28515d767ac0e78c6073a36b395f0fab202d678eb33c0f060f2f63d6027761bc

Analysis

max time kernel
147s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260708-ev2mgsbt8l
SHA256 28515d767ac0e78c6073a36b395f0fab202d678eb33c0f060f2f63d6027761bc
MD5 b417c554e33998ce1f8e0cb78c65717d
SHA1 2b09af3926ef8d571ab2a4f289c38004cde76eda
SHA512 a410b01515b47b113ee724fe2c4f40cd85908cf7e8fd5b5a09f18703fe9d11f3ea2db5a82f16f0e60d6a0685535835d71074a8459743fca5f40d70298da998be
SSDEEP 12288:mg49H6EAceNwqAdMkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:949H6N+qnbf3BQIMqixcOobas
TLSH
T16335BF02B7E99134F2F31B31AFB952555ABABC62DD35C60E23C4160D0DB0A90EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 17 IoCs

pid	Process
3824	alg.exe
6088	elevation_service.exe
1656	elevation_service.exe
2132	maintenanceservice.exe
1176	OSE.EXE
4532	GameInputSvc.exe
3448	GameInputSvc.exe
3244	msdtc.exe
3352	PerceptionSimulationService.exe
1836	perfhost.exe
2032	ReFsDedupSvc.exe
4588	locator.exe
2952	SensorDataService.exe
1560	snmptrap.exe
420	ssh-agent.exe
2912	TieringEngineService.exe
3408	AgentService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\28556120d8ede1e.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128406\java.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{0FC46C57-F2C9-438E-9FA1-AECE64B559D5}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{6CCF5FA8-D30F-4EA6-B9D4-1E2F486EE6DA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3024	explorer.exe
3024	explorer.exe
3448	GameInputSvc.exe
3448	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6132	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeShutdownPrivilege	3024	explorer.exe
Token: SeCreatePagefilePrivilege	3024	explorer.exe
Token: SeDebugPrivilege	3824	alg.exe
Token: SeDebugPrivilege	3824	alg.exe
Token: SeTakeOwnershipPrivilege	6088	elevation_service.exe
Token: SeTcbPrivilege	4532	GameInputSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2032	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2912	TieringEngineService.exe
Token: SeManageVolumePrivilege	2912	TieringEngineService.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
3288	sihost.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
6132	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
6132	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
6132	2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
3088	StartMenuExperienceHost.exe
5780	SearchHost.exe
3024	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3024	3288	sihost.exe	98
PID 4532 wrote to memory of 3448	4532	GameInputSvc.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b417c554e33998ce1f8e0cb78c65717d_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6132

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1656

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2132

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5552

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3024

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3088

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5780

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3448

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3244

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2952

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:420

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:3408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1128

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1124

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fb87e7466b44b21b5a0ab9d5bc0eb1910250191637f4c75bc7f53f98accdb3cc
MD5 a7b866cde12610403f9523b44fca3609
SHA1 d5b0e9a5ddf857e2770314f930baeb0a7c9332bd
SHA512 2a5ef7690ed5efe1155940e7921286c7031dc532c29f0f4545b4043b35ef9716283ca0c15b231d7e7523221872071db4f72f14ac00f32d2ac1ed411b2c0e8243
SSDEEP 49152:Rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnybvBcqyy:X3q6gjBxbvBcqyy
TLSH
T15CD59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 946cdab5ec8d013680fecf1d3ccae1bdd8d8dcb2380626fddfee920f1da10756
MD5 a05d0c96fa82fe4ed7b4383003053e41
SHA1 59c63819c6e533cd7f749adffe111fb681766805
SHA512 456bf4e584ceee3d65f62e040e5ba75f704e7b438bc6dc6feed72e4151ce1ed78cca97e2017a207b15a7e5bcf63c61a3bcb8cc8edbbcfe313f780cf4d6c92736
SSDEEP 12288:61XLslBXTxy2lRq2czAtpRkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCR:QXYrttczAhbf3BQIMqixcOobas
TLSH
T123050238A3E109F9ED67813DCDA28501EB73B8558760EB9B03E485650F333986E3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 1636a34a9c54bc92d1a128d1c557576ce807630d1dc72ace7159de8d0df8586c
MD5 61ce6781bc79a1888ac774de75c66086
SHA1 0971f6a786b4f0f5997497d9841dbd72a206f525
SHA512 c5c69021a35358038b25a697f44193b9177a0dc98a7ec82ec8021f6733d762c92683569e96810c16b67a7058262ce1a81457555a23647eadb91debc3e6985bcf
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CQkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSa+:Owu+OWrbf3BQIMqixcOobas
TLSH
T12F05F15577A40CF9E9A781398687D532F7F2B8012A21DB1F1760C25B5F37361BE2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f3dd96473203039b6097998ea2185a917a31b1d34ed49b78432dd33c4014b4f
MD5 6c8468a4deb1cc01ad123ef5b66fbfd8
SHA1 1874af03e4e38c399ad8ac1aa75d5a35259a3981
SHA512 f2546cb84f51e302e4ac69a7178945f59ca1709d45ca9be5b0e1d85abf42f187ba5e2659b9e369742e011e2d5601d9574b9a555c9738852589081e742b27cc3a
SSDEEP 49152:aB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glHbvBcqyy:Iu6JmTxd2dHbvBcqyy
TLSH
T1B3D59D13F2DA01E8D05ED078974A9233EA62BC494B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 f78e501f10adb452b346a90d0c61aebc81919f3492c81ffdc84b3c0db51976e8
MD5 f9a924782a9144bba243bad0186ab88b
SHA1 c86aa1d45a159d2b4ffdfd05062441c8ca2dde67
SHA512 dde5c13727a39efa5a306884927a62ee2353f12a01c87068c06d62d054fc6c606ead1b6009a4cda3017951cefbb3d2f7171559db71b94e031ec03216d205c6a3
SSDEEP 12288:BF7ekSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:DCbf3BQIMqixcOobas
TLSH
T15FD42370C7A50EDBF86ED23A4ACF67116775F114DF41EE9A2848024A08B4781BBA377C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 16c30f0f54ff59e698d3eda7f06b06fe4a422b19cad2448d04e9b6071d5df599
MD5 ef59391a74e8dae32566c2e45ecad7f0
SHA1 8d86c3f9ed69088d7570be935aaeee3f174cde95
SHA512 11ab2cae7518092dcb6e0ca5d90c84f9163bcd1d40b408144900ebfe0c78baf6e18d2cc07dadf4e22ecd3d6bd8961f4597299b53bdc8a1fbc37fb07d20d9b14a
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYDbf3BQIMqixcOobas:Ggb4mBIBhGF8bvBcqyy
TLSH
T16365AE1E22EC02F5E0FAD2B8CDAA4417D6B278164732D6DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 39761967c4d38bbe2978fe498f991c2ca0dfe539bc11a848d0df9574191b18eb
MD5 ba76ef09cff300d6994c4cf41604464e
SHA1 91fd94cb80c5fb389af8fbebde5a6f3bff518b67
SHA512 f89459ac081bfe47642f74d69e9026ace2b2ccff711cc244eff83a25fe5751623f89838b9b65c563baba7756b6a709ff46a2a32c47332caf2840de4c297e3282
SSDEEP 12288:+QGFkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:TGhbf3BQIMqixcOobas
TLSH
T1B6E4237C63F229D9C87AC23A49DA66527AB1F050D7056EFF08D441364EB47E07336EA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 8aa9c21c41c82b3acfc76c9bba6280a4d9f8b1647fd035ebc7aaee325b1551dd
MD5 8b02a4aa79382498aae52fc0b8816b63
SHA1 797a47900bd3930a0b478f59034b0e0ecce351e9
SHA512 dc79711258a6873fec8586bbfb76e83b0cb3e8e8b95eea8a2e200a367b72c5ec75af2d6730d1147821d35da3012e5d7e56cbdda524b45453407ec53f726657ff
SSDEEP 12288:0mkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:0qbf3BQIMqixcOobas
TLSH
T108D423B4C7620ED6E95AC17B4ACF2B416BB1E105DB466FE71898020604F87D5B373ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ee87906562bfcb7deb22f250c967a93216c6aa2d5443187f5b65dd16e9108477
MD5 5b3fb558967654add60c8db7e5acae89
SHA1 9bb32be461478732537c123743b078ff687cb1f9
SHA512 fcc2f093c97b3dc9f476cb460e6eea87047db310ab21c66003269bd26049136ccc8798ff6332bd898a6c20eae9933b35cb0c244b7feee092d226273b3cf4fa6d
SSDEEP 24576:I79858yMJqH1Mzria7/mpbf3BQIMqixcOobas:myiykqVra7/ibvBcqyy
TLSH
T17B35F165A7E101F1D47BD1388A864663F6B2B4250364EFDF06A88B511F23BE15B7FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 5e074004353449781e82571533be2afcc03d37eea124224ecc8d3d649edf5354
MD5 95360cc87f30d03440b8bfbc1fd90239
SHA1 a3f7af5e0d6c64579874155d0045a7406c9a2ae9
SHA512 4bf7e5a2df844bdf7901a96879175719e67a86323970723be08ca7e7ff8f300dcf1a9c36a13170c75b875fc711d9b425d0bead2d3dc2357a19976c06bccb2463
SSDEEP 12288:iHvUrBFrEjwaQ/kSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:iPUr+NQ/bf3BQIMqixcOobas
TLSH
T1F205F12E63E81CE5E67AE13D89864709F771B4525712D6CF01E0417E0E67EE8BD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 35c9499fc22bb14f197d19338e64325cfd1ec5d28a7bac4b1ed386a09b4b562a
MD5 423fd1170b6d13ae2ad8e1ed7edce7f0
SHA1 dd5477241e1f85f83de9a210a9a48d60fdfc3598
SHA512 0637d38149e85c08424437520a529801fec97056fdd83caccfbef34ece8152b0e12e9e4088ac0e47aba895589dc7b6694b95aebdc64d0d9e92544341cc71cea1
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjabvBcqyy:FG05lO43bLbvBcqyy
TLSH
T1CBD5CF6E62EC11F9D1BBC17CDAC64A0BEBB23415032556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e0beeb6da4b32158490bcb32715c01b9cc335cb35ae1f5bbd7ec23aaf9e937aa
MD5 d5f219f9b513c575c6588c0c5aad93d7
SHA1 63c1b47b81f36ff0f89c41d7e0a0b5f44a7bf299
SHA512 fd50c2993090a9816e3d9d93cf1256b0cef2c1976f48ec4b55257420854098f312b5ce0b38ddb447685713fcc0cc1b08b6dd363002bdcb5866559a64e7f9c2fe
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7FkYbf3BQIMqixcOobas:TNc/zEOVHF7bvBcqyy
TLSH
T128858C2623E901E4F5BBE1BE89679546FA71786553308ACF0291811F1E73BF46C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 28e3fd22785c65ace9efae42767aed9e14e28f9137dfe8c0c06a362c51e43d1f
MD5 cfd9916fad4b93e88956f7cbc40bcc47
SHA1 1255e7e48513ac62c2bd5574f4c13e6e85673613
SHA512 1a576fbfd4b1711fa0456e554074433b4edd4f9ecdf650cf3a1ae5ac90c200b066c8795e2b5fae115f735a41de07675b61936749ac5b21e128d8b162ebf99210
SSDEEP 12288:J+HPJnJP6szeCs6Rl28dckSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCXB:OJnJPbzB4SUbf3BQIMqixcOobas
TLSH
T13415D03CD2A810E8E4B7C2B4815A1B56FF31346D2B2269C719B4D5353F52FE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 dd4b95d32441644ba02c3a802a66a0ce8180c9481a24432c52b0bc79c884c61b
MD5 cf47802a18f33e862e231d5aa7022dc1
SHA1 97d19b40029de25f5fe4593d70741b86829bac93
SHA512 7f3868e4fcf0f21a8ff102999c1a684d0c38ac83d1246bd3d53468d4c4e4dfb045357a3f59c5d44cc6ec53d50a1b66383556c10cdb00defe8d5ed481d0f87265
SSDEEP 24576:ACLHGL0MoeVtFumTijCmlKQWDkYbf3BQIMqixcOobas:ACLHGeeV5ijCmlDWDkYbvBcqyy
TLSH
T116A56B05E7EB4184E8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 661d7b65626add7ddde9fdce67f6edf935c396c3078aa217b9c5719d87b7c790
MD5 24ed9fc846b9c97701fba7409d3bc21f
SHA1 6632a7c1be5317d1a11d8f1d92fac8ea9dfc65cd
SHA512 38811b0786a6459ba9274ac706118847570fb727c599410ee4cc2c085aa91d39fe581f168a1a934ef9eb09604980a6387103da149b51278927d9bb3f61da6bf5
SSDEEP 12288:WSHck6j5ZI7PkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:h6DIDbf3BQIMqixcOobas
TLSH
T1E3F4016C637611FAD16BD03E86870602E2B2F071D7525ADF0AD4817E4EB3ED8B939E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 19cee3508cc520dd31bb284a2f3f82cd069eadb289b7591f57130f48710154b3
MD5 7706434c6e4f3b2b6b4c061d9ad49c29
SHA1 216b74b765fb9dfc24ccb346e5f25c8a9775a722
SHA512 89e6194677e7e8597275be6ed8ae1c4d6cdd2722cebfa6419e487c8d9e38f4b44c2604526013ada2b93aea92bdfa7b9e8b59713e6b1a93ac42427e5862ffcbed
SSDEEP 12288:1G6kyUkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:MtyMbf3BQIMqixcOobas
TLSH
T12CF4221493A415D9F9BA82398E9753909F31FC20DB129BEF14D0932F1E757D0BA32B68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 0df66428d5d7503f07df8e1c2adbca235ebeac77d9b03ce5b6d016d5ec1923f5
MD5 af85717e39a0b8fc0301e10521a98759
SHA1 d41f9d74a1351112f251be06c1db3d2953fa0ce3
SHA512 a50bfeedaa41d3ac1072909ab828d84fc01bbba21ef8f9bcb41084adb8cfe88407e4667ed5bdaa1935d1907655045568b15f042cf54d97f8f36ee14a9cb31e95
SSDEEP 12288:5Y8EskSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIzr3WSaCX/T+i9:W8Ekbf3BQIMqixcOobas
TLSH
T1AAD423B893611AD6E859D17E0ACF2B815771F024DB066EEF28D8022649B83D57373F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 b7ba653ed72700f0eda0694a0a5640c598aafc62e3e5b773fc722c719dab7a3f
MD5 3c49f468b5788e56533b00f8af030748
SHA1 b6ab3fcb6b31f25a2cdf910bc1e6ebe8aa769f3c
SHA512 b85bb2e39ad8fdf9bafda7388b49225c3d07ebc4b01f97835484ef7d620c0f8f3b3e8df5fcc6aee39005d65d0257e5f0d204fb8db81bac8aa622fc40a952c9b6
SSDEEP 12288:/cgIuZyFDK3tT5Tr7aVLIH9lH3cXkSo3TUOIR/akEyq8AS3BQE+AVPMqixcQZIz/:/cgILoTfaidZubf3BQIMqixcOobas
TLSH
T1C1559D1D63EA05CAE2B2D239D9631493D633B4315772D6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 1bb8c3d1d972b3295180adc20daf42aaeee4277115eeaef76f6d98ae5b30a1a0
MD5 e2031bbf122893f1166927b7b41c18bc
SHA1 3e2d057ad499ef6d5622b23a858d42233357437d
SHA512 c2b8c20385b5a277df9b0259df5075933556febe60c2decfd35c4ffe920c41b5691047ab575189c6f70efafafd6c9fedb086ad5faad0d1b09e4449d0c457c4d0
SSDEEP 49152:vDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS33bvBcqyy:E3Upow8sBybvBcqyy
TLSH
T155A58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C178BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-521-0x0000029BDF570000-0x0000029BDF5D6000-memory.dmp

Download

memory/420-519-0x00007FF79BC50000-0x00007FF79BEF2000-memory.dmp

Download

memory/420-522-0x0000029BDF570000-0x0000029BDF5D6000-memory.dmp

Download

memory/1124-559-0x00007FF698BE0000-0x00007FF6990B0000-memory.dmp

Download

memory/1124-561-0x0000014315850000-0x00000143158B6000-memory.dmp

Download

memory/1124-560-0x0000014315850000-0x00000143158B6000-memory.dmp

Download

memory/1128-550-0x00007FF6FF870000-0x00007FF6FFAFA000-memory.dmp

Download

memory/1128-552-0x000002319A080000-0x000002319A0E6000-memory.dmp

Download

memory/1128-551-0x000002319A080000-0x000002319A0E6000-memory.dmp

Download

memory/1176-58-0x0000022593A80000-0x0000022593B5E000-memory.dmp

Download

memory/1176-61-0x0000022593C90000-0x0000022593CF6000-memory.dmp

Download

memory/1176-59-0x0000022593C90000-0x0000022593CF6000-memory.dmp

Download

memory/1560-510-0x00007FF681F00000-0x00007FF681FB3000-memory.dmp

Download

memory/1560-511-0x0000026904B00000-0x0000026904B66000-memory.dmp

Download

memory/1560-512-0x0000026904B00000-0x0000026904B66000-memory.dmp

Download

memory/1656-38-0x000002D405CF0000-0x000002D405DCE000-memory.dmp

Download

memory/1656-40-0x000002D405EF0000-0x000002D405F56000-memory.dmp

Download

memory/1656-39-0x000002D405EF0000-0x000002D405F56000-memory.dmp

Download

memory/1836-473-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/1836-558-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1836-477-0x00000000008E0000-0x0000000000949000-memory.dmp

Download

memory/1836-471-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2032-483-0x00007FF7A2DC0000-0x00007FF7A3503000-memory.dmp

Download

memory/2032-484-0x000001B8F94A0000-0x000001B8F9506000-memory.dmp

Download

memory/2032-485-0x000001B8F94A0000-0x000001B8F9506000-memory.dmp

Download

memory/2132-55-0x00007FF7E33A0000-0x00007FF7E3507000-memory.dmp

Download

memory/2132-46-0x00007FF7E33A0000-0x00007FF7E3507000-memory.dmp

Download

memory/2132-48-0x000002A0D2B60000-0x000002A0D2BC6000-memory.dmp

Download

memory/2132-47-0x000002A0D2B60000-0x000002A0D2BC6000-memory.dmp

Download

memory/2132-54-0x000002A0D2B60000-0x000002A0D2BC6000-memory.dmp

Download

memory/2720-573-0x00007FF6AC9B0000-0x00007FF6ACEB6000-memory.dmp

Download

memory/2720-568-0x00000222F6750000-0x00000222F67B6000-memory.dmp

Download

memory/2720-567-0x00000222F6750000-0x00000222F67B6000-memory.dmp

Download

memory/2912-531-0x000001D13ADC0000-0x000001D13AE26000-memory.dmp

Download

memory/2912-529-0x00007FF729880000-0x00007FF729A14000-memory.dmp

Download

memory/2912-530-0x000001D13ADC0000-0x000001D13AE26000-memory.dmp

Download

memory/2952-501-0x0000023A51A00000-0x0000023A51A66000-memory.dmp

Download

memory/2952-500-0x00007FF6528E0000-0x00007FF652CF6000-memory.dmp

Download

memory/2952-502-0x0000023A51A00000-0x0000023A51A66000-memory.dmp

Download

memory/3244-446-0x0000025F0CEF0000-0x0000025F0CF56000-memory.dmp

Download

memory/3244-445-0x00007FF6B4440000-0x00007FF6B4559000-memory.dmp

Download

memory/3244-447-0x0000025F0CEF0000-0x0000025F0CF56000-memory.dmp

Download

memory/3244-537-0x00007FF6B4440000-0x00007FF6B4559000-memory.dmp

Download

memory/3352-465-0x0000028CFB520000-0x0000028CFB586000-memory.dmp

Download

memory/3352-464-0x0000028CFB520000-0x0000028CFB586000-memory.dmp

Download

memory/3352-549-0x00007FF782470000-0x00007FF7825B9000-memory.dmp

Download

memory/3352-462-0x00007FF782470000-0x00007FF7825B9000-memory.dmp

Download

memory/3408-538-0x00007FF7B4860000-0x00007FF7B4B80000-memory.dmp

Download

memory/3408-544-0x00000162BDFB0000-0x00000162BE016000-memory.dmp

Download

memory/3408-540-0x00000162BDFB0000-0x00000162BE016000-memory.dmp

Download

memory/3408-546-0x00007FF7B4860000-0x00007FF7B4B80000-memory.dmp

Download

memory/3408-539-0x00000162BDFB0000-0x00000162BE016000-memory.dmp

Download

memory/3448-442-0x00007FF7AF220000-0x00007FF7AF2E8000-memory.dmp

Download

memory/3448-528-0x00007FF7AF220000-0x00007FF7AF2E8000-memory.dmp

Download

memory/3448-453-0x000002840BD10000-0x000002840BD76000-memory.dmp

Download

memory/3448-452-0x000002840BD10000-0x000002840BD76000-memory.dmp

Download

memory/3824-16-0x000001CFC66B0000-0x000001CFC6716000-memory.dmp

Download

memory/3824-15-0x00007FF675A90000-0x00007FF675BB2000-memory.dmp

Download

memory/3824-65-0x00007FF675A90000-0x00007FF675BB2000-memory.dmp

Download

memory/3824-17-0x000001CFC66B0000-0x000001CFC6716000-memory.dmp

Download

memory/3824-18-0x000001CFC66B0000-0x000001CFC6716000-memory.dmp

Download

memory/4532-518-0x00007FF7AF220000-0x00007FF7AF2E8000-memory.dmp

Download

memory/4532-434-0x0000025A40040000-0x0000025A400A6000-memory.dmp

Download

memory/4532-435-0x0000025A40040000-0x0000025A400A6000-memory.dmp

Download

memory/4532-433-0x00007FF7AF220000-0x00007FF7AF2E8000-memory.dmp

Download

memory/4588-492-0x00000237EFCE0000-0x00000237EFD46000-memory.dmp

Download

memory/4588-491-0x00007FF7E3700000-0x00007FF7E37AD000-memory.dmp

Download

memory/4588-493-0x00000237EFCE0000-0x00000237EFD46000-memory.dmp

Download

memory/5780-262-0x0000023A80000000-0x0000023A801E3000-memory.dmp

Download

memory/5780-108-0x0000023A93C40000-0x0000023A93D40000-memory.dmp

Download

memory/5780-107-0x0000023A83A20000-0x0000023A83A40000-memory.dmp

Download

memory/5780-93-0x0000023ABDD80000-0x0000023ABDE80000-memory.dmp

Download

memory/5780-125-0x0000023A83B40000-0x0000023A83B60000-memory.dmp

Download

memory/5780-139-0x0000023A940C0000-0x0000023A940E0000-memory.dmp

Download

memory/6088-32-0x000002CBA4DC0000-0x000002CBA4E26000-memory.dmp

Download

memory/6088-31-0x000002CBA4DC0000-0x000002CBA4E26000-memory.dmp

Download

memory/6088-29-0x000002CBA4B90000-0x000002CBA4C6E000-memory.dmp

Download

memory/6088-30-0x000002CBA4DC0000-0x000002CBA4E26000-memory.dmp

Download

memory/6132-0-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/6132-1-0x00000000023D0000-0x0000000002439000-memory.dmp

Download

memory/6132-7-0x00000000023D0000-0x0000000002439000-memory.dmp

Download

memory/6132-6-0x00000000023D0000-0x0000000002439000-memory.dmp

Download

memory/6132-26-0x0000000000400000-0x00000000005FA000-memory.dmp

Download