99195c3115493ad7ab333a2d11bc327f912801efb9a37e554550c4584c01c627

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260816-e8ysrabc52
SHA256 99195c3115493ad7ab333a2d11bc327f912801efb9a37e554550c4584c01c627
MD5 51595c67ce59eb49947073fa1977ab0f
SHA1 69ab73e7a246345ad806972b4cf110fab626fea5
SHA512 3ae38b4c8436eaea1087005472d797ccdf1d9d46a698dc3d2893c8015ee8a359c0ba1034185507314387d18e68adde6d17793c6809229e3a9017550a74746704
SSDEEP 24576:k49H6FauwmK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:k4p6FauzKOEFH8sy7RqmV1ye
TLSH
T19535BF02B7E99175F2F31B31AFB592655ABABC629D35C60F23C4150D0DB0A80EA35B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2212	alg.exe
4616	elevation_service.exe
4624	elevation_service.exe
4152	maintenanceservice.exe
1524	OSE.EXE
2036	GameInputSvc.exe
2780	GameInputSvc.exe
4316	msdtc.exe
2808	PerceptionSimulationService.exe
716	perfhost.exe
112	ReFsDedupSvc.exe
2072	locator.exe
3784	SensorDataService.exe
1632	snmptrap.exe
4752	ssh-agent.exe
4148	TieringEngineService.exe
3432	AgentService.exe
4176	vds.exe
5760	vssvc.exe
3308	wbengine.exe
4724	WmiApSrv.exe
4572	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9389fd405387db0e.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020622d46392ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	GameInputSvc.exe
2780	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3040	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeDebugPrivilege	2212	alg.exe
Token: SeDebugPrivilege	2212	alg.exe
Token: SeTakeOwnershipPrivilege	4616	elevation_service.exe
Token: SeTcbPrivilege	2036	GameInputSvc.exe
Token: SeBackupPrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	112	ReFsDedupSvc.exe
Token: SeBackupPrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	112	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4148	TieringEngineService.exe
Token: SeManageVolumePrivilege	4148	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3432	AgentService.exe
Token: SeBackupPrivilege	5760	vssvc.exe
Token: SeRestorePrivilege	5760	vssvc.exe
Token: SeAuditPrivilege	5760	vssvc.exe
Token: SeBackupPrivilege	3308	wbengine.exe
Token: SeRestorePrivilege	3308	wbengine.exe
Token: SeSecurityPrivilege	3308	wbengine.exe
Token: 33	4572	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4572	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4572	SearchIndexer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3040	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
3040	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
3040	2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2780	2036	GameInputSvc.exe	96
PID 4572 wrote to memory of 2388	4572	SearchIndexer.exe	113
PID 4572 wrote to memory of 1172	4572	SearchIndexer.exe	114
PID 4572 wrote to memory of 688	4572	SearchIndexer.exe	115
PID 4572 wrote to memory of 2640	4572	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_51595c67ce59eb49947073fa1977ab0f_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3040

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4624

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4152

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2780

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:112

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3784

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1632

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4752

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3432

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2388
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1172
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3064 3068 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2996 3000 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 83d73e463e6e9761820c658e221f413f95d3519c880d162eb155f16869e7bc67
MD5 624ee7862b3460344ee227aa7dd942e5
SHA1 5604324b15581df2355c423ad3f634a9572f0003
SHA512 844c742a39ffff1507c18a53a727060bf12201da08b99a6fe0dd9784dc54a70b269a8aa31173ce280277c1a13b0df418bd2fb0cb3815a51b991a1963487dfdc8
SSDEEP 49152:/AJ632BuPkFKRrdE6oh7stBhuXjfS4LWxnZKOEFH8sy7RqmV1ye:H3q6gjB8Eh8XRqmzy
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 a86c7048f235a9508ca51d0e2bc32ae329a4a07aff0d1d752a453c3a86f51a57
MD5 3469cba2ba7c35dabdbc5918aa9a2d51
SHA1 4c5dae99c0d53f7536d6763929638d9126f03e96
SHA512 e7b7dddfa9b7df1d6e7b03bbcfad4d82fcdf41021ffb484bd60bdc5c6efb8cc5ae73b94ee97845f66ba03c828f272dca0a78d62848c5b6ed00837a6add7d62bd
SSDEEP 24576:lXYSDQczAiK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:fQcHKOEFH8sy7RqmV1ye
TLSH
T1E205022977E409FADD67427CC9A2C502FA73B8514764EB9B03E495391E233C81E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 62cabf672558f7d4d7d0710753afc5fbc77f0333c4b7002b2cac927778152a0b
MD5 c1e21f2dd1e4ba7bd98ce2f843d76216
SHA1 536ed1ffa8ba0539aee4b863cd009de241cba91d
SHA512 2574e0c25dbee25b4bfbd68ed0193dc73daab76197d205fdd6d24c403814fc89402e3fd09908425f90461ae6e8ed12a843e90df67b19754fba634171dbd94ac6
SSDEEP 24576:u0Jew/90CyxOrMBK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:us/909owKOEFH8sy7RqmV1ye
TLSH
T1FD35AE16F6748336D073C0B9C5D2A68AED7130825B308ACB5286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a2ecde7ea1e470fc1113c0f1a778d8098b8dde306daf81ea15370bae3847476d
MD5 d536961f52b9e40a12caed1432fb8ef9
SHA1 82d6ef030cfa618f0a5ba4b42334819b08aa832b
SHA512 a0e5cd9dfb3474816ab0bb1f9248ab458bbd3fcc61f560db426764089d866f7084c26edc348623407020873a8149fb28e2215f2dffad85917a7c08bfff651abb
SSDEEP 49152:c/ezSC6vUzPvuHjycKOEFH8sy7RqmV1ye:YezSC6v2XuHPEh8XRqmzy
TLSH
T18D756C15F5788323D0B2D0BAC5D7AA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b90e9d7084b85ff4cde3154517ed0b8601285a8326a2a85866f4bb425c1cbc9a
MD5 00c422b70b294fae6cf12a3ad13e8cf6
SHA1 cccbc724653a0f209f7f097d1b7677994d5a2f2e
SHA512 1fe142e5e0d4b4895379d83ec89d27288fff5426ca173f8cd078abbcf7815eff20d7afbc5816d3ce0bd359a3c01cbd36aa921bf39cdac374eb031e4a9d450c1a
SSDEEP 24576:0abnP9Hgnv/l+dwK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:0aJHgnXl+6KOEFH8sy7RqmV1ye
TLSH
T1DD559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 20f6d4ac551f5a580f6776c552cf405e1dfaf41fd531485e375f2cd26723a85a
MD5 3d32c4dfbf7feeaab1825e20c861b27d
SHA1 d59050416abc83b226ddd514e38fcc837cb3572b
SHA512 c203f13a759ad87c7a0425bb910a55c5fbebaec8663f83c515c7e9a279541abf718be808827e49f14b8bfefde6acb74ba7b003a152519012b18bbad0dde906df
SSDEEP 12288:Qv8K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:Qv8K3zNf0lmRXrz8Upy7Rqm4UHMp2yum
TLSH
T1C7D42307A72592D7C7FA13B596EBC8C33CB89C029998CF6B3798B15D5CB424531262F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 079d631a5f5dab5dad889cd4dd49ffa47a8ad093beb23e993023edd51af2431f
MD5 ba2a00844505fdf2af05948d5fb7aa39
SHA1 08d6f9b97ac09adcfc9ddc1608726c61131fce7b
SHA512 2ae15c9c32f378edce3814dbde9d71d6f121a4f7369447bac229a756a59371cb186f057393ead831ccdaaf44ea4e2ef2f6b257db333777b813c292ea059795aa
SSDEEP 24576:/JIUtK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:/JIUtKOEFH8sy7RqmV1ye
TLSH
T14E15CF3BEE28FCD2C27E4DB95A91C640A77278314F6197CBE164820EDE235D11E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 7ee63d510acafde8520c07fdc412a020e35c83f1b654e43c30cb9f1a09819398
MD5 5818cb64400855952e43cb6fb36e0b41
SHA1 089a759d1b66c5b00dd5d906d723d2573f2d1d42
SHA512 87b1c7e28ce0ca093ed7c5f446363baeac2c7fd263a472d96843595fd5d6c5e1e75979bc2349bf3a3a566c1dff59d2a4119542ccdf2b02595c8da1d21383aa82
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THy:1QvGAdlCEL8c/NRNw5CnEh8XRqmzy
TLSH
T12C367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 6054a31a553f536397696d43f850755921a4640b715643549c91f121d6c87146
MD5 14fdb543da388cf432d7c6796309e83c
SHA1 1a13af6500ae0e29d419cfdae394042d982dff1d
SHA512 057881e963a16b020713429cc76d65ed09e6f33cd4b339cbcc795ebd1396b02f6cee3fa6c6f9b22c67bc834c069bb426399b5c94e197ca26d1af3f20743f2124
SSDEEP 24576:omewsAjqK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:7ljqKOEFH8sy7RqmV1ye
TLSH
T1AE15E031FE74E036C7BF0DB61B66C716287CA9204B511EC3F3A8999D59702D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0cf7c72d99f250ea9ca9cb18e6ae6623a5f76f73f17bb9753145b94b175fc49a
MD5 9ffb7a5f984c02e5179b058982357541
SHA1 41b4eb3aea95df7285a36a1ac8aaf38c0d1a7600
SHA512 b1058fbe14b5b37b8d9944b95a9cb0c643447e8709b88d94b34fbc9378c210d09d53cc7248d4ba47605d4adddf641f522208e0b57da0a9b988eb15aaeb817b72
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJH2xXUmO:HUEtQevvqc2W1cpV2X1322
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f37741b24acfe8597b3e5b34f2c3f38162afb925e64e4e1b17d12ad0ee24b111
MD5 5458d873ffb4aa9d894057e9c28c4e42
SHA1 3a46976bf8c7dd68d4e66a1ea35a9dcdc17474a6
SHA512 955e57fce1d39c94f8abc4f6700fbfaa3721fc005099b001317d2f3354022961623405752a95f2f3441e03e6cfa8520928175ed9263ff9802fc6c1404f6a386b
SSDEEP 49152:cUbRquA/m2yL5zMfFiV+XenmE3/z8KOEFH8sy7RqmV1ye:voq1VjnmpEh8XRqmzy
TLSH
T152D58D0976B8C2E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 10023e058579b83edbc3d2f61fdeee8f2d08e570597925e21c04a9ecb99b9969
MD5 7d459564239232805cc0f52d46f266a3
SHA1 50314ffbb9291ddbbcfb479cff9b8a7f880a13f7
SHA512 bbca42569cd2d582284d0be4aa308b36beb7dc37ec7825db8eb9a752f603b55d7d4f3029c0f649e969348d7c17b5b97a1886f55dcea0f6b03932440a4dcb1142
SSDEEP 24576:BAhGLvdFoiwtA5l7S531K3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:BAM5Foiq5lKOEFH8sy7RqmV1ye
TLSH
T14045AD81E7F955D4F5F3AAB899B68171EA76BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 826KB
SHA256 9a0a67c5f407da8a9630d9831f371781aac515acfc5ebff56b9aa5e38a412300
MD5 fc30e0a872870abeca4578567f6b3df2
SHA1 ce4945e788fbfabe0fd6ebe7a7fa41fe114f5cc5
SHA512 d61fe6a60fc43b04f64c3f957ea30c62bdcdb143b3ef86a4c8183152e1cf0c0be6e8bda3b1a0ecaa13f72b261d254c923465868e16246ecd08a0ce96c791ea7f
SSDEEP 24576:Qwu+OW6K3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:QwlORKOEFH8sy7RqmV1ye
TLSH
T15605F14677A40CFAEAA742398597C532FBF2B8022A25CB1F1760C65B5F333517D2A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 ef999ebb3d177a83a0dac9b3ce1990f9bd8e1f35f7d05dce7591e1b6c000c0eb
MD5 7322672f77e8107444907da9e091f455
SHA1 6c2c0cbcf6e7127c2a0a9eb8ccef7f2d997e95b3
SHA512 10d31ffd636be438504aa3c898ed28c7ebde1030acf2759a0cdbd81115e93edc7cc352aea6edb7ed555f0bc0b3580baf9534eff91b07c1bc4815e2103c4c802d
SSDEEP 12288:RwC1I1MxK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRZ:KCuQK3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T141E4124A33A461FBD2F7027CC9E68682EB71B41257758BCF2364516D1E726C22D3A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 29a9fa87771e8efb65f85e7ab33ca00f485f22f1498183f7a0be000f57e0fcb6
MD5 f04f99873e99115a67aed6014a8e546b
SHA1 38f2d63dc1216b2875cdd328ab48d1bb3ae9fb7f
SHA512 e3686b6c28e02e8f180c0767a641ba4917bbbf7f3bf67ad2e7904123ed69b42090f7e2cf53c53e4c2216ba9e7d7dd2e1ff4de4275a704dc7fdc1e82381e0234e
SSDEEP 98304:nQRQyi36YOcP8Lvw2gAf+PN3MEh8XRqmzy:2QyiKa+X+PN8xXUmO
TLSH
T1DD667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2110e10e766331fd3d51444cf9c4e656f793c91de54fe9246275bd1dd949d16d
MD5 631df9689ecee47602e238bac1d5faca
SHA1 62ce01347f156bc339dbe34dff8b73bcf3eb80b8
SHA512 bd9d90bc01d23893a85f96f094dcdea8adab224202595130966a2fad1acec577ff9ec9cbee52175b66c0324fc0ef65add341eb6630b49f355e2d59b57c2028b6
SSDEEP 98304:nQRQyi36YOcP8Lvw2gAf+PN3rEh8XRqmzy:2QyiKa+X+PN7xXUmO
TLSH
T1F2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 26d071248d05f0121b3f907181bb06651ea3d4c1c29a716bc563a1a491fa3dd9
MD5 35481047057eb3e731219807857e4945
SHA1 618f2e663a90dcdfc407d2bfd44aff373f300e7f
SHA512 b0dbdb14bb5962cd4ebc7e04bd014a8fd02446471cbcd8e897c953bc7a91e2a1d37b65eb49d927f70b105f83b9bea38954e73448d83d7c8b7631cf7bda762d2c
SSDEEP 49152:c68Qg55nhMeWu7PNU3/KKOEFH8sy7RqmV1ye:WthbRc/8Eh8XRqmzy
TLSH
T184B55A33B2F200A9C44DE1769F4A872196D17C758FE0E7DB8515720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c98db53f8b85e2f2071b8bb6e1ae26117d4febbfae919668a4c1ea26ab3ec414
MD5 4be1592c2961f3bd2f3dc29566d1f3fb
SHA1 fb2f06b62b57704b3be1c3496d85b989a508d2d2
SHA512 2e672713bd65e173fc20a2da472127857deb569014a4ddf6ae7165070e7f04dea49a23f1e2a02c2cd808d4f4daad629600ae05a0b5286364e2c26f27c078f207
SSDEEP 98304:Fy5112gYy5azzVv569nLKnhZ2Eh8XRqmzy:oLIHAWhoxXUmO
TLSH
T19C168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 812ece208217bee5ccbca3b5f3279440ed252ef7e94cbd367ba8c267f47e876c
MD5 142787ab6e686fb8e64ce5e023aa2f0c
SHA1 941b336c2ee97e5e253738cd87095a75615ac432
SHA512 ac01e2f418070d8448ca5738d12534212e2c08b666315b25df774edadca346612cd97cd4fc3b8815335601729f42073508c51db0806f39d037a1224fc8afe958
SSDEEP 49152:Ym+taZ3usBWOBr4tEGp0bqx0z+n217aau1gleKOEFH8sy7RqmV1ye:Nu6JmTxd2d4Eh8XRqmzy
TLSH
T111D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 281350e34ebd271cae27a428d4c69c2a6fafdf7fc782bba7066bb31729b77d98
MD5 ebd015190d4a0edad70a7ee68495b20d
SHA1 331a6c31d3b3925cd520a07e733f88e942fdd4ca
SHA512 31639495f6e87e948325efe95fade09663c8a6deec799479486a3686dc0c3be9d92096a19f2302486abaa460108ae2a2d7155ded52d3a326203e61e61a562634
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xvKOEFH8sy7RqmV1ye:NmifPbRUEh8XRqmzy
TLSH
T181B5BE13F2D901E8D06ED17887569232EA61BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 40b0099811fec3524f66693221f2a3b15318a94eae2512b29a2255336dfe1250
MD5 b81457e662db182e633825430208b630
SHA1 0a40b7c82ff041a34fe8048e359a6c5a9d83a72c
SHA512 528dab6dc60b559c1554c7ab47925df1c8676d08f352c21ee188539d09b4a3175faead4e8e0824c9e8eefc840b1c6e0d2e176c4753808e3d5123ea58dd8e4cec
SSDEEP 49152:cSuZQIY0Be2K6RVtOnks6NMHqDKOEFH8sy7RqmV1ye:e5dKoi61xEh8XRqmzy
TLSH
T1B3C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8a6fa5f786f84ffe152bb2ec517be061ba1b5dc9689ce018b945dc1339ed1ee7
MD5 e0a7abbfe40ea4b57115589dac7ef0aa
SHA1 c531adf6112505d478f872a0dfdb67c47d46d4c5
SHA512 e5c3ea678cd67af85c416660c8003e4996e62ab789b349c0af95e15410b2c6b487dd5653f8291e4730c365811a2d17206674cc4c120159b428d386de99888519
SSDEEP 49152:a+HSn8EApI0figTgiDn0AP5wkKOEFH8sy7RqmV1ye:8X2iyph/Eh8XRqmzy
TLSH
T158A5BF13F2D901E8D05ED178C7468632E972BC160B35AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 e795c375423909bf51ebc80c9178396bf77bb8076149ac6ae1567e237aa91f4a
MD5 e3ad7f6cb7449e33d1b9a61a30168556
SHA1 5ce183ef798668d7560e0fe1923d69ce397dbf91
SHA512 a271f5809360b45abcc24b3a41bd5c6bd8c8a5f630f27fb38e6ad1ca292c47816d906a2377858e1b76a33d6129379879d4fd9b03d67f94fc598f238afce39b0f
SSDEEP 12288:5J4K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:5SK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T11AD4230ABA2682DBC7BA13B5C5D7C5C37CAC980799998F6B379CB01D5CB424631262F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 ab33859cfeeabd2e0e3f49ab8689504afa7658970213e889e66259b55e9870b5
MD5 9bceea518a14349d15ec7d49948723cf
SHA1 9a34a57f102df29d988dd215b4412ad2adead0ab
SHA512 02d1571460c5383bfe1fbf324718346574313a7e346fc3cafd642769090dcfb951436f2ee0511a0622792d56b9e6231cb99ee837b6719f92096865f1bb7f7813
SSDEEP 12288:P70K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:P4K3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T119D4230ABA2682DBC7BA13B586D7C5C37C789807A9998F6B379CB01D6CB434531271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 36c1ecc92af6e3cbea61224ecdc846772a3584003a77f95b51d850048fba1394
MD5 d124af2c8fba89b5ca3786749eab7868
SHA1 80aa915aea6a36a1c1a517fa8a9a0b82bd9b4ddc
SHA512 831e59bffbb71e83a12f9590f682d9168492b0999defd580fcc34552b7b8dda3388b79c25b011dad8c97486f369712ef47975c78ca17812bf6689260a5a209a3
SSDEEP 12288:tM0K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:t5K3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T199D4230ABA2682DBC7BA13B586D7C5C37CB89807A9998F6B379CB01D5CB424531271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 1869e5b7e6db4d6112f117e17a2eb2da747cb3b91bee834769e490f74293c444
MD5 c70664e2426cd4ed8296aeda1ae1d23f
SHA1 95207eabfc174e829936291ce74ed8401604e8bd
SHA512 6735e27d64dd494386539b33e2cdfca2d925a3a90eec7dae5b68c354c161184731d07556b69f46be58a0dc0d2d9cbcd1a350b29cd1ab126cedea71f102d291b8
SSDEEP 12288:zl3wK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:yK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ
TLSH
T173D4230A7B2642D7C6BA13B9C5A7C5C3B8B8B846AA758F6F3754601E1CB034531367F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 b9e39cd3677d01acfdeca62fb587c7ac2c21b9df0dd469633c8353be81470e6c
MD5 080a5744f645418c12d13cbfbe9b4c0e
SHA1 79eb90ead3fd94730c4155487b4afeab8f31dd75
SHA512 7f332725b85214fa6ce141f7a0447496c2603ecdbce2e2e3cf548ac298b63bfd645d6d49e082ae9ac39eb582659f9bdaeefc3af5492c13fe6679f4d4f60c7a68
SSDEEP 12288:Mg6K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:MTK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T17DD4230ABA2682DBC7BA13B5C6D7C5C37CBC9807A9998F6B379CB01D5CA424531271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 c961633f6f795582f9ba7d703d44dae2d97f559c339a6a2748055a881709d2da
MD5 419e4be87946b15780ce7a01c3e85950
SHA1 44c639b8904ddb017f1ea1eb7fb6c8af105b87fd
SHA512 8f132246fd8d8d2a17cf3880afd1715a377d320eb8ce0b94655e5d72dc9da97c1d54971b1dc10cdb7295f006c252081517d3608a582f6d50ddbfd30e34048f22
SSDEEP 12288:Xg6K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:XTK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T1FBD4230ABA2682D7C7BA13B5C6D7C5C37C689807A9998F6B379CB01D6CB424631271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 4b4e7ea72e3903531a271097d026baa4fb47783d0e7cbf318b52a7aa2ba7e9c0
MD5 101b728e4b6ef753257cadc2198f3799
SHA1 781646996c8f65b414d2631669a98afb54744d99
SHA512 490599879ce85eaf1d80850752ee5b3505f70267a5dba75d9ad42d870b02c66eb39e2cc079e07285b635e80c7998eb042ceb6148eb5bde87eb539080b0c29963
SSDEEP 12288:AgNK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:AIK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T1F1D4230ABA2682D7C7BA13B5C6D7C5C37CBC9807A9998F6B379CB01D6CB424531261F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 902d41bc470a30da1ec2aac8bd41c620a7a32f5a2899982c1f5cedc58342f536
MD5 2fe88cd24438112b202fbb0b732020e2
SHA1 189f84897a847142bc6a988b3b96cedf107b42fc
SHA512 0d34ee9a97d4292d5898ee434d5142625777b3b7706995d7556d1a478de507955d1550f09fdd21693f74bfe121586d3a5dbb6f05c4a451afd61f6e4a5b32903a
SSDEEP 24576:BZMbzFNSsLK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:BZMbznVKOEFH8sy7RqmV1ye
TLSH
T1BB150295B35018F9DDB7423EC9568942E5B2BC1A0A70CA1F13E8362B5F733511C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 1d32db3d0a59465cfc28b726453af1b8960f04b50bbbc2444888b76b32764fc0
MD5 fa5adf8d6bfd940b00db3214b123191a
SHA1 74989bb1f55445154dffcc0fd75499c420b6b49f
SHA512 4628be5660cb748ee88b10a212198c24dc4919089cb2401965c7195a4c2bd3c4cb582d6410db19f319583200681582930f75db0489e153392cc863fb4cfeb600
SSDEEP 12288:3mmK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:3lK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T198D4230BBA2582D7C7BA03B5C6D7C5C37CB89847A9998F6B379CB01D6CB424931261F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 2ce25a829c3ff5ef49d6fcb84a6c0b2dba06ffafc3be9064dfdb4cd9a433db85
MD5 bb5be19989249731eadc7f02cfe65513
SHA1 adb022442b6008c183ed44af74de65c371f3e4f1
SHA512 ca3013458d228b29e88878f8ca1c4a2c8cf9450f3fcd6f02ea925fb3e58b94dee9dec3e58784887807c5a4aeeda9113ee1d68e410b8ebe0307de4aa3f9672dc0
SSDEEP 12288:9T0K3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:94K3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T11DD4230BBA1682DBC7BA03B5C6D7C5C37C789807A9998F6B379CB01D6CB424631265F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 49cb17b1c473bee2688884b9fd9661f8de79ac1fc46e0c2c5c07834beab66873
MD5 721b01b03f7c3333faace0ad50a65552
SHA1 9db68d1193127c3cbd2242252fde5eac57dc7d96
SHA512 704284d8635cd0af53e1c932472ba6989db97ee166d3e04e799fd368b5c5406b4e660ea43fca13e9e657912e5e4421afce2518b21a7bad4b9b41440a54c2a259
SSDEEP 12288:yMPG6L6fUK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sL:JGx8K3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T1F9F41207736131FAD2775238C9A34A42F775B83247648F6F27A4527A2E633912D3AB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 af2d6b9750fb74c95a0b3fe24e6178f48510a739cd506ccb8152544dab87e76e
MD5 0c67fefd120f134883e58428a968b1e0
SHA1 377a2ed49b7e6027eb03101b352f50214349573d
SHA512 b78332ea09f756c6f6d10aafb95d110e337e44738f8ce8ea6f7cdf301dd8e242311c6aae83432300dc023936b52a4605fe429a725eed3b34e5277c5d7b810b63
SSDEEP 12288:HLK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:HLK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T186D4230AB62582DBC7BA13B586D7C5C37C7C9807A9998F6B379CB01D6CB424631271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 d7bffd3188cb218bd9fe849366ae7066173af5c52a95f74797972207008a61c5
MD5 b11a1dd7cf1dc246c25c068919a21344
SHA1 fffa7aa3eb0afee7a6d8e867e8d65f1552864265
SHA512 c6c28fcac26fbc690a3f6310d9bcf0f295c662f9255f043a807f4b20ef2fe915cc5378947cc1710b530379ca3893030d17d0577f84765fc5838acd693af7c018
SSDEEP 12288:LLK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:LLK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T112D4230ABA2582DBC7BA03B586D7C5C37C7C9847A9998F6B379CB01D6CB424631271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 88dcf3c1e9c8aa6d4d38795dff98afb8cc42b60613f9ed6939c9f7ca09384401
MD5 e4999a5077c009d493c8dc27de49b75b
SHA1 f0ca7114888248c24e2891a2779ded8b2e55f51e
SHA512 db612ac09f01fba0c19b0ae755995ad98c562544fa32f17ad2d970cdc1d79123f802fbde5abcbda5f866c4e6bd9acfb5ae177d60eeafb11d274e96df4ac54ed4
SSDEEP 12288:TMPG6L6DK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRZ:AGxDK3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T11CF40207776131FAD2775238C9A34942F775B83247648F6F27A4527A2E232912E3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 6f4a7373f47ce58c7c77c97075984561f6dc78dbe7aaf6e297c4085677e424ff
MD5 e39991b1b306f4e25d1e411c55d62598
SHA1 0a659bbc32c44480224d85f74eec5a41a8eb75a8
SHA512 53e663cba410747ab8ae616669403c9fd052d9fb407fbfa34f5ab81e9543ad904f5d11e88e5bea26b756ec7aa5e9972ebe7654451bf541079e038ff21fe96be7
SSDEEP 24576:cT8aL43z0zXUK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:cT7L4jxKOEFH8sy7RqmV1ye
TLSH
T120150295B35018F9DDA7423EC9568942E5B2BC1A0B70CB1F13E8366B5F333511C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 5d361f82f4dfeeb1315c81ecf8ba2d5d5993c49086ecd76fa8dee885d051e83c
MD5 50dae79b92e67d1794ee917d3ff4170d
SHA1 92dfd21b6e2e81884c98951d055649d79b7a8f09
SHA512 db6de09c0b9b24400af7e1ff747e5fd4c17900e6dcc36d13f52a043f8bf21a4c363c680710e21a4b24d1cd94c812dd52e140f60e8b6cafb5dfbbc5f16255ea39
SSDEEP 24576:r3pdbCHCy7lfuK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:LpdbCHCyhGKOEFH8sy7RqmV1ye
TLSH
T10135CF90F3E410E9F1B79A3589768512DAB67C5A1B31CE8F13A8251A1E337D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 608cef0daba789f6788d4151b450d6ba9eccf4aa3a7dcc084ed4cb29941d769a
MD5 2e0cd5718fa440e242f47558f3872043
SHA1 80802d25dad8b9c752d6f2eef881d8c2f7453f95
SHA512 9c2e30ad03c0056c545794e09dd4498f25549ec54680f10991188f8748bbb99cd0b79e4fb186e1d02af3724d757618263646e7ade00e53811b3b7297b61441f4
SSDEEP 12288:LcK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:LcK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T131D42307BA2682DBC7AE13B5C6D7C5C37CB89847A9998F6B379CB01D6CA024531271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 a1ad7082b12ec48da86a1312897c1ceb44af4b335dfc6d6d4a0d62f0a58a0412
MD5 c68f3b5fee5520225e2558a74c5404d6
SHA1 3a1c957c818e50cd56a0794e47befc6e9a3202cb
SHA512 01b398a8a7dcc3ad3358fdb3fb3a83ac1b73f3b9139e6b42abbf06faf33200ac43afce22a871c570579376adfb5bc376f1ac080f50ffd106b9cf5ae684d11c01
SSDEEP 12288:IIK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:IIK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T156D4230ABA2582EBC7BE13F585D7C5C37C789807A9998F6B379CB02D5CB424631261F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 645b0bf9d08413acc55717a5e108db60a468266108106ba1192bb9838bd49502
MD5 efbbc85ec18da735da0e468016a262a2
SHA1 f6f652a9c4eb8124848996191491652ef3a9c821
SHA512 b031b9cb21a68b491500002ff0f8661a15782fbaa456afe29702ad7c25697d99097768675037feed0281dadb2e114a9e461b2cac0f59daa32fa137c1512ac1e4
SSDEEP 12288:arK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:arK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T1A7D4230ABA2582DBC7BA13B586D7C5C37C789807A9D98F6B379CB01D6CA424631271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 b1740c98f59e00555df60a7b4eb126b8653de2787f277cfdf31f48d7fb50401f
MD5 584f22d769b6a6c7634872e0dbf75fba
SHA1 6bc33048415c8b26e1d8dc2eec81c768ce9805be
SHA512 f3701d75ffb8c94ed0bb39d78f4548f2f45220bc4dd853459fc89a4a554faadf209cb761d14887135f23b83b2464188ad3294e69d0d454357ca79913a4dc683e
SSDEEP 12288:FNK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:FNK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T18DD4230BBA2582DBC7BA03B586D7C5C37C789847A9998F6B379CB01D6CB424631271F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 0093eaa30a6104cccdbd4ff48e856cd495911d4fc77e2dd18fe065ea55c301e9
MD5 7ec1f526041cc97833258f005c30477e
SHA1 d84179b06d38a40dee37d262d2915102345d2e1a
SHA512 9fc5795f8e652090d2065f00df63b64ff9609d1e36e41e5d8ef51ed46122a81cb316bc23300c50787549ae735f66f882b1acb4ecba97cbe545f68062f81e55bf
SSDEEP 12288:MdXfNKK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:INKK3zNf0lmRXrz8Upy7Rqm4UHMp2yum
TLSH
T1DCF4010AD25442EAC1AE2279C7968A81B7777C2587E1D7CB23D0F43E1F752802DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 9a146f4287f5bac2b16f1c88c944074a82a96ac01c45af3b9b93a5968635bed5
MD5 4771503bfb98399357b6ce446eda1c29
SHA1 226c43a7b942177d5f942702f9f8a9c9408be193
SHA512 b617d6293de2b11dd3684aaf1fc409cfecfb3c568ea3293244a4e0f91e89bbeca937e330877f339d4df2c91441e16e74adb9cad4dc2587f594b8c74b6190a660
SSDEEP 12288:cL7IK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:qIK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T13DD42307A72996D7DBBE13B4819BC1D23C2CF8169F94CEAB7748705D6CB028525363B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e2173e7262d2fad37945c81cb75b09c1dd0a77f73c1985045554a7c8bb808cb7
MD5 a1318126ffcb9db0d0f912a5084afc4a
SHA1 ef1d710bddcf81211b01ac807f7980c8e7944c62
SHA512 178082fd7fa299047a2d608c19735b4b0112332e347ee2c890d34321715e6f260bf374c55cea84200ebbcff3485b5aba72be4b415d2472c6f72d9a8fffa73317
SSDEEP 24576:0gb6bmBIi49WNNFpg1rSvFv7bYMK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:0gb4mBIBhGFjKOEFH8sy7RqmV1ye
TLSH
T1C865AE1E22E802F5E1FAD2B8CDAA4417D6B278160731D6DF1251423D2F3BEE85D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 2bee0efbca317beb56fc35d04796f4fe53bf5f5b45fcf46bf4ed81ffc260dd7f
MD5 8b7662e4dbc91afb762c865a0e340899
SHA1 2e47375841cb6235d9404a4405b1ace77e21dcfd
SHA512 a515a5efa1e2222827816e863280c9c45cce8a76635a1a6688aa75bf2db3790a796e8dbdba42d203a609c326802eabcc6799f106c205de2f35498dfce3f0e8c1
SSDEEP 12288:lPGcPK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:1GcPK3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T1C5E4221E72B661DACA7A037984A7C4D37CB074515B245EFF2AD4E03D9DA46D0323AEE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 1272971701403f6d5d4001d35b5252b97b4319bdb1c11fc7ee421a5ac3380788
MD5 ec10b2b373685e6d078b525490c8802f
SHA1 44de8c0178acfe33b04c6376423a8420b518f948
SHA512 f151fbd1e3f6f56a2cc3b83f9e4f276d0eb48f6f2ff01ce4692eb4516c33b12d28d1de50aa1f588f12164cfc5926ec33e1f0f55d3e2f81e66028bc9407093556
SSDEEP 12288:SlK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:SlK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T15ED4230AA62582DBC7FA13B58597C5C33C68D4165B998FEB379CB02E5CA42C631362F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4f665bd738c63577c6045d7d30d14c64bbb8946734ce51c26e471c65e9999c8c
MD5 7059b71bc1c8a7711109b4404970980b
SHA1 67c1de1557ac28109ecdcf16a7bc2f1d37b6fe04
SHA512 e89e9553b64346c140539de44410c3cfe33b17936c03c03ece362e7a8e6dacf439117d72c902ace21af76f0f35ff3bd8d7f7780884aeac9c785f718f322cd017
SSDEEP 24576:bls8O8EdJqH1qzria7/meK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:xL5EzqV1a7/lKOEFH8sy7RqmV1ye
TLSH
T1B535F16577E102F1D47BD1388A8686A3FAB1B4250364EFDF07AC8A551F236D50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 cfc872207221678433ca46629d8fe0266dd9f11765f0595baf2b3748f290cd7c
MD5 911a130e28135f839ae4e94eeeab3a9e
SHA1 187070ae6aa76e4046db586eb2c139cce573d470
SHA512 ffcd731b41c03d29a577d49730e4d5ad4ace6ecdfa5f7e7ff7b76a493c4606c6969fb4e2a85b1fe504fc89878da813f7b92305713312bf35c2e225a6c30441c7
SSDEEP 24576:NPUr+NQDK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:NJQDKOEFH8sy7RqmV1ye
TLSH
T14105F11F62AD18E5E67AA17D85838749F771B4620712D6CF03E0817E4E63AD87D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 b756843b6ef912c0dfb1c058c53ba88d73ddbef9126230d9d49297c5afdc1c7b
MD5 b4443423f9f13b408598070f8fcf84e4
SHA1 4bcf6f2222c87d24ed6f94207bada6be10ca7184
SHA512 737d7bed1f2e266976bf5086e6e477e22b7dfc47f30e038379d3414cf79c6b90511fb016995a617abc8943d491103c8ad6a718dc3fa50352aa734f9dcce8d07a
SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj7KOEFH8sy7RqmV1ye:gG05lO43bAEh8XRqmzy
TLSH
T199D5CF6A62EC11F9D1BBC17CDAC68A0BEBB23415033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 8be256a931ec4c7040d103b0eca3e4a18f2296d717879e841947c31b46db9c42
MD5 6f2b8ddf16a269d65f6a983582783e03
SHA1 0c11b73227e4f4e6bd1aaf1b91d6b3105e84883a
SHA512 0a6f47212080011462a2df19df1354a0d9e17fc2f10fd57baf1f2a4a2b2825f96de6a727f1755f0885e8fc25d80283f42fa1ff75f33874f471494c4b01b639aa
SSDEEP 24576:OFa5POZ3dpbWVM50JicR2hG0lasx2+47eidn4K3zNf0lmRXrz8Upy7Rqm4UHMp2Q:Aa5POZ3wJt2pasx2+m2KOEFH8sy7RqmN
TLSH
T1D765BF5EA6FC01D5D1B9D17DC583861AF5B1342253329BCB122182BE3F27EE85E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 dea964862aa3b474c3bb1b7dc617b0e27130d216c648459f882716393135a535
MD5 1675c3500897096b5fbb74d93c8643fe
SHA1 00a4571def9f8c44e77ae6ca9010beef556f0009
SHA512 b344bc5c836f49ee4b07131e8e9b01d869099e55911d513b7882dd22ad7267c9ac45f5ad8d1469d2457304bbdd2874e7e4897a6121a0323d011ff4e413bececd
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkHK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:BNc/zEOVHF0KOEFH8sy7RqmV1ye
TLSH
T197858C1623E901E4E5BBE1BE89779546FA71786513348ACF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 ec34df8e11029d688e50c4f6acb099f1fd01eae1a427baa23797b3cf17992110
MD5 852da18b2c42df4d30bbc125da6e6504
SHA1 b998d2c85279a0035301d4aa021369028ccc5848
SHA512 f58f44c5da691e6d94a7cfbb94fccb73e4bddaf124412035cc8a21410c9acf872f921d9c15d19cbae578a4073ff7a75aa6e6c265290bda908d803afae9da3e52
SSDEEP 24576:3JnJPbzB4S8K3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:3JnJv6S8KOEFH8sy7RqmV1ye
TLSH
T1ED15D03DD2A810E9D4B7C2B4815A1696FE31386D2F266DCB29B4D4343F12FD06A39F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8013c2a46e1904840b60ac69eeb3410bc4c803bb76d0825e5e99a2b85733418b
MD5 d9553de7398d6dbc247175d9c7aca0d3
SHA1 7c3a88d66ba03b18b211484f93c78ee0e51f90da
SHA512 cb6e12d4b84ab64937feddaf2515f192282dd1bd4a97e56d9afb691c980715b6490e60736edafe6f7a767c508e547b697a89ff4ba52f916c6d69fd4545db3225
SSDEEP 49152:QCLHGeeV5ijCmlDWDkUKOEFH8sy7RqmV1ye:LcEh8XRqmzy
TLSH
T14CA56B05E7EB4184E8F3CAF5CA2694169E327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 df3249152955b1840c47ce7d4e82ff2ee1308e71ef9641218bdf21ac0904728f
MD5 904cda43971f386d0fb8e6bfcac31b7a
SHA1 d4515b460e9e7107eda13f8f67df52252716f156
SHA512 0031df13714eb9ce257429e813f0810ffe2008eb414252282609d27d2f7a33d0967798f42071bcd752467a15728d25ced5a56977551b0474ef837956ed531fca
SSDEEP 24576:I6DIuK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:I6DIuKOEFH8sy7RqmV1ye
TLSH
T16AF4011D337A10FAC1BB913D86834542E5B2B07187625EDF1BD8C07E8EA3EC87539A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 c49d0567823a8b99c94b9c336a16db4f94f0eaf13137fc1aeb2702d2b5d5bf9a
MD5 2e4f2ceab8a9bf45e85c837b9f1e479a
SHA1 942ef102f4469454d1cc29fc223b57c22c4ec0d6
SHA512 5d7a6c7f715bfbda445562263ca1205d13ffa3f5dad2acc373efdd811d263241a75ed91c2e506ec5353cee0d176413a9ccb36a21af3f653c22c8da3fcc6203bb
SSDEEP 12288:IG6kyUOK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRW4:JtyTK3zNf0lmRXrz8Upy7Rqm4UHMp2y5
TLSH
T1F8F41205636461D6DBBA13788AA3C1D1AD34BC219B618BEF36D0F23E2E757C43531B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 7d9cd75421475480af60af34e20a62bd0d53e0a942fa70c347654ec247de6f63
MD5 98f918326a89717d1a2fd16ded3db058
SHA1 cdf5498cedd35d9da319b928f1b6278a5590d76f
SHA512 8e2aa8de5864762c1623d4b685193896c96234d0687c44748f944c48728d8c14142b36484fb1ba8dcb8a1f3aff10ff0ef9486f9c9a3bdb3ad758a2989c6c2781
SSDEEP 12288:++pK3zRjio2lluxRXQFsTFR8UpCniuEARyCw7m+Rh6HMB7gPAr0tji96sRWud:fpK3zNf0lmRXrz8Upy7Rqm4UHMp2yuji
TLSH
T1E2D4234EA32562D7CBBA13B88197C5C37C78B4265B554EEF37D8B03D8CA42C52136AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 f689c8609720cc6aaef64b8059ba818ee2a66edd38e68171ab334843549af096
MD5 d30b9f2966217ece435a647bef47c8a4
SHA1 e340848339eddadac0166c9ba8764d620ff6cab5
SHA512 5d0565c9a63aad32637d4fa5d6da5ae01657e738be4c3d261579a4b783352f6e0bb9fa2e0632b4895221e33ff6b71586a73ba5429bc01b27e69d3b012625cfee
SSDEEP 24576:3QgH1oTfaidZ6K3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:Ag+TrZ6KOEFH8sy7RqmV1ye
TLSH
T15C559D1DA3EA05CAE2B2D275D8635493D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 3463191d78880be4d2a79ef579b0eea3d5d67dce00957643dfb48c470fcc6510
MD5 0f6235b36882986f836003dc5636fb74
SHA1 72a1bb77057d4c922f7064cf07fb046bbdaf0037
SHA512 bcabf595ce06f536eaf89d9655f4f346857b70fb0b76cded21c540e824f06c0845dc741d85fd6b8542e9b21933dc50f4c643e25b8a763e8fb4eef1e4dd2c8dbe
SSDEEP 24576:jrcmR+dK3zNf0lmRXrz8Upy7Rqm4UHMp2yujcZ:fcmR+dKOEFH8sy7RqmV1ye
TLSH
T1D005F10EB36E00E6D2BB827CC9828542F6B3B03157525BDF12A0C77E4D676D93939B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 bfcf6d4c7402f5b9334fc15d89de03bd49e9c10fdf6c0947454140a49a90a3a2
MD5 d92b522a96be94759b0d4a0ef5e98a30
SHA1 dc16632285d318cdc2747cc0aad10a37ce602f7f
SHA512 599f975eb2c06c32cbaf932df6afbb39b1cd18a94cd627a145cf7ddf7d80283fa629db66e244b616cd6859b54a362df2538f5b7c6cfb67a3f410b375191504d9
SSDEEP 49152:yDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3UKOEFH8sy7RqmV1ye:z3Upow8sB/Eh8XRqmzy
TLSH
T113A58C3DA2E800A8C9AAC379C54213A6EA71742E3F3055DB0174C578BF1BEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-286-0x0000025537E50000-0x0000025537EB6000-memory.dmp

Download

memory/112-285-0x0000025537E50000-0x0000025537EB6000-memory.dmp

Download

memory/112-374-0x00007FF70EAB0000-0x00007FF70F1F3000-memory.dmp

Download

memory/112-453-0x00007FF70EAB0000-0x00007FF70F1F3000-memory.dmp

Download

memory/112-284-0x00007FF70EAB0000-0x00007FF70F1F3000-memory.dmp

Download

memory/112-451-0x0000025537E50000-0x0000025537EB6000-memory.dmp

Download

memory/716-359-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/716-273-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/716-278-0x0000000000910000-0x0000000000979000-memory.dmp

Download

memory/716-272-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1524-57-0x0000023530EB0000-0x0000023530F75000-memory.dmp

Download

memory/1524-59-0x00000235310A0000-0x0000023531106000-memory.dmp

Download

memory/1524-58-0x00000235310A0000-0x0000023531106000-memory.dmp

Download

memory/1632-312-0x000002AC67500000-0x000002AC67566000-memory.dmp

Download

memory/1632-311-0x00007FF755B50000-0x00007FF755C03000-memory.dmp

Download

memory/1632-389-0x00007FF755B50000-0x00007FF755C03000-memory.dmp

Download

memory/1632-313-0x000002AC67500000-0x000002AC67566000-memory.dmp

Download

memory/2036-234-0x00007FF7B7960000-0x00007FF7B7A28000-memory.dmp

Download

memory/2036-320-0x00007FF7B7960000-0x00007FF7B7A28000-memory.dmp

Download

memory/2036-235-0x00000228D93B0000-0x00000228D9416000-memory.dmp

Download

memory/2036-236-0x00000228D93B0000-0x00000228D9416000-memory.dmp

Download

memory/2072-378-0x00007FF734100000-0x00007FF7341AD000-memory.dmp

Download

memory/2072-294-0x0000020096020000-0x0000020096086000-memory.dmp

Download

memory/2072-293-0x0000020096020000-0x0000020096086000-memory.dmp

Download

memory/2072-292-0x00007FF734100000-0x00007FF7341AD000-memory.dmp

Download

memory/2212-16-0x0000025DE5F20000-0x0000025DE5F86000-memory.dmp

Download

memory/2212-71-0x00007FF7FCA20000-0x00007FF7FCB42000-memory.dmp

Download

memory/2212-17-0x0000025DE5F20000-0x0000025DE5F86000-memory.dmp

Download

memory/2212-15-0x0000025DE5F20000-0x0000025DE5F86000-memory.dmp

Download

memory/2212-14-0x00007FF7FCA20000-0x00007FF7FCB42000-memory.dmp

Download

memory/2780-244-0x0000026C77400000-0x0000026C77466000-memory.dmp

Download

memory/2780-245-0x0000026C77400000-0x0000026C77466000-memory.dmp

Download

memory/2780-243-0x00007FF7B7960000-0x00007FF7B7A28000-memory.dmp

Download

memory/2780-329-0x00007FF7B7960000-0x00007FF7B7A28000-memory.dmp

Download

memory/2808-350-0x00007FF6B0AF0000-0x00007FF6B0C39000-memory.dmp

Download

memory/2808-262-0x00007FF6B0AF0000-0x00007FF6B0C39000-memory.dmp

Download

memory/2808-266-0x0000024599B60000-0x0000024599BC6000-memory.dmp

Download

memory/2808-265-0x0000024599B60000-0x0000024599BC6000-memory.dmp

Download

memory/3040-25-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/3040-0-0x0000000000400000-0x00000000005FA000-memory.dmp

Download

memory/3040-6-0x00000000024E0000-0x0000000002549000-memory.dmp

Download

memory/3040-1-0x00000000024E0000-0x0000000002549000-memory.dmp

Download

memory/3308-370-0x0000022E0C7F0000-0x0000022E0C856000-memory.dmp

Download

memory/3308-369-0x0000022E0C7F0000-0x0000022E0C856000-memory.dmp

Download

memory/3308-368-0x00007FF6928C0000-0x00007FF692DC6000-memory.dmp

Download

memory/3308-448-0x00007FF6928C0000-0x00007FF692DC6000-memory.dmp

Download

memory/3432-341-0x0000026D13FC0000-0x0000026D14026000-memory.dmp

Download

memory/3432-347-0x00007FF621FF0000-0x00007FF622310000-memory.dmp

Download

memory/3432-340-0x0000026D13FC0000-0x0000026D14026000-memory.dmp

Download

memory/3432-339-0x00007FF621FF0000-0x00007FF622310000-memory.dmp

Download

memory/3432-345-0x0000026D13FC0000-0x0000026D14026000-memory.dmp

Download

memory/3784-302-0x0000018C080F0000-0x0000018C08156000-memory.dmp

Download

memory/3784-386-0x00007FF727B40000-0x00007FF727F56000-memory.dmp

Download

memory/3784-444-0x00007FF727B40000-0x00007FF727F56000-memory.dmp

Download

memory/3784-442-0x0000018C080F0000-0x0000018C08156000-memory.dmp

Download

memory/3784-303-0x0000018C080F0000-0x0000018C08156000-memory.dmp

Download

memory/3784-301-0x00007FF727B40000-0x00007FF727F56000-memory.dmp

Download

memory/4148-332-0x000001FA09F60000-0x000001FA09FC6000-memory.dmp

Download

memory/4148-445-0x00007FF741F20000-0x00007FF7420B4000-memory.dmp

Download

memory/4148-330-0x00007FF741F20000-0x00007FF7420B4000-memory.dmp

Download

memory/4148-331-0x000001FA09F60000-0x000001FA09FC6000-memory.dmp

Download

memory/4152-54-0x00007FF65C0A0000-0x00007FF65C207000-memory.dmp

Download

memory/4152-52-0x000001E270AA0000-0x000001E270B06000-memory.dmp

Download

memory/4152-47-0x000001E270AA0000-0x000001E270B06000-memory.dmp

Download

memory/4152-46-0x000001E270AA0000-0x000001E270B06000-memory.dmp

Download

memory/4152-45-0x00007FF65C0A0000-0x00007FF65C207000-memory.dmp

Download

memory/4176-353-0x00000233B2150000-0x00000233B21B6000-memory.dmp

Download

memory/4176-446-0x00007FF73EA50000-0x00007FF73ECDA000-memory.dmp

Download

memory/4176-351-0x00000233B2150000-0x00000233B21B6000-memory.dmp

Download

memory/4176-352-0x00007FF73EA50000-0x00007FF73ECDA000-memory.dmp

Download

memory/4316-249-0x000001C4A06E0000-0x000001C4A0746000-memory.dmp

Download

memory/4316-338-0x00007FF7D19C0000-0x00007FF7D1AD9000-memory.dmp

Download

memory/4316-248-0x00007FF7D19C0000-0x00007FF7D1AD9000-memory.dmp

Download

memory/4316-250-0x000001C4A06E0000-0x000001C4A0746000-memory.dmp

Download

memory/4572-390-0x00007FF67EEF0000-0x00007FF67F22E000-memory.dmp

Download

memory/4572-450-0x00007FF67EEF0000-0x00007FF67F22E000-memory.dmp

Download

memory/4572-391-0x000001B7C2E60000-0x000001B7C2EC6000-memory.dmp

Download

memory/4572-392-0x000001B7C2E60000-0x000001B7C2EC6000-memory.dmp

Download

memory/4616-29-0x000002185ACF0000-0x000002185AD56000-memory.dmp

Download

memory/4616-28-0x000002185AB10000-0x000002185ABD5000-memory.dmp

Download

memory/4616-31-0x000002185ACF0000-0x000002185AD56000-memory.dmp

Download

memory/4616-30-0x000002185ACF0000-0x000002185AD56000-memory.dmp

Download

memory/4624-38-0x000002C23E940000-0x000002C23E9A6000-memory.dmp

Download

memory/4624-37-0x000002C23E750000-0x000002C23E815000-memory.dmp

Download

memory/4624-39-0x000002C23E940000-0x000002C23E9A6000-memory.dmp

Download

memory/4724-379-0x00007FF726590000-0x00007FF7266BE000-memory.dmp

Download

memory/4724-380-0x000001E217A30000-0x000001E217A96000-memory.dmp

Download

memory/4724-381-0x000001E217A30000-0x000001E217A96000-memory.dmp

Download

memory/4724-449-0x00007FF726590000-0x00007FF7266BE000-memory.dmp

Download

memory/4752-441-0x00007FF717ED0000-0x00007FF718172000-memory.dmp

Download

memory/4752-323-0x00000152FBB80000-0x00000152FBBE6000-memory.dmp

Download

memory/4752-322-0x00000152FBB80000-0x00000152FBBE6000-memory.dmp

Download

memory/4752-321-0x00007FF717ED0000-0x00007FF718172000-memory.dmp

Download

memory/5760-447-0x00007FF7AC010000-0x00007FF7AC4E0000-memory.dmp

Download

memory/5760-365-0x00007FF7AC010000-0x00007FF7AC4E0000-memory.dmp

Download

memory/5760-361-0x000001B993BD0000-0x000001B993C36000-memory.dmp

Download

memory/5760-360-0x000001B993BD0000-0x000001B993C36000-memory.dmp

Download