddc
SHA1 19beea8fcac11e60e6db1d143618752df854e06b
SHA512 068de65029cf59f0ca5c47eb56fe087529fabab5a79202b011417f4d620606fabbd15daee15ad529a2290bd7d2d8a60bb0d5a666daed39974a0e9340cad5cdb7
SSDEEP 196608:DUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHXdz:DUEtQevvqc2W1cpV2EI32J
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 267edaeff1ed2217b4c4821e807787dbbe7ac2316b0f817ee584397f0c0bcad7
MD5 606519210cdd943705fb9974e1cabf55
SHA1 c9ed1df103b629b964e7c8c791017783c62dcd26
SHA512 d468762494e3b63f0bc0fe95b3a8a61d83d72a777f08f09119fd49380c25400379ae3764759127f565fad20a9ba407e0b8bf6288ae75fbaf4d70741f4fd6c020
SSDEEP 49152:zCbRquA/m2yL5zifFiV+XenmE3/z+AxUsZn3zAj:MoqHVjnmixUc3z
TLSH
T137D58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fa7c407b911875d75ecd27483777445daaf39cc14080c6ab0249d7919380735e
MD5 8315ee62857c1a10c1745d606bfcb24f
SHA1 c6cb2e6af92cc2d55fc449cc5bba50c970dbb99b
SHA512 0e18c802f9f89d6fbfbaac0bcb3227dd917dc666ca5fac8e0bec89ef54eb83ac4d107c9be85d835a67bc577c3f536100967e19956337a7c94f0a7575ff2be77c
SSDEEP 24576:fAhGLJIFoiwtA5l7S53BA7Nnm5uqLazZn3zAj9:fAMyFoiq5RAxUsZn3zAj
TLSH
T1D3359D81E7F955D4F5B3AAB899B68570EAB6BCA55E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a5ed14d7a57ea8baf71348301f063272ec1b7b2a9355ed2c7c7ef871c88b9cde
MD5 9d25fe5ccd2f9aa1ab3f6afbf907225d
SHA1 03a92f2c5570dc79e848da09220fce2badab6c3b
SHA512 95a398596788fa224cba1ad56f362a0d66d02341702685e6a3c13cc0c8639f47061ae7d6d3a0da9811b6e455c5e3d92cffffe5507424b1bbecb9acf5d656188c
SSDEEP 12288:Omw5HEjsChNVBFgl0WDm+CVOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTsZ:HwuoOWKA7Nnm5uqLazZn3zAj9
TLSH
T1A765F14672A40CF9E9678239C657C531F7F2B8412A21D71F1760CA5B6F37361AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 42d318688dda25fdedda030ce9e5f981fc884c195577f1b434cb964763876627
MD5 09c1b632f8746de9315fc6131c9839a5
SHA1 ae36d771c0d150b91c363324666ec8ec9c72663a
SHA512 6fb2a7b20d923bd87de33b654e9e72eede170aa4d6332ab08ca8087121354e711b4645c850395de61a366b6099fbf738851bee85f26196f118d13d935c08947a
SSDEEP 12288:3BZ1IyOOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:RZuzA7Nnm5uqLazZn3zAj9
TLSH
T1C855125B32D421BAE5A38378D9A04540E3E2B895677143CF17209A5B1F77EE18E3E732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9ef154a0d25373a3ee956ccc44f04a4258bc288b901f7440359a6fcf7e0f3435
MD5 4ef8ebfe51f9000197aacdc715b748b4
SHA1 bb1d2eb15941a7f09144a6ef608ce0c1e1d6186a
SHA512 3a9ed21ff25403e740600f30390923c8d61be0e8102469066d0f8969a2811c1bd6eb0cc56156834cb9eb2769a4111f7f720fd6d308008b72db832cfeb84c3c55
SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:1QRQyi36YOcPQLvw2gAf+PN3TxUc3z
TLSH
T1D7667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5cf4425113d82d0f9c46767b4ff2cf38cf57bdd68ddfd589da2722ea564a97b3
MD5 5fbab279ffe38e8fa34bf4ba98ba0be1
SHA1 99c366d93f3651da73e4839ffe0cc281d3e8957c
SHA512 3e0b26363d4856f24628733c37e495b13f1f8851e135531133983ee856b688f8c4b020c5dace4a73f7856ae3b3a5d5a58e952c619d0c61fbacf2eeb27a0a54c4
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UC:AQRQyi36YOcPQLvw2gAf+PN3TxUc3z
TLSH
T139667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fb561cbbd22f85733b5368e1f6c61d93cbb5d7d58f31e3d29d7a5faa9854d8be
MD5 4079ae0efb4fa6d643fee3a4c9547df3
SHA1 98afc4946a1509dc64a8a00d1809ac9fad9808ca
SHA512 2472565c2df62da56f764c9d64e216799bc18325a6e1855767f27ff5cba891c81f8302f63db9b95700b59fc43f688b3a8cc25d4d2bcd216e2775513a5c215dcf
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DA7Nnm5uqLazZn8:o68Qg55nhheWu7PNU3/uAxUsZn3zAj
TLSH
T122B54A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c180909fb7f321891fb41ff11bb2cdb5a9b63e2377eff7153b92d243b9990cd0
MD5 fb399ee7f751b0f0cf88d6b086ef3ed0
SHA1 7da2e8bdeba2e88e298644468b160d58c39f1b10
SHA512 e104c8937f12a57082ea5fb0f9734703868232d9409e06d1373e3d550bf8f50370815bb67ff871508155dbc752780a8233089601cfd1ab39fa3a5c828604367a
SSDEEP 49152:B3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:Ay5112gYy5azzVvL69nLKnhZ4xUc3z
TLSH
T1FF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 656d464f4fbed74512eaf0f04c07e0d903d1f8ad8dae6d2dc980d17b3806560b
MD5 15a165a6314a86ec0e452f16aeec5b07
SHA1 961907954265cce6c4f8b7487f31d3a9385d14f2
SHA512 40ecaf5cbaa501ad70431b3fef34279f41310360f44a3d9fd4b8af4f032e38f53c19cb545a7fe4b1fdc9c2b49dbce95ab83016e00931c9200b201b609ac61cc6
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl3AxUsZn3zAj:2u6JmVxd2dQxUc3z
TLSH
T1B5D59D13F1DA01E8D06ED578974A9232FA62BC490B34B6DF0A9073562E77EE49B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c81e6fc0c0b9cd4319c7904a86dec280399c743003a7dcc32623109d9d5d1dbb
MD5 d4e42c841164ed3a3d75364f9b4c5252
SHA1 76cc4bca83926ddfc5821d3465e357004811ace5
SHA512 4f265e37bcfbf9c762aceecb574474d030376eb8a52cdc38b1165c0e0e7de97f2b3d3b8171257c1cdee5e387c2be8c7d7502d15ae7ac15b9584b47d5878bdc72
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4x8AxUsZn3zAj:bmifPbRixUc3z
TLSH
T1B9B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 9e838b508f9480d47a88b037c1710ce8907ca35bba81a37ca79f0fe6483ab9a3
MD5 00f1cbfa0c44f035e02068791d43d723
SHA1 308bbd38e21d5823cb7a5fbea1bca3adc03f20c2
SHA512 2fec1904bb64d61ef7864b736ad6d8953740c0ba7d577190ea97bbe8cf61caf45719bd0774a5cd35e48515956c69611b461bd7487d8427ede56d6d244bb98998
SSDEEP 49152:oSuZQIY0Be2KRRVtOnks6NMHqzAxUsZn3zAj:y5dKTi61cxUc3z
TLSH
T107C5BE03F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d7cf3a458ca5a87f013356ae6a45ca0bb07ab2d27be5a4a11a668796d8b25764
MD5 2303ac6ba4fb145a4843bb87b0b5dc0d
SHA1 964d340f9fd3d2405ea4519444721becc2155b48
SHA512 78592d485d02a7c5d40dc2062eb9f5a1d54d82cc6f8d6c3e1dc4a9849b1baa81d043f114714bbdf8c58050c4067db524b574db7c572f32c7c23bf77118287e8e
SSDEEP 49152:ihtSn8EApI0figngiDn0AP5wwAxUsZn3zAj:DX2iyphuxUc3z
TLSH
T1E795BE13F2D900E8D05ED178C7568632EA62BC150B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0a40f332a07b41c44f81275d6a8bf62be180aadbea70abe842d36d10a965f19b
MD5 d7446b67cb76b8eceb19d7fbaaab1007
SHA1 113e8821eaca2ebfcc90a127ecdffcc43b5b9b66
SHA512 f4abdfbd0d5b936c20cb88bcf9b84a3676e4cfebca413a61442a5523587420829dd0315f1e80a5299b40ffffb82712a3e2a912b66d0aff32950ca067e11de174
SSDEEP 12288:W3OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:W3A7Nnm5uqLazZn3zAj9
TLSH
T1CD452357A096462BED5787F1F72095C0A0C6CDC9A490138D6724FD0B2EBEE74CE1EAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1b4846b27613f6cdf4478e6cf5b861ed7e9249257af93eed5a37fd11969eb514
MD5 f23f04a2a146b0756eebb9e493a0fcee
SHA1 6b1e858521e1eccde4d05ce25eeabc4de0d0b264
SHA512 e36b695f3b4c65c0465f75db154ba54978b7b1d9bb5bf16e679342bd49920893d61600cf7280319ad5ca92e514a6b4baaa5d9a81f9d5a54e677f032853015751
SSDEEP 12288:CiOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:CiA7Nnm5uqLazZn3zAj9
TLSH
T1FD452367A0924627ED4787B1F72084C0E0C6CDC9A890138D6724FD0B2ABEE74CF1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 192d3cc579ebb92ccd09833ab8560cf4b30552381c8cf47a2e85fbc702bf66d8
MD5 c0f38a8767761508b9faa5d9f5235577
SHA1 bc256ae575f1daa80f22226d1b9037d7c32bad4a
SHA512 846fe3a095602c65e3a73902823ab41e4d899aed0676d3d92ab39ac6442eb718689976375336e6d3d9b7797b76d25ef1b6270d4e104a888144852ee373bc38fc
SSDEEP 12288:MEOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:MEA7Nnm5uqLazZn3zAj9
TLSH
T19C452367A096462BED5787B1F72045C0A0C6CDC9A890138D6B25FC0B2E7EA74CF1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e326e89c7b22ca822e2405a6bf71dfc11754f7fc3e4ca18ec4b8e41cb8ce2e81
MD5 55c5e20711365a9e7b2b844dad31864f
SHA1 646d53dedf33a76dc1bbad057ddfc5bebc90b898
SHA512 0ee3ab63352760d44f2d4e748c3972fedaf87bc057b0dfd41461fcc9a7f2c9065ecbd95bc5b4dbe337eca102ef58dd66e8b5c42f232362c7aa1b8e5b7d11c31f
SSDEEP 12288:jVhOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:rA7Nnm5uqLazZn3zAj9
TLSH
T188452353619601A7EC63C3B4E6208480F1D6FCD4A670538F5B20AD4F1E76BB4CE2AFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c080941dbc87d8211e8f5fbb692d86550c082d0e303fa2efd20eb2d354f4ec47
MD5 ebf210264d67b7e7465f089757a2e6d1
SHA1 115e0a71851e8295a336043c5071262f52cdd8bf
SHA512 5fa5e3423c94b042f977cc3560705837dc2d3b6f3fd3e0d5b4ef95494b86721980bffbfc00c2eb0c784ac1ce00c3c912061663a520376bc4200a7a0c0b1fd32a
SSDEEP 12288:05OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:05A7Nnm5uqLazZn3zAj9
TLSH
T1A3452357A096462BED5787B1F72085C0E0C6CDC9A890138D6725FD0B2EBEA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 0f3883978d6ce4a8a895243071f642de9d708dea7ed0d9b52b4063a480e9e4de
MD5 a5e12be38f8fd08160bf18c47bfd75f7
SHA1 bf9754d058870b90e8c0d4aadb642416783e3354
SHA512 417fc1e646cd07071a5044e7446b65f4cf3d28b0d8c97e1e8c751e21d574a5a6bedff27a2e7722c971ba9aebd6f59c9ade1dfe4db619000b71cb71092a37dba0
SSDEEP 12288:ymOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:ymA7Nnm5uqLazZn3zAj9
TLSH
T14F452367A0964627ED5787B1F72084C0E0C6CDC9A890138D6724FD0B2ABEE74CF1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 68c1e6ecc5e6cccb39f4e72e61992a7b32be6b93186d7c308f92e65a166841be
MD5 877023d5dc9f29a223d0cbac49d7fd2f
SHA1 ce909cd5c1b6d7a1f2f6f61e095ba03224396307
SHA512 b1ccdbf72b401ca0b77bd9db1e25db24f3cfeea7204d161b9f5eb5341bcd1af59e54ad7b43d4c09c8f6f6f628d658eae2f8d707ddb5691a70bb741f36eaec492
SSDEEP 12288:zaOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:zaA7Nnm5uqLazZn3zAj9
TLSH
T15A452367E0924627ED5787B1F72095C0A0C6CDC9A8D0134D6B24FD0B2BBEA74CE1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6385123e0a595986eabfeefaff6fdfda737e545e108fa1473e170b3e35597761
MD5 62baf7d3085418bb30e09f08569b5659
SHA1 03ca9eb9eab82ce9668d2849776dd736d57c7887
SHA512 666c80532248025227e2c3d427a3766c3f1774b68c7196d5488fe0dc8f94c29c9b2fb304db52b44ac336fb2cb7d437b3a28387497b0101b2ae2dec19dd8a0fee
SSDEEP 12288:2iZwb6zzFEoS2cPvyCOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:5ZMSzFVSOCA7Nnm5uqLazZn3zAj9
TLSH
T1BB650195B39018F9EC67823EC9258945D2F2BC590A70C61F13B43A2B1F773A14D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b03bd57afe4e1315579d8560815bfc8e2d4dd732d888c1aa948b67ff7cb23ff8
MD5 c009ce7843d8eb20a7ec153847ee9ec5
SHA1 b26a1c155e76915b2aec45733e23cb4849f7f102
SHA512 01450ea1d3c038319aa3369d7fe2b3ec1e6d712e7105ba317659538050bde9961cac7436503986fe20629fcbb36f59db9aeecc319a7d6be3c2ea24dcc5c07227
SSDEEP 12288:fjOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:fjA7Nnm5uqLazZn3zAj9
TLSH
T18D452367A096462BED5787B1F72085C0A0C6CDC9A490138D6B25FD0F2E7EA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 23069adddcbb2ed143064dd8b894bef3a090da8831c3a4034d437c71aba0f983
MD5 b085c589efcbf01e3457a25df9a9140c
SHA1 3380a904cbff588058c637fc8816e78b08f27e2d
SHA512 46a5ae4138463009992a888ddcddabea3438c8c7fd2413022f57c06356c2bf366cb262e9963913e9739c54c2c779d30014cd31adf2c28461d524a416eecf2f2c
SSDEEP 12288:hfOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:hfA7Nnm5uqLazZn3zAj9
TLSH
T158452367A0964627ED5787B1F72085C0A0C6CEC9A490138D6724FD0F2B7EA74CF1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 c5873fef0f67f7644bb869e8ecc94f1a8974c196acc9e2a1559a5825f49a0a1a
MD5 dd79e81660f06081d42f11a6d99a6766
SHA1 7a3dea9df5372098c7aa7645b8b5c9c6fa991508
SHA512 efd600a8f6e15dd6e4915bf73e8bc067a114ea73d10b025049336782c2ae07d05c2dc2944fe45fb20388f9f2aabc2705b7c0de1bbfb5ad251e78600b120df3db
SSDEEP 12288:+yPz5L8OOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:jzyOA7Nnm5uqLazZn3zAj9
TLSH
T18355021772A130F9D5678374C9611A41F3B2B87547608BAF17609A7B2F376A08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 22f5027d174aef3ee34c8a6e4025a31b2b56bf392b9f4a9c1260a10861200b3c
MD5 98055c8739ea7bdd724493ee88e92f47
SHA1 5f64aa6d4e4a30b65727b51a1cd178f979b793c0
SHA512 2ab236cb9d58a39daa7bfdde1b14b52c2a272040022d73782d39430a7a1e69e0348e304645fcbc19f05bc4c4f566966ee9e64b823f9f26503b58e779754fc5cf
SSDEEP 12288:0jOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:0jA7Nnm5uqLazZn3zAj9
TLSH
T150452367A0964627ED5787B1F72085C0A0C6CDC9A4D0138D6B25FD0F2E7EA74CE1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3fd1c5af23d538d2c9e0c077544bc6c37b3875f7ee47425ff9c2c8a4f7d31d7f
MD5 d1d2f7dd04134b2000f0595f65fb94a5
SHA1 5da819371cf13adf86583540211bee443ed944aa
SHA512 857cb14e57fca4ffcf92f4efefa79c9147d9f11ca53e17e0da24a5b6e9605b42797e50e3198c6e9450dab5fad5ea0ace99c18473473dcad9333b73bd19c21fc0
SSDEEP 12288:VjOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:VjA7Nnm5uqLazZn3zAj9
TLSH
T1C3452367A096462BED5787B1F72085C0A0C6CDC9A490138D6B25FD0F2E7EA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 28be118909c63f4c762a54dbebc45ebd5398540dfed0e98d89f0773bf6c96bd8
MD5 b6c96adcb812929f24244628c489fabf
SHA1 dd4e353e575cc61822b89af8ed18cf74957b5bed
SHA512 7a12df077ac6997258085ccbea9139f647ad89d8393fcbd5ecc42c2ab26d855d79e7dfd15635c253ad9367b4a1ab8427a91079ed98f95f3e89c6439653e7141e
SSDEEP 12288:CyPz5L8OOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:fzyOA7Nnm5uqLazZn3zAj9
TLSH
T14655021772A130F9D5678374C9611A41F3B2B87547608BAF17609A7B2F376A08E3EB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 efdf303def53c21c8be0eca6d3110f26b366766614d0684a3c50dc08069d03cc
MD5 a5806534db3a82ae1d5b650057d4289f
SHA1 b3974d7981ad90e83a75f9381b29fb75f31927fb
SHA512 78358644b414c35677e2390b0b42dff3682ea0ef4daa3f0805b4cfce0640b8821c5ae8d74704e9f88ee3802be17747f4e14815ada70da7f512d36199af1290f1
SSDEEP 12288:WCd9eWYoaLHF3z0z04PDvhUOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTsZ:3THaLl3z0zDUA7Nnm5uqLazZn3zAj9
TLSH
T1ED6502A5B39018F9EC67827EC9258945D2F2BC590770C61F03B43A6B5F373A04D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 2689d8648f1e7ebe76b4fd0f2f653392a2428930da31a994253f630fc8425282
MD5 62f9792f00eb84705e88e35a1723d3e7
SHA1 57c2a50541c31b4fee0fbc6eb5f35b37e938e41e
SHA512 ad045a771eed386cbe1933e39dc75b496ca00f748e7f3461cf525e17ba3654eea589dc9e0eab738362b295d37024a9b2f88e42d5e5b8dcdb05fd34e4d8fa5b0a
SSDEEP 12288:mi4e7+RdTfgwCHKy7GLbbdIvNOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYio:m37d9CHKy7GZ4A7Nnm5uqLazZn3zAj9
TLSH
T10175CF91F3E410E9F0B79A35C9764501DAB67C991B71CA8F03A4661A1F33BE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ada68c66aebc2556b90b752a2e102746e2dcbe9f76a1392c7eba3cfc06360865
MD5 4355c01dbddf917726a08eb861e9338e
SHA1 cc18030ede9b1af42dcc24e8ac10532adf0c5806
SHA512 9f81cf8dba141887652cab4b754963f2ba874ec06726aacea772b57649049f51d57750f3a3a844050cb3d615e52e301333b69a8023bfba49b9cf9317c7c77829
SSDEEP 12288:9kOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:9kA7Nnm5uqLazZn3zAj9
TLSH
T100452367A0964627ED4787B1F72095C0E0C6CDC9A890138D6725FD0B2EBEA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d9acff08200d7ccb09ce7745281c7488e6cbb82041f6246104df1b5f5381540d
MD5 001b134afa8aa52082a46c75f5b67c0b
SHA1 f465c9f979eb71b190ef23ecf8b7e086ac75258b
SHA512 7952d76d5714ba260f1ffd66509c55426413ffb563a68875f743430c85170329ad904f7b305d66270fc60724ac3e896d393dd5ce1b6d4236b9fbc6757de0e6f1
SSDEEP 12288:QuOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:QuA7Nnm5uqLazZn3zAj9
TLSH
T177452367A091463BED5787F1F72085C0A0C6CDC9A4A0139D6725FC0B2EBEA74CE1E9E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 258561d9a900c8c7eb33b0f8ea6b46eb96d5a0600cb2dce03bb2340dcbf249bf
MD5 7d14162cce40e9d07b81a5a143552fc3
SHA1 3ab931ff04cf0a8ebed787c879d13eb766fbf728
SHA512 2e272251acb3451be26ee98404cb8fc2f0ad86525673a840025cfc63898a290824741e9e7f9fe207ac8f2571a061b2c06afe9700c88d6f916ee56a198c674d8c
SSDEEP 12288:qNOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:qNA7Nnm5uqLazZn3zAj9
TLSH
T195452367A0964627ED5787B1F71085C0A0C6CDC9A4D0138E6725FD0F2EBEA748F1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 57f1ea47c42c6be643eb67dd43dc3af07fffc40bf388941b35f31c713b7aebc0
MD5 8695609e4217d1e791da99d8499c8464
SHA1 448486c83414c3b1eba68ea743a34af822c718e4
SHA512 63e97f6a85ac29f3bae7fd39bf3af54b4c3139d7edd0151d4a4ea9ee7d6a153fc4253622c53add04929ab538fb2005b0ce19bd1da8625aed302f9f9acb101cd5
SSDEEP 12288:ajOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:ajA7Nnm5uqLazZn3zAj9
TLSH
T11F452367A096462BED5787B1F72085C0A0C6CDC9A490138D6B25FD0F2E7EA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 e9d8699dd776d97f18a3f77db48b8eeeede5b7fd218c81ef5a1a357e39e9d6d7
MD5 c49f68d49eb905a097480c4764afc331
SHA1 43cb8688fddc3c180f0db9087b72797e4f343bb1
SHA512 c84d4164af84d4d02bbb978426becf71543b34ab40c1f14d5403ef055391f954b704c67bbc191ecaf4c41a7f27e95f08e005c9ae6dca7484d14216161c61fa36
SSDEEP 12288:gkOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:gkA7Nnm5uqLazZn3zAj9
TLSH
T11C452367A0964627ED5787B1F72085C0A0C6CDC9A890138D6725FD0F2E7EA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5c9b773f95a5ed8504984b5eaa971ee97975ccad3dec9f27a6ed08352ee69279
MD5 ce6d2f386fed6945c18c2afb5fc68755
SHA1 7a6c8327d5c774775fd42bfbaa7e5a41945bae42
SHA512 e76fd275944e0cfeeac93792ecc4d43f885d1d6122dc18b55f992d8d305051a92d07d69794189f9fb978f7a7dbff4e465727e3fcb6936a5e4327cce53b55253f
SSDEEP 12288:A7OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:A7A7Nnm5uqLazZn3zAj9
TLSH
T1C5452367A092462BDD5787F1F71085C0A4CACEC8A490138D6B25FD0F2E7EA74CE1E9A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c911f007f3da2b8e2faa7a44a28d1dbaac010d739d23dfad164b966859afd0a9
MD5 0651e3ac474317b54f1a2c6ab409c1df
SHA1 ce8e9e2622c44a5ccbf643e63f552910ec2d6d26
SHA512 d81caa4d8e80f14dcabb625fb4edc2b3f96c82635e09752bf1bd194f20d69b99b413f9b07b2542feeb367eef5af3130d890c651d5026e6a4f791f1bfebca1834
SSDEEP 12288:o5OTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:o5A7Nnm5uqLazZn3zAj9
TLSH
T14F452367A096462BED5787B1F72085C0A0C6CDC9A890138D6725FD0B2E7EA74CF1E9E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4b51ec5a840c582f515cfae14b130e17ebe60c9b124c56bff832f17bff56f014
MD5 225d89afe007cf45dbe8cacf87bec122
SHA1 d2535d13de6af76f663f6f1b0d5042ad8459bb9e
SHA512 113153380caac03f0815423717d4c23ca7c5442fa36d47a6554765fe1483150855c6b21dfda841eb2998b46aba035fb2d4a224cb6584f59ddfc6fa51256e0559
SSDEEP 24576:Pfwvok9RX6wkyAIPA7Nnm5uqLazZn3zAj9:pMnYIPAxUsZn3zAj
TLSH
T11C85D029EBDC44E5E177923C99B3460AF2B178591B31C2CF125A536E0E37EE45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 23bad0fddd19a86c844b12c4840bd662d0093bbaa05698a4ee20840219ec737e
MD5 e128c99dd6d048a57a0d4974808e8081
SHA1 d07b559381fa21ddaf8ffd8983aebefcaab564c4
SHA512 da7e36130b476ebcc2d880f9234cf45c65da895365c284222f137e559fce69a8ebbbc0ff1a71328804231a83bb5d4ef4e7f2615eda8b1d55b03e858d215ac605
SSDEEP 49152:BYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QAxUsZn3zAj:pySzPzxUc3z
TLSH
T13A067C57A1A801D5C1B9C1B98B0BCC1BFAB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 62eaed7c1f955760fa82a15136878640888d3671a5fb616947306bf2b7a50548
MD5 f73645352a939f8f249c161926b9a9f0
SHA1 2c0ea541a8dae56470c3eb0aca395598a332bc21
SHA512 fcd8d84a5b41ed31c771763d21ec6dcef6f6453efabec405b0a47bf0f4566a843aeb5f395df16f52a9f24aabe5ea7fb5835a6ea3f2276b58639d3b89583f7b8b
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYyA7Nnm5uqLazZn3zAj9:U47JUQj1irIhCnDHUPfF/AAxUsZn3zAj
TLSH
T1E565AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8715617984485dc74b90d3110dc8fa1674449a410aee77e76420fda5bad59d9f
MD5 b35e9a48badacfe83bf51293017c347d
SHA1 df85b786faa8eb0723f061c2eececeef7a91e8d3
SHA512 d0a3c006742723f1caa612e574c1cd2bd2f3af550b29069df55059d672ebeb5ea9fc5b83a9719c46719dd972027b0419d3aaac1fe6a01e5585443bdff2b2284e
SSDEEP 12288:oNsfzOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:JzA7Nnm5uqLazZn3zAj9
TLSH
T17255F11AD29402E9C46E6275C7114A40F3A37C6587E193CF53D0F93E1F7A6A08EEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f5424e42a59d38d05c88866fc321775ba5731b10e291f25a6f05d9f367799eec
MD5 b428654e6d6b772ca03163f9f67a1c39
SHA1 2405f3f4152692ef7ab74fdeef8e725fb61d8ea9
SHA512 b768c3a7f690a85a2f39dc28c032f028445bf361c10b6a050d90f5633ac5323e5cdab467d3f0c61c4739930040ac99ab7d0aa95a4c3a190c434fb698b6c40e52
SSDEEP 12288:WqzM40LKU3fvtcTPawyHrMPOeosp0q6wvalxa:Wo102UP4kAPbosp03wva
TLSH
T1AE35F601B626D78FC6A950321E76C6CCAB707D42FE05AF0772C9473FC476658BAB5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 941KB
SHA256 f1f0bc62ffae5f18747529632d6baef3e6141238f5275f22ec848664926ee36b
MD5 430ce78529f0fac1d5e664bd0528c093
SHA1 cc12644ae1418734c42a30f4861ed99652a507c6
SHA512 183ee15f53159d6f8057f16a554a9b9af0bc61aa948adc2cad10f7facfadc65bde89ccfa03626874b44fb1b28359d001af98704a8fdc824604c0c9661ee64f55
SSDEEP 12288:8dn5ueIZTie2xvVnKBFi3QIc9+XthONs/MZnOOVdMsFG7sjGFMPfuRPMm:8dlj5hsgAIc9+rkZOOPjs74Gy6E
TLSH
T1CA252905B177A74FC9BA4033023189CEBB74AC16FB4A3B0573884D39C86AB59B5E57D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 1617066bb7411f69386cfcb9c603fb9fba46a5a45fccd6e953e01504dcc2882e
MD5 d3d1541a8fa53c6158ecb9052edbea6b
SHA1 bbe2d6ef24e9a85bda0b3ae8340996da3248f556
SHA512 73da6f15f7c5a256a0e941363b2edde2d9920168074aaf98a4a141ea0339ea50b1da48ff8b937e9f32a0bbc5b5d174e82558caf536d4f22d2ba534b005964933
SSDEEP 12288:3z7LOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:3LA7Nnm5uqLazZn3zAj9
TLSH
T19945236391954627EC7797B0B2248440B0CAEDD45B9042CFA710FD4F2A79EF4CE3AA5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0ac6fb49080229adfe08c29958f1683db86f6c7e44c764fe2dc480d613a558e3
MD5 b37e03f6836d0fd00d6d372cc04d5a67
SHA1 1db905a36c650ed1e7bac0280b46a757f299da1d
SHA512 1c42304211bf9df52d888a596c8a33d01dabc2d55bcee4a4de1b94a9afce2fc4b2f118daf4a7c8a8e078cbc31b8d4ff3e5f1dd0133eefda8cbb1750ab2750a83
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY1A7Nnm5uqLazZn3zAj9:dgb4mBIBhGFyAxUsZn3zAj
TLSH
T11A65AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c5836ac5cce6ddb6dc8dfbbb6f529f6d8f55cf3b8795b2ac112ef583820da169
MD5 03c6d589d64a111e348896a3aa03633d
SHA1 34f180bb8106efe9dc7247b4972b40c863240eaf
SHA512 de231534258a85b7da6fed15788d37e48efc7fb1df39f89f35a67956ed75bbce589a74af4b10f7a2bbd39d40d0c7bc4d329f850200bc59b929733661d4ac02d0
SSDEEP 24576:oG88u8FpJqH1bzria7/mCA7Nnm5uqLazZn3zAj9:L7ZFPqVea7/tAxUsZn3zAj
TLSH
T10385F16576E101F1D477D1388A4246A3F6B2B8251360EBDF07A88B561F23AE54B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e38b072c92452f67663fe75d0332914df1e70a65c48e9e684b2325455a4b5d94
MD5 8527681e6df20162943ab598abeaa456
SHA1 586dac6f85886da31daa6be4421e1f8811b392b8
SHA512 791534f837ee33c514df353e8444646ec3bf95c6e6fc67cfdff5a8ab0fe5edc5f2a587472732b881cc619dd898e31855028eb34b13ba5a08c8db84f4b1ffd560
SSDEEP 12288:NHvUrBFrEjwaQWOTzx4gNnmGquqIr41H7o3drt0Y+Y3zWrHzXKYiTs1f:NPUr+NQWA7Nnm5uqLazZn3zAj9
TLSH
T10565F22F62E918E5E677E17D85418609F7B2B462171192CF02A0817F1F77EE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7aee9df7b9ca17562c24d041c1d587a951dd1c0c0c28954782920bb3fcbfb656
MD5 4061475d55009741f2866a1171446121
SHA1 e1efcbd32e06bd8ae7d9de4d4c2817a5c15fc505
SHA512 286a299e3b94b98e94381527f358bc70bebc42140262060302b14fb9ffd0e93e780c7ddf9ce634ade306dbe1beae85a6018580830205291b8cb074062a652385
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmAxUsZn3zAj:1G05lO43bAxUc3z
TLSH
T129D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 2daa552d48603d21f487285ef86a6399574444d1ed8dc542974cdf58dbf44dcd
MD5 297f4dc7506e150e7433fa89827d0519
SHA1 5d3f785553a550ba6927389f7bfacc3658a15f28
SHA512 1ea0fd268aca05c73b919bb67827e9aafbcc063ca431eb457769d713de68e527b774328a2c8eec0464007c2d3b91663f2b98795919b0f95796d864bc568f2d37
SSDEEP 24576:Hffa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQA7Nnm5uqLazZn3zAj9:Ha5POZ3+Jt2pasx2+muAxUsZn3zAj
TLSH
T13F65AE5EA2F801D5D5B9D17DC683861AF5B1346153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7ee44b792fb7bd8c0125f4b95480333f703a4696e3e90fd2f95d1cb1f77b10da
MD5 925a083957a2656f8e5884837145161e
SHA1 c8ff32a2521f8bb28057521a7ac4049e43d2e454
SHA512 b0f4ca1d9b235a619d2268f9edbcbd891aaa2e050f3a8626ce06fd9ac89e90b43a3c401da00e540eafc1762edcc6202a684cc743f39e7006ea471f37d4753af7
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkqA7Nnm5uqLazZn3zAj9:INc/zEOVHFNAxUsZn3zAj
TLSH
T167858B2622E901E4F5BBE1BE89779546FAB17865133086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a6fa221bfb84739a2814429111b4397c8d861c69f5cc3ccb0870f3d6d6696da7
MD5 9188d1f1527e4945f1875d5496ffcaee
SHA1 e807256d059a5cc26e87a30b8290aa6b014ffcce
SHA512 867f15bd5a9ac67ab951c99fe096ca1e73b493412fcee0c0db77c22337c9df12e0184beb489afc278b0763fe3cc44c2e89868b0bea2c41561ecb9bd6ec794286
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmDA7Nnm5uqLazZn3zAj9:Y8MwBtOmDAxUsZn3zAj
TLSH
T19355AF6EB6B846E4D1FAC6B5DE238512E6727461073253CB5390C13F0E679D88E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 16d70c21d6826e121473bd77bb9027208611b9d226ffebb4186fd6053c6ac7cd
MD5 3eaccc0b7ecafd5f7c780bab640cb4b3
SHA1 ecd04565f9572f75e6077f51f8fe05d751ff2003
SHA512 9e4c27d45425c6d56da5f14ae1fe471e19178b5c5da2f0cc1db41489ab924bbb205032f602b7e4fd1e580426f8ed9dfe3e6079dd88251a10cf68f4a7575c58b0
SSDEEP 24576:5D3FHshBIYQgAXA7Nnm5uqLazZn3zAj9:5DVHeBIAAXAxUsZn3zAj
TLSH
T1C275E17EE69C04E4D57BC2BCD6638906E7B138A9032156CB0294C1BA1F6BEE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-14-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/236-22-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/236-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/236-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1124-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1124-238-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1124-58-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1124-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1656-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1656-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1656-124-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1656-118-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/2064-317-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2064-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2064-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2064-110-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2064-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2544-82-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/2544-81-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2544-313-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2544-87-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/2804-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2804-130-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-136-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3060-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3060-77-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3060-71-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3060-299-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3064-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3064-51-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3064-56-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3064-45-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/3064-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3104-344-0x000002A080220000-0x000002A080320000-memory.dmp

Download

memory/3104-356-0x000002A093E80000-0x000002A093F80000-memory.dmp

Download

memory/3104-367-0x000002A083C80000-0x000002A083CA0000-memory.dmp

Download

memory/3104-355-0x000002A083A20000-0x000002A083A40000-memory.dmp

Download

memory/3104-389-0x000002A094200000-0x000002A094220000-memory.dmp

Download

memory/3416-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3416-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3416-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3416-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3944-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5552-41-0x0000000000400000-0x000000000102E000-memory.dmp

Download

memory/5552-0-0x0000000000400000-0x000000000102E000-memory.dmp

Download

memory/5552-1-0x0000000002FE0000-0x0000000003047000-memory.dmp

Download

memory/5552-8-0x0000000002FE0000-0x0000000003047000-memory.dmp

Download

memory/6016-513-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6016-515-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6016-98-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6016-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6016-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6016-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download