1146089a6dc4da320b07ab68379fd3361c89b75f83f34041b5f0130d86ff2f9e

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Size 1.3MB
Sample260709-b7h45act8w
SHA256 1146089a6dc4da320b07ab68379fd3361c89b75f83f34041b5f0130d86ff2f9e
MD5 e508d3f17d21a5560edace659b3230f3
SHA1 ffe57a811da3d1e313907fad82c8b1595d2bac25
SHA512 f05208670191e814463d8010fed5645c16e5f23717de18e0ea58f7bcbd2bdaf014ac187a5402f2c403b991ed594d87f52b3f0c5b6f000172ce723eddffc11155
SSDEEP 12288:lfD34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il0:xcSnnrFb4PM4MYgLxEVyGLm
TLSH
T12455012233E580B5E5F72B3055B896A55A3FBC72EE75D50FB384210E1A76A80D931B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1096	elevation_service.exe
2388	elevation_service.exe
5576	maintenanceservice.exe
2884	OSE.EXE
5344	PerceptionSimulationService.exe
3140	perfhost.exe
4552	ReFsDedupSvc.exe
4368	SensorDataService.exe
2776	ssh-agent.exe
4152	AgentService.exe
2936	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3ba143f784defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004ada04e6440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001dbc4ae5440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c55c4e5440fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000080c60f25450fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000098844b25450fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbfebde4440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d0bde6e7440fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004121a7e5440fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c76fdbe5440fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000beae86e6440fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
1096	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe
2388	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4552	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4552	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4152	AgentService.exe
Token: 33	2936	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2936	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2936	SearchIndexer.exe
Token: SeDebugPrivilege	2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	2928	2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	1096	elevation_service.exe
Token: SeDebugPrivilege	2388	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 4188	2936	SearchIndexer.exe	100
PID 2936 wrote to memory of 816	2936	SearchIndexer.exe	101
PID 2936 wrote to memory of 6088	2936	SearchIndexer.exe	102
PID 2936 wrote to memory of 2736	2936	SearchIndexer.exe	103
PID 2936 wrote to memory of 2648	2936	SearchIndexer.exe	105
PID 2936 wrote to memory of 4872	2936	SearchIndexer.exe	106
PID 2936 wrote to memory of 1548	2936	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e508d3f17d21a5560edace659b3230f3_bkransomware_elex_maze_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5344

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4368

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2776

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4152

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3016 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2736
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3016 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f365e1d50aa35f87e3b3170d678ab40845c5cc94ce5b706a09f3d960f2c2a39
MD5 323835c626b294996a714e3d7e8e6b1f
SHA1 53149bbdcc31787e9acc33e9a64f1eabc8f7d002
SHA512 45534b8382159c80eda8431962bb043b8f3606f46182ff3e0d1c2e5bee09564466e157ed4d884b1327e791d07322c8170789df75c2fac0b3d6ce120ba6ad5b47
SSDEEP 49152:Pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMj4MYPVyGLb:N3q6HjB6Vv
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 572e7fa91f8149d6ba0752e0fb150606b043fab2c5264b11f790a776982f909c
MD5 735fa1e5150ef15722551aaf51f16b88
SHA1 1cf423f5163ab8af1c55a438ecf38c6c94121eb0
SHA512 2a83022801edc56823c95fe07cd14a1d7362d9c068b969648aec70245c882a322ac491d5f101faeac8e6ab7bc8aa5e0a625b22c3ceb7fe45e4e3266570bd5cfb
SSDEEP 12288:y1XLsswWkxy2lRq2czA934XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9J:YXYfDtczA6SnnrFb4PM4MYgLxEVyGL/
TLSH
T17E65F12977E408F9DD6B8278C8A28545E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 d2dd98838c38ee242c2af6afecada9e3090e8f37967d9036659711625b15cedf
MD5 ac654565e7fa2bf23cdce86e4d378363
SHA1 4ea3dde6a2bcaaa441f2377ee0b4ccae76b5470a
SHA512 523fed9da6c28b30bc51e5148f0b93a9b158c23c4c0ab8d2ea2dd5cc36fa4ab8065e2c0d0161cfc26092526549a848beade6bae6263e8626d37de6646f5b47fd
SSDEEP 24576:J0Le5ji0hmxirMrSnnrFb4PM4MYgLxEVyGL/:JPji0AcTj4MYPVyGL/
TLSH
T144859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2f936404c063ed0963e85f2f13672859ff9a64ef10385b0ddcbb604bc5cfb4c2
MD5 b24ec3de847d91c39ee9de29b6caf5dc
SHA1 2f0f676b9a5aeb26c630242398b53e6f147b0a24
SHA512 d4796cadba07b1abad23ef44d3892855172e05a287a17fda05ea8a082015e129530db2401e7d1e498767d917294bf807b5c0bf46e04dad59e8137d4a6e7df78f
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyudSnnrFb4PM4MYgLxEVyGLa:u/ezSC6vUzPvxHjynj4MYPVyGLa
TLSH
T15A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e4a5d3b0642e812b73767b758441c7ebb4ae85156d80fd5274edd1f55842d873
MD5 97ad947f92cf41bbdf8f99665f622a00
SHA1 05546631a7ebab84b4b963418e1c26509e8f7a72
SHA512 c4095b9a90a1237783bcefb257afe6cfcf2495740d0416285a22b9ee9ce12fee4002b809c764429fa70699643e08a4f1d0927682e5901fb60319ac26ccd7e02e
SSDEEP 24576:mVbqPb88hv/l+62SnnrFb4PM4MYgLxEVyGL8:mVO88hXl+4j4MYPVyGL8
TLSH
T1E9559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 3188446f5a92332b932331fd3c7b0fc39114ce2fd77effd698aadaffafba8c4e
MD5 59d176811b9176b478ba5f68a5160552
SHA1 08bf7b2c02c42a399e1603818b5c4aace2b478ae
SHA512 2552def7a9bc6d648055a2c084cfac8ca3a8b9bb707705e63b0d74921b97ed0117e6b6eda3d623b6459eb714f3156fd947a7c6379e91688f5924ca5f9d08cd46
SSDEEP 12288:5Rs34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ili:5R3SnnrFb4PM4MYgLxEVyGLw
TLSH
T1AB4523A76BDC10EACFAE15B0D1B96AC8E205BC61F875B20B6750785B363F20DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 09b1956e681f43d8c30f58760be455b2ca0981f4c8fd69b8e328d7568c71db68
MD5 d9b6569dff3457862fc4c05de4bf8146
SHA1 5bda66a7c3cdae1270712db64d32c30dd18ef1f9
SHA512 d57f08feefa5064e4891ccbf2e7ba5a369ecc7a05c6fa3f9f436bdf1dfcb208cd1986759b94615d3e73793cf114398ece6c29faaec29cce71bf35c23c2c00e27
SSDEEP 12288:2eBNUbTVO86U534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:2JIU+SnnrFb4PM4MYgLxEVyGL/
TLSH
T12765D03BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5a2a4c2d86f38a818dad8766c0b4afbb75d4a74af58cb802cd17928603b957dc
MD5 43a6b2fd3831ca17e241cf8d34899653
SHA1 489c1328acd6bf22f75cd57a918a2524f49261be
SHA512 df7f73811d9086b8b8dac7b569a2a5366a3681180b62f19e7f4bbff50ecafce80ea989e717668617055a99d8716c610b8ec1f7b33e8f947afce52d32343ec8cd
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:nQvGAdlCEL8c/yRNw5C3Vj
TLSH
T17C267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 65f6b890c93d659339fbda65610caec4efb07e6fee5d59b7b2980b91afb90ca3
MD5 804e048184f41e54595086ad891c4f3a
SHA1 2631f87a6815ae61c65271485fccd7e0cbc4fe59
SHA512 fc836a38c792d51fb8621cd748cded60d071548d8523ac618c56638c8c8d9d315cd6d2778ad2c5119dcce234372a9f13490125292b57283aac941317574ffa16
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAjP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAM:jdewsAjQSnnrFb4PM4MYgLxEVyGLP
TLSH
T11175E031FE74E036C7BF0DB21B36D706542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 045d9a899b253ed6c9417e0de530b8818b42dc0c53869fc5595308784aa24efe
MD5 afb08d53bcebe17da0ab6248c3a1a372
SHA1 38a47e44bdced911da94757e082e5735522e11a2
SHA512 76f7fae7e1950047c7b7a2f4fa279d394ab03c0af895574a029a026f6f51ac54513410b6185e29d35397cf375b16fc17221dccdf30511993bd228ecd9954cc7b
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:FUEtQevvqc2W1cpV2EI32
TLSH
T103474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc2e9e95b3d22db9a0e07b69c085355897b2b540804f9ae59f6e6b1c55b65b68
MD5 c0a847e4b208380e33415767b91a1456
SHA1 d64deaa1da74101d7faae6277cf10cfcbbf5c2cb
SHA512 83911efdb08256691ea2ec4b9f10d54aa5560abf7da888ece189e7543ef881a9e8db451af83f17a4d59b56174d589ce97bef476d1f0ea39f3bd641857e4bee4e
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zDj4MYPVyGLS:XoqtVjnmLV+
TLSH
T1CCD58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1fa4931eee9c3a0ad761c432fe2170cd34e6b643683a48de966984ed266e564b
MD5 b1d2c89471bdfdf0f1b4042bf86f091c
SHA1 67723f3a3cac4b3e8558c5f211f696a8b8b7f78c
SHA512 b9e78751eddac2458f019c0a0485d855517c857fcdd519a8a7aa31d29cc5c8d4dfa506c544a6030a20b39196870b2420bae40855c684b095e3a9df9e671bfd37
SSDEEP 24576:1AhGLJIFoiwtA5l7S53RSnnrFb4PM4MYgLxEVyGLb:1AMyFoiq56j4MYPVyGLb
TLSH
T1EF35AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 db517a862c1aa15fcb920bdb21251df581704af36d80e621ba02257c887d4657
MD5 0e5da02be4e50f5613118926b3f1cba7
SHA1 f11a6356930849a69b109bbeeef7c2cb111832e2
SHA512 3941123d0a09a4b6f9dea3a4f42a24ec7e17176125c8a3e59ad8c01ca1a98824106c2e3abbf146947f1b16fa6abb35aadebc63a6415907f47814db1a8394d0d1
SSDEEP 12288:umw5HEjsChNVBFgl0WDm+CG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq2:nwuoOWUSnnrFb4PM4MYgLxEVyGLY
TLSH
T1A265F14637E81CF9EAA74238C5978535F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8ed7f3c28cec74d62f272cc7bfc890b57a4d9939a360cd221575c0fde1fe1ab0
MD5 0bdd15d578a0d72e1cbea7b4a50fd3e1
SHA1 6af6f14525a39deb3dd2c37e06314d0c9dc022cf
SHA512 d53e1107458ae55840042076543adbca7b2fab01999a26505d3fb7fc29ef54ea2bae93011afd0b1020aff8b90e693ef577a7eaf4465355a35f6c4a95b2f5e663
SSDEEP 12288:tBZ1Iyf34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilX:LZuTSnnrFb4PM4MYgLxEVyGLJ
TLSH
T1125512AA37E820FACAA74274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc8e53a19001fd93bc05ab86fcb0c75e12cf954c3ba56a79d8e7837bed267dfc
MD5 b38df745934e85df50ef0dde6d613993
SHA1 8ad1269e7b85b7c2d4418cde2177357186b51b05
SHA512 b1d70fa2749ef2acfc1676fff75539cdbcdfae7d52811cafd373bc86a2ad317cef9d0976559d56f672e789d6533267c62b88b042072c9277fc471ac9e2a3e776
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:vQRQyi36YOcPQLvw2gAf+PN3GVt
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 27b305c71622015b217903f4270126f3fd1edce2de5dd209befaaa888ce427f5
MD5 80d467765b65e2e88ec58303994b5948
SHA1 b67d4073354de0009fd1d1cd3bffe6807831c2db
SHA512 a01788fa63675e39a489dcbb166f91fccc4f6141a8c602ee2d6040a10876f8fc12bd55eab5707f4926e9aa39a061c6da759172c032f37250373d774fec779117
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:EQRQyi36YOcPQLvw2gAf+PN3GVu
TLSH
T19D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d116674bf3510891ac5ac4fa618545237ab7360eef834757c43c507d1331dffb
MD5 8c9899b5969ad9c5fa2578ed329f6b35
SHA1 e684465a5646685ab2b03fbf7ac4da47b575c35c
SHA512 78ac58f8f3d9282068b4bf8bd719f2b1686456c370bab8e3974a5365f577e7902703b4dd65e0f2e84abca94faf29fafc04ee265c2b98fef22db3063ada52cc4b
SSDEEP 24576:ZwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0DSnnrFb4PM4MYg9:F68Qg55nhheWu7PNU3/Tj4MYPVyGLC
TLSH
T162B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d35ffd8b980d4b76d26ad9711ae3fb8600a8c8c7fd36ab3a97c54d755366a7c
MD5 132124c1d357f1470c9d7ff97d26a90b
SHA1 88460ae9d6d58bea8991c36c4db540a1eb88d667
SHA512 c7d70f345a43bead38deaab9508d6200e7b0fcaced2d92e7c7027e12dd2a73e9ca0d3f4c771f5c837b8064efffb320aa6f15717e5a87d5221b18b87bf827637e
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99G:Qy5112gYy5azzVvL69nLKnhZtVB
TLSH
T175167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 465deea59f1bb1847b76a878d1bec7635fd56d5cebb158511e1bf5ad89f40f88
MD5 9a9cbcf9b52e423b3e860225b158757c
SHA1 2fd04d0fc68854bdb5cdb7c97059f859d94ab79f
SHA512 65ddc02acee0969b6dbf45c57b5d6339ad7e6aafa86a00f2f271df95e6090626eeb295de8cd8c3a66c348bd4e326e9f009c67b427b1ecb88fe31a2bd4ee714e3
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllj4MYPVyGL6:Ru6JmVxd2d+V+
TLSH
T102D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0a3dfd504bdb469c37b40addb04261afd6a4110cf8147490c3a24631bed09497
MD5 c074715a2f1e67a5136e6542205ba965
SHA1 042cc074b88f7401557474f1c798d88d52d997b3
SHA512 1f81fcde1a2073e14a9435392dd4a20979010a5a019354026cd33b5be4a725671ed6c967f7b71575af229877c14beeab45d8cd64390012141ba4c10a507b515a
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4x5j4MYPVyGLu:lmifPbRLVq
TLSH
T145B5BE13F2D900E8D06DD17887569232EA62BC460B34B6DF0A90B7962F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef1395acf82e8bf0d8f68be4d2595db886855d4409a59e273bbad3ae0cbe8ef9
MD5 af91ed511cc3b38b2f811889d05ceb04
SHA1 6c5b0fdc483ec4b63e1fb84a5403817e1c6443d5
SHA512 70aca1f758b03ad3534a53485862d01c6260918a110ac02b3efb6fb9a89433f69b7d2d790708810ef5382171b2cb6eea32adb2a024fac91d36d1bf04dd884759
SSDEEP 49152:NSuZQIY0Be2KRRVtOnks6NMHqcj4MYPVyGLc:D5dKTi61JVY
TLSH
T1A7C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5aebeaf82875367d6a7f0722514131418aa02788a4de9ac991524cb31be18c98
MD5 641476dc3f700aaec3778c87c2e67841
SHA1 c7d4865355a5e9b0bbb9200a4c64e772c29a5bd3
SHA512 f3624b45c19a8b17a6e31547a9f36dd8dfd1c1df5b2c33e9ed3ddcdbba684e0fcbebe583859e933813e3d623f9543e90076e020cae09ca491a053fb7a763f659
SSDEEP 49152:8htSn8EApI0figngiDn0AP5w1j4MYPVyGLS:9X2iyphfVm
TLSH
T19895BE13F2D900E8D05ED174C7568632EA62BC160B39B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 345d2295e21f2f112d1442604d11c5929bd1e3d70a29cd3c0b4eb765fc830290
MD5 8e5bca065fb05187ae3e5bddbef1c180
SHA1 e8405f6a744f6e66fe83a2abe039b2e12bd33395
SHA512 8f609634c769b456ecccb33eea0fe50623f03e9d2288f62526715a4c0fa1d0782ee145a610513803f0b0ad3396fe111177ccb4d79055d306d6b7644923e6a25e
SSDEEP 12288:kU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:kfSnnrFb4PM4MYgLxEVyGL1
TLSH
T1A14523A62EDC10EFCF5D16F0C1A566C8E2097C62F976B20F7B4574173B3B60D6892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f87221dfbe89f3676b24d537fd7b4cb733088ac3c3799019248be8da3795dbfe
MD5 57cb7183b833f1fc0b1c1d5bc2becbc5
SHA1 73d736c63141ee7b356efa4f9295072f29e6e891
SHA512 7738c8f0b99117d3932f53bc45710cfcbdedc93dc5536cdbe6e863dc06bc506ef0b635e0920e3b3f0a2949716bd3b0c5cbc079eb48f1f76c3cc0c9e09f206880
SSDEEP 12288:OT34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:OsSnnrFb4PM4MYgLxEVyGLA
TLSH
T1644523A62EDC10EFCF5D56F0C1A566C8E2097C62F976B20F7B8474073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 24636ee8387143f74b24e60e4125cb97cae4da7fa2da9e363895ee6b97c2cb83
MD5 0e3521f58e75fee3b2adc51308c14264
SHA1 7ac2702a1272a99b3afc09707d7d507051ed6bdd
SHA512 87ab18d0ba5ed69ae1d0c9aa94a75b8c454d5c86ed8682f6f27e16508bc0590a17d13b27122a9982aa1e4348eb742f2eee91c63bbceac385d97f45e0add9a968
SSDEEP 12288:Th34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:TmSnnrFb4PM4MYgLxEVyGL0
TLSH
T1B44523A62EDD10EFCF5D16F0C1A566C8E2097C62F976B20F7B8574073B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 d274ca4c47fe9727a24f850f27c826cce3dfc7e40a7657d8de354b73d730c336
MD5 77ee1e5c08a9aa88b70210fc13476247
SHA1 d38061680ef3ce4f8c77fc1c42bbc88eca073a77
SHA512 f57b2fc35156b6a42665d3e517db1b422e514c602171654675bf5e47bfe270bb99073f6997fdccbdebc5e414d036250bc2f921184506142c537fc4b9bb6ea5b6
SSDEEP 12288:hVi34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilE:NSnnrFb4PM4MYgLxEVyGLi
TLSH
T1B04523662BDD10EACE6A96B0C1B556C8E2257C61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 f3ef1fea17cfc97a5e1273f8abe6d1e25d9faaac694f0edc3bcc0f93d97b385f
MD5 52257d27a979b7fe72be06a3b3a36b67
SHA1 965574651d416ee3faefdfad69f560edfac47242
SHA512 6128fe0d188ab46906919108088058493d117478f28303dcd1abf8148d54f6aab77f4be2e79ce0d087f0a7f857db5a1b96e033b7a1f20c58722ca90f7d96a494
SSDEEP 12288:q634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilB:qpSnnrFb4PM4MYgLxEVyGL3
TLSH
T1C64523A62EDC10EFCF5D16F0C1A666C8E2097C63F976B20F7B8574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 e470c4b9c24a869ab9280576b56f857006b9887ae55ff249ac60b588e86ea5c0
MD5 a725d9e92c41c9f00bf477c01601029a
SHA1 0b71fc9ed99299574e4096367d6e742e4165b064
SHA512 601105e01c2ebb2d5c00c2ad44d5eab43bf1e7c3e4ee202857378a584b2a6e28d6b658723d339b8f256881a0dd37a4f2ab65693964195fef3cf8f3ebea5cadd7
SSDEEP 12288:r334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilrZ:r4SnnrFb4PM4MYgLxEVyGLD
TLSH
T1874523A62EDC10EFCF6D16B0C1A566C8E2097C63F976B20F7B4474173B3B20D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 53dc3867669c36ed5e2317d09e0bb62845769110058c79e41e7c908436a2bea3
MD5 1d1763bae386faf1e3234987b8b3633e
SHA1 b5bff65adc295156e791b0d8a61d4bc961547f6d
SHA512 097750218243944b5de6912b39a716ff0ccb709f9ed17db1f78b1807d804fe64f8df9323180be7f9a0ad88a0155917f43e3500f8de751acadeba8700dcb31980
SSDEEP 12288:HL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilc:HESnnrFb4PM4MYgLxEVyGL+
TLSH
T1EB4523A62EDD10EFCF6D06F0C1A566C8E2097C62F976B20F7B4574173B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 b1b52917aed69842029ad62a064d23ba686168d33c4c1e6846d99ae02bfc8f5f
MD5 bf4fd6487c725a59887381b880736bef
SHA1 15565dd55c7cc33a587a6b16e96ed4fe5ab61d4c
SHA512 c7a37a54d7ca2ff15c3991b57c34602e62cc452f2d5155f8c9c22e344f206733032466dbda53b843c6518470300c1f59b2c2b3089245001eb6f153c3d0a57575
SSDEEP 12288:EiZwb6zzFEoS2cPvyz34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2n:nZMSzFVSOMSnnrFb4PM4MYgLxEVyGLC
TLSH
T1A56502A5739418F8DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 538eff1ca9be8a2a7cbeb8811815e9d6a6f1eb908062032078a4d9dd28b8b57d
MD5 145464767eb12da00cf07be34557d124
SHA1 b9b173b27a522fd82f40bdb49644bb542b14c8fa
SHA512 94cdee5a81cee96a7f704debc8633b0dbb762e4e95ee4fb7f6bb87bd8dc9782b29c0ff8a8302d26b1daf9344f3aa68737ffd46def9f5ddaca50f5fd22eefcbd9
SSDEEP 12288:gQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilI:gjSnnrFb4PM4MYgLxEVyGLO
TLSH
T1384523A62EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B8574073B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 96dead3354271663ea208a2d18f71e16d9d8eb99b99724e81e775d4d2e6dfa54
MD5 71d00903db99f153eb21ff71dfa829ce
SHA1 49fb727f04bc08807cd774799c53ff8581b95ec3
SHA512 641049988d82689e02b3506ce7b1706cc270ba24159fe8c52065879d965163280b6397ec20036db813eb6d74f1e0ab598613d7687d10d3b22c8ace8dbf39050a
SSDEEP 12288:2834XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilb:2HSnnrFb4PM4MYgLxEVyGLV
TLSH
T1D94523A62EDC10EECF6D16F0C1A566C8E2097C63F976B20F7B4574173B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 36cf40be31a91db70013525643e47ea21be78afbc384d7e63cc8d4f0d630bcc4
MD5 43d50ea7f545e9c273cf7bddfe089a2b
SHA1 e52f1adc45399067987c784eb2e16ca1410b23a0
SHA512 e4b655254167910e82e1008e4dd719cfc56cbb7c4060714418f5bc53edc7851f776ca3b7b01bc1ba13bcb0aa1e9aad2020870916ce0f2c6887afce7932f05e7a
SSDEEP 12288:RyPz5L8f34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilvY:AzygSnnrFb4PM4MYgLxEVyGLJY
TLSH
T14A55025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b503854402e568d64bb85a5fa746f0413fc9d449770ec9fe7019d108e0e92d69
MD5 5dbf79e16c865c6ac4dca8819a8030f7
SHA1 bb1a0df194a5332bc4a78517152ccb49bbadccf7
SHA512 71eaff4b55c42820df59c2e4d2e8b8e15c65e819f0e4eba3c14152a418eb18bab24316c1ee60dc6758ea5aab1b229265d8aec9d725ca29cf6b7f0f49afa00bfa
SSDEEP 12288:AQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilO:AjSnnrFb4PM4MYgLxEVyGLw
TLSH
T1A54523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5c9c143a6c82d739dba2421f665dd8bf2b3884333ca7dede89da9840cc732ccf
MD5 a751071d3bb57bc3a155e4c76c17a750
SHA1 091731a0eba38251d05e129ced43751d9c825a33
SHA512 549a7782495916bcc87b48b17665820bd140f50b28910072626c6ca3e542cb03bbb65dafe649b209cc588a024984cac7c92e0df3bc7b974b2d922cc0da0767e3
SSDEEP 12288:yQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:yjSnnrFb4PM4MYgLxEVyGLT
TLSH
T1EA4523A62EDC10EECF6D06F0C1A566C8E2097C63F976B20F7B4574173B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6952cabdd5525ed73ac5fcb09102038e1d3b73a2acfac8db43472d67c3b0660e
MD5 1954a10df0924bc03cb954773f1e57bd
SHA1 43d1b4573ba489858e6a20bb91842a5b79358d96
SHA512 df22a2849510350939e45d379c0b77cc4dd313afa8c0fe169edaba0f64881180a13be2c73fa7d51989c366f4bcd8fc6cfd400d3fbd4c586e99a65312e42a7b43
SSDEEP 12288:dyPz5L8f34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:UzygSnnrFb4PM4MYgLxEVyGL7
TLSH
T16755025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 05084a130cf34c8e189941927a0184b28d06d3c2547e7e8e281a247fa0327112
MD5 b783cb861ec5200a044cbfc8c47ce6b7
SHA1 fb1debdcd13defcab2bba4dbaf17b43b69d039ed
SHA512 b9e295709be701fda0d0a26753436ed645a482e6923b81a5422563d85995d2320c223e02fc2becd6bb6ae7cff0d4446d1bb3b144a0e1155a3cddd832b2824642
SSDEEP 24576:XTHaLl3z0zDWSnnrFb4PM4MYgLxEVyGLz:XT6Llj2j4MYPVyGLz
TLSH
T1966502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 289af2558a8f0e4a1d1ccdb8692970ebaeb36e9acf36a26b8784d67f611f7485
MD5 0f64c1517534e137f4f512cc8a16fe42
SHA1 bd78acad2e3cc179a4b6dec81efedb7a88e34563
SHA512 b17f63c09ddfb001ef259c941502e5cec4cbbd7a1041e05714644433f2dd46a871a58c96b2b56f799b1223a9af7267936d9df9519edb905137bb10bdecd58cd9
SSDEEP 24576:j37d9CHKy7GZiSnnrFb4PM4MYgLxEVyGLI:D7d9CHKyabj4MYPVyGLI
TLSH
T16B75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8bc911b511fde6b0f45366f434dc87e5636fc555272383cbeb61b9bb7ec2feb8
MD5 f89365d28d43514c51ea78b78df1407e
SHA1 bbbc5470bb670934e2e699bd2a69c12af7e60a98
SHA512 258e8bc2e0d554f1c6916bb309584514c4067c3484f5680ae66f51a5710ab860bfa9c161d69d14ef9cd79453e1ed48f969e5087ca52570060a53770e0dfdd952
SSDEEP 12288:eB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:eGSnnrFb4PM4MYgLxEVyGLq
TLSH
T11A4523A62EDD10EECF5D16F0C1A966C8E2097C63F976B20F7B4574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 656c9c025c08b2bb2c07b990e4faa6d0c145e74488571b17fb68c747e02722d0
MD5 0bbff3ea4584352bec9c7465cd9154db
SHA1 b5ef246de14b839a13ef8ea6502a7acef170abda
SHA512 69d6852dbe93b813eaca53ffb1a613338930d425228e105c7acb451d538a1dcab78bb94038f2eb820d2ed85def7a510684a91741d929714bfe25023dc9807741
SSDEEP 12288:O/34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:OASnnrFb4PM4MYgLxEVyGL0
TLSH
T10D4523A62EDC10EFCF5D16F0C1A956C8E2097C62F976B20B7B8574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 dd366d9e21bb1d759f3fec2490305e20b6371d20de0f6ad8995e16276083c07a
MD5 6bf3b8d74ea069339f369c6e350d4a3f
SHA1 de381c1db40a690989df65e16159ee2e3bec93c2
SHA512 350c3d32a5ce768a9d917b08dceda1876f871496c69c22d2d45fdd05c44be00512c81b0bc4e7ea27d0c93779bb47a1c30a6322fe616d5f1e8b0ae85eee3a1338
SSDEEP 12288:le34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilh:lVSnnrFb4PM4MYgLxEVyGLz
TLSH
T13E4523A63EDC10EECF5D06B0C1A566C8E2097C63F9B6B20F7B8574063B3B60D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9f5e834ea0c0d0a602ba1563fec12f0a771b2e0c8ddcb97d832154df64fe7b78
MD5 b99b03b55ea543b5b7269942ee84d5a1
SHA1 ad191ff2a860719b12e0d881735e930e9eb19594
SHA512 330a3517cce3e13f1ee803f093e129e9f76f3eca354ba601841c92aa01a43a6bbf5559fa1cf9825ee2486795f11fc690faa43d84480d1a6943fc3bb3a5eb7757
SSDEEP 12288:WQ34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il6:WjSnnrFb4PM4MYgLxEVyGLg
TLSH
T1774523A63EDD10EECF5D06F0C1A566C8E2097C63F976B20FBB4574063B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 09e3ca613f894f671f534b6e4b69ed37aa21b696f3838014451a4aa1a47eca2a
MD5 f5729fa1205d44345171743e9bb3b3f1
SHA1 9f33252aba1fb9c77abf3c993735c2392a8dcc50
SHA512 832fa4d907875b29ccd750e6d9d912e1c582cca93c5493ea7f9b5a6e702c629f330da6e3ccd15bff2a12f5eee8dd52c6f1eec68c444f77b676ddfba14c8e1bd4
SSDEEP 12288:ZB34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilD:ZGSnnrFb4PM4MYgLxEVyGLN
TLSH
T1404523A62EDC10EFCF5D16F0C1A566C8E2097C63F976B20F7B8574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d4046a3fdbd4ff81196ba8363fa7e14ff3657266eae36e2a83c120f659acdacb
MD5 ac97070295a72411beb9838f2a2684cc
SHA1 d0da3a1dade7511970820060f31756af36eef215
SHA512 519921c33f35ffa2403e73ea01338ad637bf9762b56cce009e1ed5eb4e675b39c4dedb1c823505199a78741a6cf7c168ac2d1bc90b8cbc1161c63893a59c9f65
SSDEEP 12288:dI34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilm:dbSnnrFb4PM4MYgLxEVyGLs
TLSH
T17D4523A63EDD10EECF5D46F0C1A556C8E6097C62F9B6B20F7B4574073B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 20e176d44cb4c961cd8c40e70aaf1177c262f3dde59742981f9294293462f60d
MD5 f85ebe13c626f50b100ed9b3bee37585
SHA1 6095d603b5e87555900e1a598fa39b7705b29ec6
SHA512 021947f657eface5a523d7b706a3fc0a55779e720cb0ee4b5537511cc48300eba2b420da8e26cb4c0987f758d342a8b4f0e8f61b1a87c2dbae68baa2517868a8
SSDEEP 12288:2634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il3:2pSnnrFb4PM4MYgLxEVyGLh
TLSH
T1AD4523A62EDD10EECF5D16F0C1A666C8E2097C63F976B20F7B8574073B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 daf110bebba66d0309fd5c6e35a8e9a8c1e85b8d149d2723783b4712f03fdb5f
MD5 4b6a63cc6a19a85b9dbc2117d2d9bbce
SHA1 04cb4975b59d7232265e0264ea284b056aa87766
SHA512 27c0c445f0b97a046a31c29198a9e31833e68d87f21276fe964fa147da23ab0d357da5bf66f75b3fb0a7dc4311d739a5ec455d80c5b857191e8a851de5dd2f8b
SSDEEP 24576:6fwvok9RX6wkyAIXSnnrFb4PM4MYgLxEVyGLW:GMnYIQj4MYPVyGLW
TLSH
T1B585D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E1E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e54676709e3cf64c955377464374371872c7a4f7d06b6cd71686acd57002404b
MD5 9493cd0d19dce3dda05b2089e0304752
SHA1 c3a781ac068731cce64336e08a5f1c58cdf5950e
SHA512 6823b393641eeef1b3362199a343999446d51f7ca6d96ec823d703a8cbf32d6ef2d680cdda73f997c9ce2550387cde78a8fa7f46855604f5baf2f6bb86fc289f
SSDEEP 49152:YYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Vj4MYPVyGLX:mySzPmV7
TLSH
T16C066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3a3a284734e15794ca00b7a841cf01e84dd3bc2c1ab0357a34d101f36c604245
MD5 e8d9c09525fc9dbc62f366c8dc686f3a
SHA1 980bae839f054f64b6c683a3eaa4e19a0ff39f65
SHA512 59c4faa7c0c7bfaef584676482e01fcef073d83a10483fd0a5e13b154aa4045e68534022094fdd56f4c74492cceef3b2eacaa241e3c3a26a4f95166f7a352e52
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYcSnnrFb4PM4MYgLxEVyGLp:o47JUQj1irIhCnDHUPfF/lj4MYPVyGLp
TLSH
T15665BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cb3ef9241f5eb9549f6f25247a97b3bb80cc4e41b2dae38400c2b7d3cdd1c8ef
MD5 ade8c26af78ef80194c90a5b59b60180
SHA1 c03f58209a85a7a870944c192632d7a8c75c650a
SHA512 e58b76efc0371069933ffbd6ae78cdaeaf815b9c578ca8c4f9d210df6a6354c48971e76094a0ba3b9ddb7fcad0c140079eb31960baa39ae5b130bac25303367f
SSDEEP 12288:MNsfA34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilU:9TSnnrFb4PM4MYgLxEVyGLS
TLSH
T15A55F15AD29801E9C56E6271C3565A84F3237C2197E1E3CB67C0F43E2F3A6849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ae9b5040d108f56559717ff7025600ade7088a993a8f36d8e14d4d7d72b492ab
MD5 cc83b36e7cb54a87835fd33c7c5da911
SHA1 df85dd30c64cb085a8a2cd1d4ea1213ab81aa98c
SHA512 c386ca7712e7096c57331c424a91c0712f591cf876512034279bf56c6452c1a50e5be6e70769c3f20c75dfbfc5788c7ea597b02d7ed6e5f32938425b1c2c2f24
SSDEEP 12288:o3vLhEIli4CNTyQBenWbEHRLq1AWZ8ekg3Jd04Z+zy7W:o3vLW0sygqSEHtq1AzdgX9Z+zy7W
TLSH
T12B452811B626D74FC6AD40325E73D1CCA7707D41EE44AB0772C8572FC5B6668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 857f4fbc80e0304b5f9a4b591df7680aa695e037fd1e12f51a582bf7df142ddb
MD5 3fc4f7cc542217855f8b683da55fff99
SHA1 2eaac690c7fae84640d13aaeccc429526b4e9ac7
SHA512 55c02f9bacf92ebd01c9f0855fa76f0e458b8b3b2886f306195fc81f87ef53a74f1413d413d619d18600e33dca59064509399bb9e43481f57daf0fe44b42f228
SSDEEP 12288:7O/MsMjcRyPuzPkGZKQNW9UoRVAgmtziwZen:7O/MsMjTP4PkGkQNW9UYVAfen
TLSH
T1A165E9406536A38FD1F7607203369F8DBB64AC02B7456F1673C8487AD86AB16B1F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7b43f685f273df08bd83fd30fa0b3652efb1ffe2a91b20012ffb3cd4db546d85
MD5 02a473251a48100926363d09f7d45ab6
SHA1 3f59e40e7595e6f350f429362f83afb989e2901f
SHA512 45bbf596f4ae6e6f211062f056272d367efd6bebf7b86427a92ed8adbe61a58460bafae1fc03e956297640cbc564336d7ebe3dc105808ceac16feefc7ec3bb83
SSDEEP 12288:2M7434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilx:zLSnnrFb4PM4MYgLxEVyGLj
TLSH
T19E4523722BDC14EADE7D16B080A95698B209BC21FF61F18BB7407446363B6CC9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 242949122319e942e4265c926de66bd9cb58871236daea1db176d91cdde4725a
MD5 e80bfb16264085552a78da035eb1d529
SHA1 0d03098a61ce1a6681ce15c8cd6d4d964f09ed89
SHA512 1311d7009720cd205d85f26f6fa66f323651fd76e00704cee82297d783b6de46f034f83a84b65eaeb019c2399c9ea1b46149897979325c7ac211dd1c1562b49c
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYdSnnrFb4PM4MYgLxEVyGL6:zgb4mBIBhGFPj4MYPVyGL6
TLSH
T12E65AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 570ccac9493980c1651268cabd7d76b47c946b339ac9f93cd1658ab91157ac38
MD5 c28720f0fdccc5c351d5aecb8abc0f07
SHA1 4896eb33e3f25049a68caca25ec42fa7d5e5a5ea
SHA512 fff8c4879e95b5a70205614ab7f1c2d09c7f074856199c0deddb4a8e7519ad80e9ddb70f1c45f27b004fdf59882adbc0cc80df99f9c201c3f66e7516bcbf8b2d
SSDEEP 24576:vG88u8FpJqH1bzria7/mMSnnrFb4PM4MYgLxEVyGLS:e7ZFPqVea7/Oj4MYPVyGLS
TLSH
T17685016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 74c4a3d8a75db113593f194cee0efc3dc2505ff789970d5fcd2ee96ab400603a
MD5 93e22619916b3a46b35863e51cd2f1f8
SHA1 f4905d8019f417452d2e23ef282a69ad419c4a9e
SHA512 665171a87ca605fe72479b5585e23000a410244860fd04b6ad3b37f364583cef94c6079b437c054726f912527b599a3413d29bab2903af00fcaaa9fb6d9ce144
SSDEEP 12288:6HvUrBFrEjwaQH34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilP:6PUr+NQISnnrFb4PM4MYgLxEVyGL1
TLSH
T19265E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 71d63af7b4b3545ce1f1d7c7e916e038c76965bef61f580c1d7ec4ab56371142
MD5 f32237e3d7eb22c0f194fc23773e878b
SHA1 0fc2d9e61c1edbfc943394be3da27e5596e9209b
SHA512 fd5a9394a403fac9402e053ff8e1bd47fe37b2594097e9e5def75772e5f50f4e85caa99a07272477fb9a3bbf971055e5ea847035a1a6e23fdfb7e3792ec978f1
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLj4MYPVyGLz:MG05lO43b1V3
TLSH
T16DD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9e5e9444c5a47bccbb331af9ded152b6e46fd2cf818c453e2b7338b1aa92449
MD5 a546af2032cfbccde763735dae5ba7dd
SHA1 b41740ec3236cc260d50b52c0fee45337b3dee2f
SHA512 1d075be10ceb5ec2790debec5b25d563b3c4e3196ad5375fefd555199deaf65d993597fab2c92c4233db6c3a0de05234fa5bfa9f2e9b00c7ef772296d4faccf1
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnaSnnrFb4PM4MYgLxEVyGLu:qa5POZ3+Jt2pasx2+mTj4MYPVyGLu
TLSH
T14465AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 636cff43fe840c80d919486bf9a1ec707ccfce38fe6c0fa3498f5bcf2de0e3aa
MD5 b6255b33dff78d806128532ae045fc96
SHA1 777c66186c89f98a50fb655e73cce262d2a731e5
SHA512 74f9e581df2b6dedc0541a2a236af613f775bf422a02d793e5f2163b15457c56212f79bd578fb3a3e782c90a9a8fab362864d67109dad1bac3de2ea731d9cfd7
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7Fk0SnnrFb4PM4MYgLxEVyGLH:LNc/zEOVHFuj4MYPVyGLH
TLSH
T1C2858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2f728af8af6f2b9ff80af12311b15e428ae95aa78bbcb5d90e990c07407690bb
MD5 adf403253c8c2b5fdb1c46a0750bee51
SHA1 15612dec4256a07a040747256507f64a25f8b6a2
SHA512 386d6f87f2e67b1cf167cb5aa7593dc3eef2e5ccf0211c0a74764571dbcee4c8245a1366930206a1ceadec87b0242d3d8e9264b2c2b00f288b58c197419ab56e
SSDEEP 24576:F8kNvNnaFeYhJNtmZBmOSnnrFb4PM4MYgLxEVyGLN:F8MwBtOmpj4MYPVyGLN
TLSH
T183559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fb18c84fb583f81db51304c451c3ce92c9e430154e8ac2c8411fafddd10038cd
MD5 d8563f1eb03725fe282d6ca17cdece88
SHA1 316ea04fd5f534159ebdcc2e705d3ee25a21f057
SHA512 698bec905d17ad59d71c5c64f93d311a64501fb3845aef8447cf1d30b98e6381cea0254528e0d7aa546e97edc022572033f33c039fd73710cec14a3af0bb2d7d
SSDEEP 24576:zD3FHshBIYQgA/SnnrFb4PM4MYgLxEVyGLR:zDVHeBIAAYj4MYPVyGLR
TLSH
T15475E17EEA9C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1096-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1096-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1096-22-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/1096-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/2388-101-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2388-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2388-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2388-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2388-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2776-316-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2776-114-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2776-122-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2776-116-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2884-55-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2884-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2884-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2884-253-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2928-0-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/2928-65-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/2928-334-0x0000000000400000-0x00000000005F4000-memory.dmp

Download

memory/2928-7-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/2928-6-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/2928-1-0x00000000023E0000-0x0000000002447000-memory.dmp

Download

memory/2936-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2936-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2936-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2936-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3140-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3140-79-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/3140-84-0x0000000000A30000-0x0000000000A97000-memory.dmp

Download

memory/3140-296-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4152-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4152-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4152-134-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4152-128-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4152-138-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4368-103-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4368-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4368-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4368-109-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4552-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4552-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4552-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4552-90-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4552-96-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4552-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5344-280-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5344-74-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5344-68-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5344-66-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5576-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5576-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5576-49-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5576-47-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/5576-39-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download