Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 18:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe
- Size 942KB
- Sample260724-ww48faaa45
- SHA256 535a50e09c8b4503eecdab1294d0965c2c1fbda49c7ed0d0145b4da638f8d784
- MD5 3c7848e4166372f8a7fafffe07a6b0e5
- SHA1 1d51dd1a33abb9b9befc2e8d87ea0b132c54b940
- SHA512 eb2fb8ea114dc6e78627c7601e7624be9c13bbf4d018570069c16127dd1566748cbc52fa724744dee6aa66b22444c1b90adf2f05969bf8b64f7d47b11708b6c0
- SSDEEP 24576:aWvFL0v3oPne87HtO/DF1+9codjeWyZxeCEi:V90v3oR2TPod5
- TLSH T1E82512C0F7D44C79F626013105BA8B21A13AFCB04EF92B8BBA8A345F4E745C1595E66F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 3452 elevation_service.exe 5328 elevation_service.exe 2560 maintenanceservice.exe 4744 OSE.EXE 1436 PerceptionSimulationService.exe 4500 perfhost.exe 252 ReFsDedupSvc.exe 1584 SensorDataService.exe 3024 ssh-agent.exe 1200 AgentService.exe 4196 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe - Drops file in System32 directory 45 IoCs
description ioc Process File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\37ac54124febf98.bin elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe elevation_service.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4228 3732 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1645f579a1bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002332f5569a1bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dab8b9569a1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a02898589a1bdd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a69029c9a1bdd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3452 elevation_service.exe 3452 elevation_service.exe 3452 elevation_service.exe 3452 elevation_service.exe 3452 elevation_service.exe 3452 elevation_service.exe 3452 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe 5328 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3732 2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe Token: SeTakeOwnershipPrivilege 3452 elevation_service.exe Token: SeAssignPrimaryTokenPrivilege 1200 AgentService.exe Token: 33 4196 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4196 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4196 SearchIndexer.exe Token: SeBackupPrivilege 252 ReFsDedupSvc.exe Token: SeRestorePrivilege 252 ReFsDedupSvc.exe Token: SeBackupPrivilege 252 ReFsDedupSvc.exe Token: SeRestorePrivilege 252 ReFsDedupSvc.exe Token: SeBackupPrivilege 252 ReFsDedupSvc.exe Token: SeRestorePrivilege 252 ReFsDedupSvc.exe Token: SeBackupPrivilege 252 ReFsDedupSvc.exe Token: SeRestorePrivilege 252 ReFsDedupSvc.exe Token: SeBackupPrivilege 252 ReFsDedupSvc.exe Token: SeRestorePrivilege 252 ReFsDedupSvc.exe Token: SeDebugPrivilege 3452 elevation_service.exe Token: SeDebugPrivilege 5328 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4196 wrote to memory of 4328 4196 SearchIndexer.exe 103 PID 4196 wrote to memory of 4300 4196 SearchIndexer.exe 104 PID 4196 wrote to memory of 2592 4196 SearchIndexer.exe 105 PID 4196 wrote to memory of 5680 4196 SearchIndexer.exe 106 PID 4196 wrote to memory of 4116 4196 SearchIndexer.exe 108 PID 4196 wrote to memory of 4656 4196 SearchIndexer.exe 109 PID 4196 wrote to memory of 5692 4196 SearchIndexer.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_3c7848e4166372f8a7fafffe07a6b0e5_elex_maze_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3732 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 4602⤵
- Program crash
PID:4228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3732 -ip 37321⤵PID:4736
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5328
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2560
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4744
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:1436
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:252
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1584
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3024
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4328
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4300
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2592
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2900 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:5680
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4116
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:4656
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2900 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:5692
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 cac49dd47c42caff44b4f479465b553900ff832433913adec32b73c0e8a9d9e7
- MD5 e0386f868f07a4dfbef90bd2df7f9888
- SHA1 0e4edc386c7d96a509e59696a65c862aa7c3bca1
- SHA512 9bce694f92cdd245b5efee0d2a9b45b990a7a81cfc8981c4bed8dd9028b34b845f6bb138b50a71730a312b4e3749ac1ad3bdf99b67a7c872780be6c125e71faf
- SSDEEP 49152:Gb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnOR2TPod5:43q60jBX2Tc5
- TLSH T103D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 a6104e636e03d1b0f1f850a1d603be9690b319811d5adbf8a38671aea0c0ea6b
- MD5 c013c0f77340f24c7c824936d33c4114
- SHA1 7da6adc59af75c6c6c3c15c8e36885e61b447bb6
- SHA512 125782d8d06b713bdd0686226a24c82ac1698542b34f2a63302363044a43ec782ab36f0ff17cf725e1025fa96198a66fe4ffbae46ce6f1c90e8c2ed555eb44f7
- SSDEEP 24576:WXYfDtczAJPne87HtO/DF1+9codjeWyZxeCEH:VtcgR2TPod5
- TLSH T1BE05F128B7E408F9ED678139C8F28501E6737C9147A4F78B03E4A9691E336D85E3E752
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 564e57c3a66f53f3a2b877a2a1381161015d8c87941f2c7552e443896f64443e
- MD5 97cbb952ab36a5f11d57369af979dc4d
- SHA1 5defb7928411b248510d296f6cd98b28b2c527b9
- SHA512 551d9d93d919833d29477252d17f5882956be38e574da6f938a6acd8794331a9840a276037d8cb0db02efbed93c40b52f7b049b5264413c95b0b5777b8d05f27
- SSDEEP 24576:I0Le5ji0hmxNrMuPne87HtO/DF1+9codjeWyZxeCEQ:IPji0A73R2TPod5
- TLSH T13F359E55F6748331D073C0B9C5D2A68EE97230825B308ACB5286D77C7E67AE6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 7fbb57889d91e510a8340a9a03c846969e73ce55629222596eba4e7080225864
- MD5 de43a79349fb850951f548a0ce9ac6ad
- SHA1 d022105d5facb02411f57b97034d28056f887e18
- SHA512 5cd21e4536cc7016e80731230d9892ef0190aa730ea82f58ea7952ef7ab0137912097138baba5639402acd4749227a40372cf59c2eb16e98ec5c921a40509d59
- SSDEEP 24576:za7/ezSC6vUyD/aqgrvWr6q8wyuEPne87HtO/DF1+9codjeWyZxeCEW:e/ezSC6vUzPviHjyLR2TPod5
- TLSH T178755C25F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E5C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 e13b470e4ef6a0303ec15c9efdc58459fe9c33c83b41337096071d6d73cf31ad
- MD5 405eb76732cb1c3512a8e334579aeb20
- SHA1 5803759839238af5d84f1aaab11778fd0912a447
- SHA512 e2447d2f67c4f2ac64226256bf3cc1a6f4e66634db56f2fa2856ca18bc42af21b48731e7d7b612c6cacdc6c7fef4411b2d69557c305bc64cb458b990522109b4
- SSDEEP 24576:yVbqPb88hv/l+b5Pne87HtO/DF1+9codjeWyZxeCEn:yVO88hXl+lR2TPod5
- TLSH T19655AE65F6748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE5D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 4d5b50fcaf2701040f6016e459fa224051e63fcc4912810685c0d3b337971793
- MD5 61fb4e4808ee8f1cc7d97d7c58ba1310
- SHA1 0bb60fd1297edd409b400fdb582253a5c669e3d2
- SHA512 681a273d6a805c263a8bd7d89f90271062b5318d3e372d15ecd240ec2466f5185458a40521a267183cb7c1b09c419fb90128015180e6fc1c89536411989ee2cf
- SSDEEP 12288:tjCPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yf:tjaPne87HtO/DF1+9codjeWyZxeCEX
- TLSH T1DFC42394FB6901B1F7B7063306FE894521B15CD0A8FEB757F5867EAD4034D28D68A223
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 eb89499127817a81634f51f8d2dd7293731ff213f84ed724290f7f56f17ec889
- MD5 e16eed5a43aa29a51675423818393fae
- SHA1 3380c1ea5b95a1e25353ae44e8e18353aa424500
- SHA512 c56c6c242ebea71d7f34b5aff9ec1836422abac54a03367a74af296133c58a9fc5b49b44041fff10214801750b59b282f217b426132daf8a3543bca196677ca4
- SSDEEP 24576:rJIUxPne87HtO/DF1+9codjeWyZxeCEO:rJIUxR2TPod5
- TLSH T12B05C07BEE28FCE2C27A4D795791C600E77278704F62A3CBD165820EDE235E05E79825
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 f890845aaee7737e6d826c091d623168cb6cf7636f3e90dd3d947b40bd3f693c
- MD5 62a6a8e54998e1945d00b99a8a94df8d
- SHA1 e9c49b034d9b483e595ed87756eb2c19faca35d3
- SHA512 bcf08c09c48d478dd9bf1c9aac0c9547adefcede93d2993369ce62b36b70078f4a3e5b402d91b9b0f7fd0aea8820fb77aa5517a84d6f095b359afce6cb71af1d
- SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THt:FQvGAdlCEL8c/RRNw5Cy2Tc5
- TLSH T1AD266C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 0267c576dd50d176aef745c5a8f9a62cf98d6f65b947196770f6e252a2b77764
- MD5 87d3aceb3079c3bd6b1955fc8217dc09
- SHA1 164dfb284baa75d2b8e8fb5923a079f1acb3a4de
- SHA512 642edaf1cdce186c94f0cd62bbb91256dd0746681a885e6617d633c881581797fe896e3466a29b0deabba7e1bdda19fde64f99af25fef7fc923dc9865e6f19d8
- SSDEEP 24576:oSewsAjHPne87HtO/DF1+9codjeWyZxeCET:7ljHR2TPod5
- TLSH T12815E030FE74D032D3BB0D721B76C706147D79604BA62AC3E3A89E9E58306D16776A27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 bb97ca32263e6a7c0e2b6c76fffc6789e8e95973bcb52dc26b7095ad6cd344a8
- MD5 358fc8ad3026839fe7f99a24ae64dae1
- SHA1 3bad2e24e4c05f86c3cad9c282f67ae901922963
- SHA512 3f2890cf94c1f73b0b2178376ef3496930b7014fed4cc852405baee486e47eb98d999ca129282c9de3a189054c5a047b6c60986ce4826f566875867e9f6de9aa
- SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH4:MUEtQevvqc2W1cpV2RI32
- TLSH T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 e938c10b998804a3a3743134f1db0aec3b179896e5abb04b80b7685535b07446
- MD5 ff5b460d1042ac5e886d8e4aa107d917
- SHA1 bb8b25201aa6b21de5d8ea2397b456380f3175e5
- SHA512 36560733cae443c5cacfde1a71a9a084eb924cd4480799d05f339def4d5e13d4725510c560f3e728aaed6a4afad49012d105dbdeddd6321a865bc3afa65b8e66
- SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/znR2TPod5:Woq2Vjnmu2Tc5
- TLSH T198D58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266461E2D33AE48E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 d9c872db2b7b0514f20c41f6812099a8d3f26dc207a3b21f493ce950bba4e023
- MD5 4af7595af480df2d2bb442653bf630f9
- SHA1 e0010c1488551359f6af4571db245abced69ebe6
- SHA512 0858b92d58d3ccdec0f35a1cd7b2e22e5ee41fd5d680b1db8ad450513584f73ee01acbe5e2b7f19dd0fc3ea5be49e1ce61a83836f2e8090bb29c063cc225b364
- SSDEEP 24576:gAhGL2IFoiwtA5l7S53oPne87HtO/DF1+9codjeWyZxeCE5:gAM1Foiq5YR2TPod5
- TLSH T1D7359D80EBF945D4F5B3AA7899B68171EAB6BCA65E31D20F2150D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 7752cd969c8db1154d4dc76bd9e79e5ffb59cf9134b1b19580416ece98a87497
- MD5 b1bf20fd3204a34fc5b7a466cf51b6a6
- SHA1 b1365abd6d99a37d289ec46a873525f106ee236b
- SHA512 5d1acf747c5d32a3e89f305110654d93336b1ae33f4c5bb18b21b68ac44262d7159dd813c17a0a8bde6ab7dc09c7387817da612a7a64f7621591d7f448878861
- SSDEEP 24576:0wuXOWrPne87HtO/DF1+9codjeWyZxeCEM:0wsO8R2TPod5
- TLSH T1F205F14577A80CF9EA67423986A7C136F7F2BC012A65E71F5760C65B5F33220AD2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 e0aa64e340a54437a6fbc8abf33e0785200212f975190250604be072838a5fbf
- MD5 6a05f7f6c602cc96d9b4c263e37d2de1
- SHA1 e9c0cac19cbe2ef81f7ee71d849f409b1d11624f
- SHA512 222dae09161d17c47881da66b2b2c15868d9f66f56ac54f93fea688e7df3eaa03684310d4e0b121f74f09a404b786b9b0b10c1a44b82bc1da633aaf5e0c3dd31
- SSDEEP 12288:d/Z1Iy/PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yu:lZuGPne87HtO/DF1+9codjeWyZxeCE2
- TLSH T113E4139833E810F5F3A3423989F58605E3B17C9123BA63CF655566691E32ED49E39333
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 6d32fced8fd27084ec8c9cd1478df0384a93f05061232ca611a1d717a37f50e0
- MD5 7099c5ff0b98a285e3c2e8530e6cbe2a
- SHA1 38a195601bfc5f29d3b790cbcbaee70c0001ca02
- SHA512 20f4f89d1c28d1ef379104a9fbc8eac075ed98441342c7c2b565aba45bb269709d7c38db365aa94f161048fd6b2d6fd56068fa45bbeab25df915d8bf20d5ace6
- SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:8QRQyi36YOcPhLvw2gAf+PN3v2Tc5
- TLSH T1DB667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 1aa39ed5d30794cf9d262644bda4dd14c9f95168d2f13bcb93e5372db3efc5b2
- MD5 d5cbffe49bdc1ec9fc2508266e4b79d3
- SHA1 8d639985b55ae99c81071fd8fe30f8f7c7dc9193
- SHA512 623b43401f1a5a3577c0494b833294d1565220a1adcd3ec29113c9344b6a3966154e0a7f838cf43ae9c080084be09aaeb17e4962a8eb4b87f43e12f3b13a0f60
- SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uh:2QRQyi36YOcPhLvw2gAf+PN3v2Tc5
- TLSH T19B667B03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 20cf86c3ddb9a6f5db230af70a04f3816edff423ef26dc6d2944e0eec9977ffb
- MD5 c2b6db042e77d57754bbf6fe10b397cd
- SHA1 0a359b0f95fc0be513b7ccbab943484b0297b83e
- SHA512 1325f78fffad9327abd456924af619b15b2cf347cc10c2db9248f5b973b4e42284e959a1273d50f2d5e3c021ac850fd80dba943ce0be9a4d2d4c385bbacb909b
- SSDEEP 24576:FwvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL02Pne87HtO/DF1+u:h68Qg55nhceWu7PNU3/3R2TPod5
- TLSH T123B55A33B2F600A9D44DE1769F4A872196D17C718FE1E3DB8501721A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 fa4903c593874f0ec2cc9b1c61faa25561c7a26620b4eeba43ac90072af3280a
- MD5 0cb45fbc68c8457bf82b4908a21bc962
- SHA1 4eda6816ff6f19b978d0a635c28c19136fbd027a
- SHA512 aa26dabb68a60af0150e7977faf4c02c4e5cfa3d374170c95a90fbbca58fc308606e36dbe98d6b26e1f9a604861d3f65f0fda67dc9fe534d12e394bb95baf92c
- SSDEEP 49152:/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99T:yy5112gYy5azzVva69nLKnhZA2Tc5
- TLSH T171167B13F29900E8D05DD179878A9232EA72BC474B35B6DF0A5077522E7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 38c0357590e004c5f3a75491f49b723f56f69fff2c51d7854bac482019bc1cc7
- MD5 d61c727efd120e38346a4ed6fb8c0380
- SHA1 3edc693c7e2589b2a81a91bcca71b0cc107cac27
- SHA512 6ac803b765e66ce3c7b4aed51c64f4149f143286d8e19d135f4b251d9af18882f35bc6cd78d8d40915f88150fae2862eb40ac2da9359105033585e147e7c60fc
- SSDEEP 49152:8B+taZ3usBWOBr4tEG20bqx0z+n217aau1glZR2TPod5:Wu6JmUxd2db2Tc5
- TLSH T175D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073552A77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 771eac7ef63146911222a5046874e7cdb37beab07b42a6437b3b21b087c8cd07
- MD5 98cba76fb4a93164cbb18308841495c4
- SHA1 a8e261f09c60fd968fb4b43e3d3180df66fd392d
- SHA512 6653a043ad6ce6e9fff9b8142200837a2261a0dc908d552456e89bc96fd976e761aa26cc69721ee0f29ab4340a6af242fd5c8eaa897fb3f1d11821fc8a4da2db
- SSDEEP 49152:a1hpsNoJpF1A6BU44CwH7R4xRR2TPod5:amifPkRu2Tc5
- TLSH T113B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 b11bb21050647791ef98c43da3d5e8b17d607a2e640c8fcb0503bb33a59383a8
- MD5 22bff00e82ba42e6d20cb8b5f68ce2e2
- SHA1 c770434c99747097c76ae7cb11ed09eaec541229
- SHA512 3796bf8590413ef1f84e15095fd7b28b575d7b44926492dc75931b78f37d933cf4ca37d592a99ac897a61dc031c0ae6139e35ec87e5f3f3f5334cf9a4cb62513
- SSDEEP 49152:SSuZQIY0Be2KNRVtOnks6NMHqGR2TPod5:M5dKvi6102Tc5
- TLSH T183C5BE13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 c9021a7dd1b868d5cc0e830a03d6e8400410fe2061aa5c1766821961418ce267
- MD5 9a056d6e9b58ef2eefb7d08e56b4b249
- SHA1 3b566a0cc227e930e2bfbc31ddd6ca7cee48d708
- SHA512 d0af962fe5c37e0f42cd571aece4aa1ee04090811989e8966c1ae395c9fdb73a43302226346ebb5478d7b43477993895b3f5e3065045899f3e5bcd9e00c7eb5f
- SSDEEP 49152:9htSn8EApI0figXgiDn0AP5w9R2TPod5:sX2iyphq2Tc5
- TLSH T1F495BE13F2D900E8D05ED178C7568632E962BC150B39BAEF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 e9628a1ef30fafeaadeab18a450b842364978a47c288f86f1282ecfb38e2fecc
- MD5 b13043dfbfa8ab546ae427b443a59585
- SHA1 10ba46d3e7cad385c534dd78318a299d2fff9c65
- SHA512 63dd3c568f755839b34c9046a7d98a9ef2aacd1bc440420a9ffbfb66759a0fafb28a9c926d2abff709669537777d444397e5b40ed1c33796c693ba7600144d0f
- SSDEEP 12288:3qPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y4:3yPne87HtO/DF1+9codjeWyZxeCEA
- TLSH T11AC42394FAAA02B1F762063306FE864921F05CD1B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 8c02a55e29df3a7b5234f0fd5bc04442f80ff28e866c31f9c8e1e35e4ec4e247
- MD5 5ea133fc0a86ab4b35396d6a186ea9ab
- SHA1 7440afdd39418ad0cf17c85ebc7eb750ad9e2c83
- SHA512 646b4866a8cbc99eb26d87b6c92f062af0f87913d116190f3cfce91ae4d42526390fbdb8b6951fc990cb221386907208f51d519da5757a2fc8bc242e75520646
- SSDEEP 12288:/zPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yE:/TPne87HtO/DF1+9codjeWyZxeCEc
- TLSH T188C42394FBAA01B1F322063306FE854961B05CD2B5FFB39BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 60b28c83154f393c68f2becea896c403975e5572a76f54dc78abe4b7a9d4294a
- MD5 bcccfebd25099e5ad7ec11fdedb3ae29
- SHA1 f25059e79d99d64a2e621bd6abda880e6443f994
- SHA512 4581c90be83212dbdc24fb8de8ea96d2d18bd105b10853683186f0fc325cf8c5cf49aded25a6a60f1b865328dece7e7cf2ab2918a3ac2d6f8924dd4b2bd62c09
- SSDEEP 12288:V9PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yH:VpPne87HtO/DF1+9codjeWyZxeCEP
- TLSH T177C42394FBAA01B1F362063306FE858561B05CD2B5FFB39BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 e23a060b97b71879a9a24b43b2f032d0b6eba1708e0f8b6e0c6bfd4bfe5bd9fd
- MD5 3fd8e5bddabd5ff26b3c3462095483c9
- SHA1 0bfbe96cfb297d668fbe0a751d350dd93b23a3d8
- SHA512 ce4e210e5bec98cada2c4c14a59e870ee6ae863cf4a6813b1d23fd945d9f75c807402e96e754094087b5059eaca23d1bdc2d27588cac1716f7f99f6c098a5311
- SSDEEP 12288:NVsPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y3:QPne87HtO/DF1+9codjeWyZxeCEv
- TLSH T1ABD42354BBA901E1F773823685FA8145A2F17CD1A6BFB39FF6413D5D0830A24DA69323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 e3de7ac00db5465eaf724c763d5731734857da8829af029c58e1c4cc75472965
- MD5 4c54f5ee41498873ab34bbb8f4d30fef
- SHA1 b2787d8d93851860d1c32db39a30c40b7d7d8f5e
- SHA512 7923fb2033a97105772e547a550f3565d7fd3e4bb3796b0bb1a501d82e327538e20ff3fa7b4916af11fb018c968f0655e1c56ac77ab2f0fc9712ac5bd72f14f1
- SSDEEP 12288:2EPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yw:2QPne87HtO/DF1+9codjeWyZxeCE4
- TLSH T1DEC42394FAAA01B1F366063306FA868521B05CD2B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 61e012351ae6f212eb04c98a3251c386b3061df38443610d2a298581d5a09409
- MD5 4485f6ad5a8b5df3a387864d0a8ecffc
- SHA1 279d1ef49cb1b12b72be5dc4b0396d9f825c4f07
- SHA512 111a1303c956d3e9d1a976c38ee2d9d51713b5202a0caa2b7d5dfb6bd551c934dade066de4e09bcc6590f4f466237e8cde2d99a3a68797ec8a8e2c020f397eb0
- SSDEEP 12288:u3PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yn:u/Pne87HtO/DF1+9codjeWyZxeCEP
- TLSH T119C42394FBAE01B1F366063306FA854921B05CD2B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 ee26a0be5af9aec5591c628b31f580a6e6f66218eb5b20c218c037b0a58e745e
- MD5 5228dd5d6aaf6df43618f106ca4a8863
- SHA1 8cd276931746ede38bc9839ab7aaf1740b3ad67a
- SHA512 9ee4f3fd61e67186ef15ffcdc9bb2f8fb19a2ba4da9076c103f4fe1118cfe72da5b8b688215676ab0aa21f6717939f6d4fd85ba158698895a2e535e2912394be
- SSDEEP 12288:ALPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y3:AbPne87HtO/DF1+9codjeWyZxeCE/
- TLSH T13BC42394FBAA05B1F366023306FE854921B05CD1B5FFB35BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 d17ea23771cb22da8a5941cdd486b5985e341515183826bc77e5d17141ac0629
- MD5 96239ecebfa6d7163fa044f3152ad56f
- SHA1 66a686c9e9c670aa497722d4e6053afc167ebf2c
- SHA512 78cceb770d6ca73ff2612df94b4e0f19549d34ed921478c02756832825496236bd33eb6feb45e5505518a80fef930159f10ba1488b0976a3be71b7105c8b7e2b
- SSDEEP 24576:jZMMzFVSOzPne87HtO/DF1+9codjeWyZxeCEM:jZMMzfPR2TPod5
- TLSH T102050194B39008F4ED67823EC9A58906D2B27C560BB4D71F13E4362B5F337A05D2EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 e79b3a438082e529e999d60520c5ea3193943e7d103fa3c2b3915f1be2b05874
- MD5 033f7800567ed6c3ee57ccd677aefc80
- SHA1 a1398d3ccbee1e9a1002cf86011a6618a340e8a9
- SHA512 df8cb9395be903f78a33bf2cdc09fc7cdc9e88673299f160820b2473729b68f2e8e84a113fb5f9376fabfbacc72477c0da328ed29edd74c3943e0946f269ca18
- SSDEEP 12288:tmPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yC:tWPne87HtO/DF1+9codjeWyZxeCEK
- TLSH T182C42398FAAA01B1F366063306FE854921B05CD1B5FFB39BF58A7D1D5034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 240c5fba5f4468d99f355e97bb791d8fd33d83ac59a7b0dc922acc6e7e9e14f7
- MD5 e9e80fb0d5c163e1ddf7c4a43cd65fa0
- SHA1 798a41139ffa5dbc9de588354a94336d73d95144
- SHA512 0b1c20b5e081bff6fa346aa2c5653e58c83bdfa9e16a620ab09479faa0632409fb0239c1697a6db02fc32ca015a9fe066de35898dc554324becf617b23dc5722
- SSDEEP 12288:+yPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yt:+qPne87HtO/DF1+9codjeWyZxeCEF
- TLSH T179C42394FBAA01B1F722063306FA854921B05CD2B5FFB39BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 73ad04aef557332dfb07fa241f70dfec88286904584bcfd040ccaffd646443c3
- MD5 816998474461e5f8a7745f789ebc66fa
- SHA1 0707c32e26eea95ce32153bb51869975edc6ef97
- SHA512 610100072f2caf870a240adabdf9be708b2c3ec5671b5c36a963209a94725ee817a9ff5a55f24d1a5ec6e1cd9bd39b7d8e6ac4d361ed71d0b195587fa048ccd6
- SSDEEP 12288:SyPz5L8/PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y7:PzyXPne87HtO/DF1+9codjeWyZxeCEz
- TLSH T13BF4024773A520F8E237423589E64A01F3B17C7217759BAF6394267A1E336A09E3E731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 6e6f5c362cfdfa27e6fece25d945cc6897036572489c93c238a78124634e985f
- MD5 82f6d911874e3f3940767ae0c93dd7e2
- SHA1 d15fa8ae2630aee7d9ecc744884b0cfa52ca0835
- SHA512 589876f629ceda9b5e24a49ce318f28fdc2261481cf25166fa44dc42e5fd3faf07a872bf669579163f4dfa393740118c9eef1e26de222d32f36a08a61d3a0fd5
- SSDEEP 12288:QmPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yH:QWPne87HtO/DF1+9codjeWyZxeCEv
- TLSH T192C42394FAAA01B1F762063306FE854921B05CD1B5FFB397F58A7D1D5034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 ef66d4e36bea0e9ee30b550b7f86ecdf9aebcf5fd9f72d094f343b8d24102f91
- MD5 c652c944e1100cf15951849a50f5874c
- SHA1 a73f5995e3eb85497ec3eefaa252529dd445bcd1
- SHA512 e61e9f805886ca9779a4e3ca13bc8914d528046ea551ada660b5b5bcaf6b87d65be4831b7cbd28a51e06fd285059563a1ed3cbc952c9c05dd4d6f96d4ecc4455
- SSDEEP 12288:wmPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yr:wWPne87HtO/DF1+9codjeWyZxeCEj
- TLSH T18AC42394FAAA01B1F362063306FE854921B05CD2B5FFB39BF58A7D1D5034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 a2ac9e3ebaf120a8ef71241afe0b5c880e0f6afad3ebdc86862f8013c9a51f2e
- MD5 ed8f08e36f2e69817f33f825f8c692ca
- SHA1 23a3f79c13645f7d13d5e42e7a61fbba584cfa94
- SHA512 2706ab3791926d9cdc1ff0675637fa27ab25e2ef978f07533a0a10ec86f74094738f23c0c0356c43acd228e4ca487bc57ac4ccdeb80f85e8d8a4c65b178870d1
- SSDEEP 12288:oyPz5L8/PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yx:pzyXPne87HtO/DF1+9codjeWyZxeCEp
- TLSH T176F4024773A520F8E237423589E60A01F3B17C7217759BAF6394267A1E336A09E7E731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 962ec55771315ce2123c42d89708380840309a932c19b878151a306959cc1759
- MD5 e2feae4dca5337ba4530d3b1c37dff2f
- SHA1 71cb75f4d9fa3c13f3efc2e98044739cf78faf30
- SHA512 502dfd8468b63469e57bde58ae4957c2a5cecd42fd3f684838ab733df4f7be9289c8596bf003520774ee3e2c0114f0282990fa0d9512c9f3a35584f3df94fe1b
- SSDEEP 24576:XT9aLl3z0zDZPne87HtO/DF1+9codjeWyZxeCE2:XTQLljER2TPod5
- TLSH T14B050194B39008F8ED67823EC9A58906D2B27C5607B4C71F13E8366B5F337605D2EB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 ba2442446033f33cb4c00fa3430eed467e0e80d79ef7a1328de7ec64a61fbe99
- MD5 2edd6a04d278a09bd18408fe89cbe6ab
- SHA1 97d12427af1f13a340f6ab80093b3d71ffb40618
- SHA512 997162ed89cc3345fd8ab685a78306d361f9c3cb1527209813520a3d610ae5fc7901a74c25b90440fa40277f17ef31b6e9882416cb61f568ed45c1e7664b7c1b
- SSDEEP 24576:v3td9CHKy7GZVPne87HtO/DF1+9codjeWyZxeCEO:/td9CHKyaPR2TPod5
- TLSH T12625CF90F3E410E4F1B78A3589768511DAB67C9A1B71DA8F13A4261A1F33BD18D39F32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 89c0daa61558def1410f73c96d0ad7b0221ab435865bd02accb06e80a3d50c45
- MD5 70aa6c813621e45b20f2685a5a07e417
- SHA1 a733097dd8894b939e2a31dcf532a0b3a2adbd6f
- SHA512 c538c46abb7efe327d094bf8af38f40ac7a1501970f0c6a37587fbbf160a0f4e2f66d5bd04b5dfe21f9ffac947d8045c40fea91da6e2dde256d40680af481994
- SSDEEP 12288:/dPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yd:/JPne87HtO/DF1+9codjeWyZxeCEV
- TLSH T1EEC42394FAAE01B1F366063306FE868521B05CD2B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 2f1cefddebab74de4d7d71b89f55c83703dc5865f28afa45511328193acb1ada
- MD5 b58ce21022b5143cf1a59c28ff4db443
- SHA1 a9db82c926bb339eb8f0eacfc671e0c793eb91ba
- SHA512 0e36b2226d6e56bcdef4d48e22f17f30466b8707ff68ab411a702b56754e07dcf8462297af2cf7e6a86434e052a6ced50088af7a22a58729ac206e694fb140b0
- SSDEEP 12288:qfPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y1:q3Pne87HtO/DF1+9codjeWyZxeCE9
- TLSH T1E0C42398FBAA05B1F766063306FE864521B05CD1B5FFB39BF58A7C195034D28D68A233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 578b3e6e18b1a863969d040f834fb239fc3b375d54bdc1f25f93a4d03d27ca89
- MD5 c7d079ef47476d2f6a6bd7bb7b423e16
- SHA1 37b79c8c33912f96f03de8dfb6102f3b8fd924c5
- SHA512 d987a9eae8bd5fa2de0cc393cd9c680d9943da99dd2ea43d0f50d2e5731505068977ba5d08158d2cf4d9575d22b37685df2fc52909c8f176e943bdbf18e33a88
- SSDEEP 12288:wIPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yL:wsPne87HtO/DF1+9codjeWyZxeCEz
- TLSH T189C42394FAAA01B1F766063306FE864921F05CC1B5FFB39BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 581KB
- SHA256 a3ec4653c0baba397b654cd8735fdb19c0bd51e6eed90dc1c3f38c7a588771c0
- MD5 249db86ba71cb4c965fffcadaf972a94
- SHA1 ef26f8ba48132c93d07cd711cf6b0fc2471c18ea
- SHA512 0b4b1bfbf22a7c91328608de2f40a5bec91b332ea3dda8bf1ed9b08ba1717396f10d1177900f06253990cf89418ce8a7d08949d8634d6fc43e5d8b80011b75d2
- SSDEEP 12288:YmPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yL:YWPne87HtO/DF1+9codjeWyZxeCEz
- TLSH T173C42394FAAA01B1F762063306FE854921B05CD1B5FFB39BF58A7D1D5034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 581KB
- SHA256 df2e82ec9617ba727c9af56123338ec09c77a233d481bf2e3363e47e5f87aa47
- MD5 2719fc2abcbad70347f271018307edc0
- SHA1 91b5bf4e4bc7d83690bbacf735beb87565717d01
- SHA512 58f6be4523adb6e2143b668e8819a102285404b1c827376f0fd7cbf62e3370b06b6fac66bbd02e8adec05bb44977041749ab4559aaf29afd28cfcc08476d6fa5
- SSDEEP 12288:0dPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yD:0JPne87HtO/DF1+9codjeWyZxeCEb
- TLSH T112C42394FAAA01B1F366063306FE858521F05CD2B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 581KB
- SHA256 1dbd458a5a03002a2540dc60588ca14dacc1bba65b17485531bc5a73648a13bd
- MD5 dea0eb2678d9f97b99057b578b51ce9d
- SHA1 b0b82469b6f3f8e8a6741b35424c9fd7d6319c6f
- SHA512 fc595b683a149e0205ad1da0f7c846650c39cf50128bacb1c7e5298c2a887ee830d710d541f1b5191384e58b19ccd6ad55494e946c9e0d8986746c63ca6dfc0b
- SSDEEP 12288:N+PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0ye:NePne87HtO/DF1+9codjeWyZxeCEm
- TLSH T120C42394FAAA02B1F762063306FA864521F05CD1B5FFB39BF58A7D1D5034D28D68A237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 581KB
- SHA256 58f3a016ca47637898a0ebbf233b42ce84df8a73605839cd8c21dae21089f293
- MD5 5d026827079e5a72cd6b8b18621f7ada
- SHA1 211804d5d2aba8610e7ece2b3b8d83358067ae96
- SHA512 088e107243207db7e18a64db511cf381d81e174ebd6ec56b2b6c2717c3ac06ac6dbc220a440da838baa3468f7982dbfa76db4bb0b23f9f8d39b226ab28ef1188
- SSDEEP 12288:+EPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0y6:+QPne87HtO/DF1+9codjeWyZxeCEi
- TLSH T17BC42394FAAA01B1F366063306FE858521F05CD2B5FF739BF58A7D195034D28D68A273
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 5a0b2b2c1317b744196f5f9b3c8651d8903df105fa716f6b200054ce538c8629
- MD5 673a5ac6c9ff75993d33de523cd49d31
- SHA1 2ee975d63dc7fe278e0f8e249f7a41d7f06ca277
- SHA512 4247134e600c89dc0c78daaee72a2580915bb6c2edda3884d44e69697a963216520fcd77abc59209c6478f8b07a5240c83fafe4b0623f1dce0e5c3a90a04e354
- SSDEEP 24576:2fwvok9RX6wkyAI6Pne87HtO/DF1+9codjeWyZxeCEN:CMnYI6R2TPod5
- TLSH T1EA35CF29EBD804E5E177923C89F7460AF2B178591B31D2CF129A536D0E33ED49E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 c43735f6fae879ccd213df57faa42a5f9c8dda5482ac95023c0853b9588ddaf4
- MD5 f480345b35d8bcff0d92524e932b3697
- SHA1 0d8a37cad2a41444a42d8931c59c31a726793620
- SHA512 5aaf5a4580d1508ac7df0b1943a1e567058265b87954f8dc74acbc6b12be81920bae262a257092257a7119158270e431e454c2f722c707b2991224cbc3d356a6
- SSDEEP 49152:UYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dR2TPod5:cySzPP2Tc5
- TLSH T1F2066C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 0b84c6a2960b41e5658b918f420d21cc1a01fd167a5ef6f80c74528292463255
- MD5 59291c310281c34da70ea5aa3a5aebe2
- SHA1 5559a147719b253a3f9df18ff51d49ed57f9ebe6
- SHA512 e5b374b52052717fffd5859805a86807e2d60e5dcd26e05092cb8333603a9afbdf452740ffd9b8cb7ea9f8daa8803f9806e43c9cfffdf1d41f09668d14d944b2
- SSDEEP 24576:W47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYDPne87HtO/DF1+9codjeWyZxeCEt:W47JUQj4irIhCnDHUPfF/tR2TPod5
- TLSH T1D365AE1DA3EC01E5E1BA823885554A1AEA71782D1F31DACF2270537D6F23ED49F35B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 0b19238c68d35d733981cfcc686b9ccf295c85315bcdad4260634460fa0b8b1a
- MD5 4d7266fe7a73a19aac506dcdef370673
- SHA1 b66eee9ac719c9451d40396b0821202657e25085
- SHA512 3b260a7e21ebef18dbde78b277dff6a373f9d485a5abfb25745b4caee32c1dda6932837dacd0d7e57ea03a0ffc640ed2f37b19c30cf9059b2ff41b30136f1ac9
- SSDEEP 12288:kGsf2PPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yd:8GPne87HtO/DF1+9codjeWyZxeCEV
- TLSH T18BE40158E29802E4D16E5235C7A64641B3737C6197F6E3CB62C0F93E1F35A909DEA313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.2MB
- SHA256 9110784625d3a7fcbc21567fcd3eee03a3ebb7301d63625460c50d89b5032804
- MD5 63dcad164b144450410b37c2267e5cb4
- SHA1 596a15d31a61bd1889ec5d9c5443801c614ca708
- SHA512 6358e47573246813f815e177a61f62a99bbdaa4e9675181cc14a623020ba74baeb15f571aa676d21ad7b750625b94bab42150f472a3c676727d467549621aca6
- SSDEEP 24576:mXdcfUPpSluP6AEpwxf05tQ8epa2N1ruwQhmaQ6iv:lfUsluP6AEpwZq1uZDQhmaFiv
- TLSH T1D2450741762AC78FC6A950321E36D6CCAB707C01EE056F0773C9973F9476668BAF6281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.2MB
- SHA256 8071a0a2235adf7358da2a4f9abb383267f4dff399bf9d96d9e17fb4daf67ff6
- MD5 3964c07c224d15806670cab6a0dd8dec
- SHA1 2e95fca5e4f5b7d919b65b4ea0d44620fe7d3e71
- SHA512 ef39cc680607647107cbe47d88bdce1baa19551ccd6ab364b8bd23e806b83a87668400c6213dd67bad8eb6f38dd2af5495d65ca47485ce8c1c0e5db12b3341a4
- SSDEEP 24576:KFnAcVJRP5a7IO/HM5tk0v/Stkv/x+u9h:qDa7IOW68/xP
- TLSH T134451A41A5B7E35FC9BAA0370332868DBB745C06B7493F057344893C986697EF6E2392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 54ce0371e7bd18943b41a62641b40c366aab6946362c2e09f7ab07ebbc3c6bc5
- MD5 b05354e350a923b45f84cf48073d71bc
- SHA1 43183e7f5182443a2b6696ddcacfe854d18fcb47
- SHA512 6ded60bf99a7a7f640501aa81da3ec65006b8cc75d04a65f7c3d3b1a4e97b01c2b52b54566055dd852204c4c3cbaf1b833b67d05febeed799952be13d3a6fa2b
- SSDEEP 12288:hF7OPPNle8D3HHNO/DKKk8Ti9YBpmZq2trjeWvuNK8HReCuZ1rb0yU:vOPne87HtO/DF1+9codjeWyZxeCEs
- TLSH T10AD42390FBAD05A1F776063205FEC11421A57CA06BFEB2C7F4467A5D5030DA4DEAA327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 cc20ddb8a9d962246ebdd748fd0b3d55091bf6968b8f746dc54ac9905ca16ab1
- MD5 285b3cd412f301c6e56e1cfcc9241a6a
- SHA1 d9c58999d56cae2cf08e2d6990fc1244bc73c279
- SHA512 60e020ced0079d4062e608f76d26ddab981f85bbe2033d26c992d90a23fdffc4e1433fe95383ef4d798df09b334fa58345f6c565a879c5524b4b2014110621ee
- SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYEPne87HtO/DF1+9codjeWyZxeCE1:Lgb4mBIBhGFDR2TPod5
- TLSH T12765AE1E22EC02F5E1F6D2B88DAA4417D6B278161732D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 52a1eeea58be343f662e6ab9f2eb067f92135d23b5cc08dc1caffeba279daacc
- MD5 71709cec70de58d9d7cd211a6ac1aac8
- SHA1 6d0d4085dbe692baf9b3d62720fe984f426b418f
- SHA512 85056f0b3123ac462583cdb6f0024ae8c017f24f7c9dc6c33b0e8579c51789c124dff75d42f0a885e8cdd00f763735150abe170d6be3cd8a4804f2fea6f3acbc
- SSDEEP 24576:wG88u8FpJqH1Wzria7/mzPne87HtO/DF1+9codjeWyZxeCE6:j7ZFPqVha7/MR2TPod5
- TLSH T19135F165B7E101F0E477D13889964663F6B2B8210374FBDF06A88A551F33AE44B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 5d19ac2297fbb1785c994abaa3f4b2bab4fed451ee0e5035802ef6f5dc51ed71
- MD5 4a77f7fb06bce0af7258d71267672abb
- SHA1 d1b469887ab2324ef1fd3c5ab98733ed3a08d9c5
- SHA512 97ba669299bb8d1f01d6724aec2dc400e67cc537f7326c33dcba409b8e85cb8ec4d2ae7d257d9970d2f4238e3e4e720537a120e80734701104b125edaa51d51e
- SSDEEP 49152:uBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj/R2TPod5:xG05lO43bY2Tc5
- TLSH T174D5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 f3e3c12d35f13b13dfe1c20f8eba257152df5102900dc625b9508cde6b4b11ba
- MD5 4610f3f4a6a3403c4563ca16b4e6cdb7
- SHA1 7fb0ac021ec8ea95000973509c76b38b0b8aca00
- SHA512 095a1851bf7918d34fdb76947b08daf30388612556aa8bc4465be039549f72ff4f7ed8bdd9562e19f82a535452f67aead4124f083c868e162ef6800695f30d15
- SSDEEP 24576:ifa5POZ3dpqWVM50JicR2hG0lasx2+47eidndPne87HtO/DF1+9codjeWyZxeCE6:qa5POZ39Jt2pasx2+m3R2TPod5
- TLSH T1E965AF5DA6FC01D5E1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 21ac9bb7186ebe8c74cf1024976be8562f2dfd6a65334ea83fa5ff9b610f017a
- MD5 4483649a2ea73560276f66770de0463c
- SHA1 d36768daa84b1a15341e35ae03f834f93c7c62e9
- SHA512 9863a6f1f665e51d1ae8a00f70116cd2b4fb21d40521a3b74b1b4f88ba345bac3be867a4470a98405d134be3ea29f4354bf011eb54b5cfc195cc2a6f48ec2942
- SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkLPne87HtO/DF1+9codjeWyZxeCEo:NNc/zEOVHFsR2TPod5
- TLSH T151857B1623E901E4F1BBE1BE897B9546FAB17865133486CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 871694315749c3a3fdef9a5de7d74c67a75af0b611cec364d6edcd36240b67a3
- MD5 dd98424c84af757fa9400ce7f87f2f94
- SHA1 52f8312cd365210fa51129cfacabe617762af90c
- SHA512 0bed140bdaf9c57c6c0967f540728b9132ebc73ba34bf0b5dfc84018f0a92de7d992eb916869f2c2a8d4b801bbe87aeefb7caa32455c4a07d91bd7d90a17bfed
- SSDEEP 24576:ytkNvNnaFeYhJNtmZBmFPne87HtO/DF1+9codjeWyZxeCEU:ytMwBtOmFR2TPod5
- TLSH T19655AF6EB6F806E4E1FEC6758D238512E6727861173293CB9290C13F0E279D89D79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 4017f28dbefd3ec7eea8f2d82763c8d39881072dcf61dc29b6645d952c554b1c
- MD5 30f2b489264bce968826c87fc6b0e112
- SHA1 786f6d8827841a47507039719f1f22abad9a0d5b
- SHA512 27641b152bfe3484a76e1c803af7889b35329399bf3caf61f43cec61649178d7b6acf6d32b868ae3053314f9344e8774920e09f3a339e412a25023bba790eb87
- SSDEEP 24576:6PUr+NQPPne87HtO/DF1+9codjeWyZxeCET:6JQPR2TPod5
- TLSH T17E05F12E62AC18E5F676A13D85968709F37178621352E2CF02D1917E4E33EE8BD3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 83686411891e6132b916911abf612703d391ff632aee216b26da919064b9a72b
- MD5 c3666609e40b0bf1a0158f017b7c2b6b
- SHA1 1d50ba0141d975f4c975c36bdc0b730cb945148b
- SHA512 16548e84872ca0d49ff58540fae617fa54fecfcd418484dd304a9d3b43dbb3980e132332725f6bcdb9df737c8cc3a7e41099a71679182c66f3f9848887d6c9d3
- SSDEEP 24576:eD3FHshBIYQgASPne87HtO/DF1+9codjeWyZxeCEi:eDVHeBIAASR2TPod5
- TLSH T1F525E17DE79C04E4E57BC17C86A38A06E77138A9033666CB11D491BA1F2BEE46D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH