36e71e5cb43999b9eba7f9e4d86959c022bddf25e258163c9346376125e34870

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Size 2.4MB
Sample260830-1m3eps1ane
SHA256 36e71e5cb43999b9eba7f9e4d86959c022bddf25e258163c9346376125e34870
MD5 0fa3845d06a3ea194e757e8bbfda26ab
SHA1 0cd641d4c823db4b04c2382f89f06cc4f7b082d5
SHA512 b0a1d9e88d6c5191466e9f3c289cba3323d41819196a03af487288f812557c611e2b1a59f4f5af708232877abc243bf87c4e9c572cc6d001985d959eb76f9488
SSDEEP 24576:NhYjiTIly/LO7MO0cXyxWWYO/McuXpQkM7LEDr1zHHjRLi5Y4MfO:NhMingDXOn0DpQP7gDdoE2
TLSH
T171C5AF35368B8A36FDB22571497FAB1F8C1DD854072440DB53B80E2F1DB0BE2AE7165A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5676	elevation_service.exe
3140	elevation_service.exe
3380	maintenanceservice.exe
1680	OSE.EXE
5932	PerceptionSimulationService.exe
3048	perfhost.exe
5056	ReFsDedupSvc.exe
2624	SensorDataService.exe
5600	ssh-agent.exe
4256	AgentService.exe
1300	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34587dc2238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000077e5d81cc938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001944f31ac938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000003c3ab1cc938dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007025e81bc938dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a62c15ec938dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\ = "RLEditor LAF Document"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\print\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\shell	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\open\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\open\ddeexec\ = "[open(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\print	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.prl	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\DefaultIcon	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\open	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\open\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MsplDocument\DefaultIcon	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MsplDocument\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,3"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MsplDocument\shell\open\ddeexec\ = "[open(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\ = "Bst3Gpp Document"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\print\ddeexec\ = "[print(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\print\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\shell\print	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\printto\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\open	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\printto\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ehplmn;.oplmn;.uplmn\ShellNew	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,7"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\printto	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.laf\ShellNew\NullFile	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ehplmn;.oplmn;.uplmn\ShellNew\NullFile	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\ = "RLEditor TOT Document"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\shell\open\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.laf	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE,1"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\shell\open\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\print\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\open\ddeexec\ = "[open(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\shell\print\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\DefaultIcon	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MsplDocument\shell\open\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\print	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\print\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\printto\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Bst3Gpp\ = "RLEditor.Bst3GppDocument"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\printto	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /dde"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\open	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\printto	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Bst3GppDocument\shell\open\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\open\ddeexec	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\printto\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-0~1.EXE /ddenoshow"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.LafDocument\DefaultIcon	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.MlplDocument\shell\open\command	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.PlmnDocument\shell\print\ddeexec\ = "[print(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RLEditor.TotDocument\shell\open\ddeexec\ = "[open(\"%1\")]"	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe
5676	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Token: SeBackupPrivilege	5056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5056	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4256	AgentService.exe
Token: 33	1300	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1300	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1300	SearchIndexer.exe
Token: SeDebugPrivilege	2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Token: SeDebugPrivilege	2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Token: SeDebugPrivilege	2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Token: SeDebugPrivilege	2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
Token: SeDebugPrivilege	5676	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
2396	2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1728	1300	SearchIndexer.exe	100
PID 1300 wrote to memory of 1488	1300	SearchIndexer.exe	101
PID 1300 wrote to memory of 4588	1300	SearchIndexer.exe	102
PID 1300 wrote to memory of 2844	1300	SearchIndexer.exe	103
PID 1300 wrote to memory of 1444	1300	SearchIndexer.exe	107
PID 1300 wrote to memory of 2024	1300	SearchIndexer.exe	108
PID 1300 wrote to memory of 3156	1300	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_0fa3845d06a3ea194e757e8bbfda26ab_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2396

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3140

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2624

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4256

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1772 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2556 2712 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1444
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1772 2884 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2556 2712 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 438e2c539d06cc9ca42696a55dcc8b41ed6dc7687e2f08ab61678adfc5ffb10b
MD5 b265f9466669e5ad92583c98bce507a7
SHA1 ff462185fca05bbb87d577d0d8085828fb943c90
SHA512 c3038f2ee089c283317cee7c9783966aa0fb2f86e371575c401160b21cd314604ed0911717b12a7db19aa5e77ec1a6a5287926c4fe9879124bbee7ef429fe91f
SSDEEP 49152:Hb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxDpQP7gDdoE2:13q6sjBouPs5oE
TLSH
T154D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 496915c6d8273aa9e107a0a9ca875a7e8adf1541b54032ae867c4f881e1e7e21
MD5 7f34e36ea0f6f76c8e77c22a2dccd71a
SHA1 12fe6c0fb399b5257c6ca76e0d22f24f7cb6b844
SHA512 a816b338d8f408f073f116f0a602696717640f352ee955fdc5b13f55a042d689a8d48fb5bb866de96d2d6a03ca43e5c9589f95f6040d8792604e7f98e197aeca
SSDEEP 24576:IXYfDtczAvMcuXpQkM7LEDr1zHHjRLi5Y4MfO:ftc7DpQP7gDdoE2
TLSH
T1B505F128B3E409F9ED678138CCA28511EA737C9147A4E7DB03A499651F333D89E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3c7f81730c8efcc14d1d22ce7a4e60f4a9fcc0092790d3c63f087b1934f4f43f
MD5 6973313294ea40282f1b1eca4e2e8f69
SHA1 e9848d42b3954b5e882a2ffe5f2cf60a5636536b
SHA512 a34020f050654d56876c12280bda992a3b1244a1fd2e31bf0428c73d3890638a1e39a338ca0a0795f2f17418ff1f1f2dacbb520eac2c8840382e840cc7ecd641
SSDEEP 24576:40Le5ji0hmxxrMIMcuXpQkM7LEDr1zHHjRLi5Y4MfO:4Pji0AjqDpQP7gDdoE2
TLSH
T15B359E16F6748335D073C0B9C5D2A69AED7234825B308ACB4286D77C3E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 59dbfbdf454deec553edb97f50e41ba9344e6864d14bc628b9251041741aa553
MD5 7847e61db81c40f89e53b555fbaaed3b
SHA1 be224700820ac29c9d04fa7b2168f5e3678cdaa7
SHA512 04aea90a7be11274556e37252bdfa53ee553463487bfbc9b997f886463a987d06bbe110195925a21a71e9ea4e13cfcb8d28cf0a13a664b5338d7973ee797f39c
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWn6q8wyuyMcuXpQkM7LEDr1zHHjRLi5Y4MfO:f/ezSC6vUzPveHjyWDpQP7gDdoE2
TLSH
T152755B15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d38041a0b318569fa2a18c0ed6241a5f125e6e02c474e9002029d434d6d7975
MD5 999ee97ca7ae67d80c84c2e801c6c7b4
SHA1 41afedbca1d9747baecb03c93f5c876dbfe1a334
SHA512 50724382c73ce19c6382382551ba5b3875912b1a81a99edcd317932259146169e1a961f8a2389041c5618f696b374602d46a5955b7ca611bcc740df0b539f7ac
SSDEEP 24576:aVbqPb88hv/l+YrMcuXpQkM7LEDr1zHHjRLi5Y4MfO:aVO88hXl+DDpQP7gDdoE2
TLSH
T174559E66F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 acfa8a15718d580a1e16d0b2da19e9f6d5b125d3d4bf6d18ced0095175fb7e2e
MD5 f027b15cbc84341afcb6a99fd8fbbb4d
SHA1 aba5bac92cf3f3ae43c6f5a4c507383824ea9db1
SHA512 621078f75d47eaf31670010071ffb925e3a9d0ef5c4cb95ce52a4b694eea105171a3959e1e78b4ad1eb763b599183825ca8a4ea7409d8a7914fe9b263ef67b25
SSDEEP 12288:IL0twBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:IL0McuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T136C4234A9098194DFBF74431F97B7991DC628CA08AE80FA6A16AB5C51C3F1E8DD31733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f421883cf069b99f6e888a22eb814507322ff336390ead20c1513169403ca3c2
MD5 4786f44b8eb37d49bfb7d4a29cb9bf1a
SHA1 f8f3fced841548dbfc00f5b86945c89ec92da3ab
SHA512 a79f607dbba4f723bc38b2ed1f97ec22a0ccb28f3bb6367b1a16f2c00740343918b5241ba585052c04508a8505405739608bf6e3ef1044afc9cf6fd04990b2c0
SSDEEP 24576:DJIUjMcuXpQkM7LEDr1zHHjRLi5Y4MfO:DJIUADpQP7gDdoE2
TLSH
T1F105CF3BEE28FCD2C27A8D785A918640DB7278704F6293CBD175C24E9E235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 acc6ec0614275388617016f584f84541d070f27194fc1ddb6b8401a3dac0991a
MD5 7b91e4cbec6d39e176f9340370da45d1
SHA1 735d7a82e27fcc3f70d2f83524866adfb425ab38
SHA512 028b941624eb2fc3ca4faa7062a6983068e5881a47da1c52fc406afde78234647a12c84abf22bbea6a13cee8da0f02ce3ae0f2e755ad710606796077c82d67d3
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THp:gQvGAdlCEL8c/DRNw5CbuPs5oE
TLSH
T120266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 612d535b6e5730170b45d436d4f17bcb37e145f0e756c68cd908c55f98340815
MD5 2b30cc4a5033c403383eecfa45b6ef5c
SHA1 9c970d556689bf1abf6a489b18d6ab38b6e34aeb
SHA512 5f9653e582eb6046b1e23deababd805aa50ced2bdf5c925d12bd7b84dd6575423c3cfe8a1d910127a7446c21158cf0ad188e030309e11dcc719fbfb9cd72efe1
SSDEEP 24576:90ewsAjlMcuXpQkM7LEDr1zHHjRLi5Y4MfO:mljaDpQP7gDdoE2
TLSH
T19515E031FA74E036C7BB0CB21B36D716583D6D204FA11AC3E3A89D8D59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 629a2f0b283acb3c1ac0110ab1dcf564b796b590f62b07006113327a52279515
MD5 0aeaa296fb17427389becbaa6753a24e
SHA1 f8ce0bfa91cffeb6a9c4133c65a9ac8ecc01b6ef
SHA512 547bc7741c99724b7eb9dcde5e00c9f1812ec9b553d5cd56ad144fa010dfa33e2e25e68f0f998711dc427b31a1d65a98b4971a040e82c577b3fd554037853041
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHyuPs:UUEtQevvqc2W1cpV2tI32NP
TLSH
T143474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 12600c530940724d7df189f6514d72d4c7db741589585123e2b6cc9a532b9e66
MD5 f1b052965cda42f6feee905f09bc8271
SHA1 2e55e3b02eacb10ab6899aaa09edba64a4446b5a
SHA512 6c3942158d38e55bad9251f33a474c44551c7ac02fb7499598162e7e2c5dd1300e4db0d9c98532ab7223a8e9ebf3357f6ef2db75664dd050b84f650678879d06
SSDEEP 49152:pCbRquA/m2yL5zLfFiV+XenmE3/z6DpQP7gDdoE2:moq2VjnmHuPs5oE
TLSH
T11FD58D0976B8C1E4D1F6C77886A2C647F37178154B359BEF4266460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5afc8c983c4e394c746c2049f841761dd9c81fc084903c6aa39f24b0b34b8429
MD5 9499da2b416a5e07b248f508359f70a4
SHA1 0429e90874526e842564dcad851c7b6addeb66d5
SHA512 49f26188bfa6e60a6a2a6215eca66b211f24b467b313ae9619a5a9bec266a6f1874bed71872ee3fcbca69f0f6783b7ddd27f32af473211b4fe552a7106b6c5db
SSDEEP 24576:kAhGL3IFoiwtA5l7S53GMcuXpQkM7LEDr1zHHjRLi5Y4MfO:kAMUFoiq53DpQP7gDdoE2
TLSH
T1F7359D81E7F955D4F5B3AA78A9B69570EA72BCA55E31C20F2160D10F0E33A90DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 8fe513f95d003f8637612ccdc7ff6d99c8968be1f0465c34352dc24741bdd670
MD5 ad8c7b4b84c8b172e2d7602b2a92bc4d
SHA1 53fbd3fc8a876d45425994372299730936684f0d
SHA512 dd171301095a57ee1722b2405df3613ffef299e334454c62d9096610533c96845b39c77fa9083515f11013424d3834e4d9f40c4ef79606d0accfdc872760619d
SSDEEP 24576:zwu4OWJMcuXpQkM7LEDr1zHHjRLi5Y4MfO:zwvOTDpQP7gDdoE2
TLSH
T1B705F14A72A40CF9E9A78138C557D536FBF2BC112A65CB1F1360C65B2F37361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 978437545a74707516e90073d14dae510c01d33cf978e0edf9222463be1377bf
MD5 7f5e72852f5da03bdf50d52489219eeb
SHA1 df23a375c1f0a295190bf7b2dd5463fe4e500911
SHA512 1a097a05d76d2958c5c056cdedb7c364d01fef231d04cccee85b8b69b068dc2bd261262ea476a937036ad9139e0a6556a7e2d8def0184f08bd377e4583717f67
SSDEEP 12288:5eZ1IyVtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWH:8ZugMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T132E4128A32E821F9E6B38138E8F25645DB727CA257B503CF122562862F376D1DD35732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 16821f844d0bc7ce499c34327acaa62f8411834cedd9892f38dfd75aee857119
MD5 477d18ba9e19320cf0ea04acbc4badf9
SHA1 5cc11a7d482e186a4f465acab2a60e6ea72591c5
SHA512 3a632e6eb0bf28025f53dc9e49743d0fe66f928d9403b7448db9e1eda78bd81003205d35c1d08dcfb0ce494e09c763ffa8250921145ebd632a5738b57935fe78
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:7QRQyi36YOcPbLvw2gAf+PN3MuPs5oE
TLSH
T137667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1ef7e5e61b58014a3e797aafa18f04b8a5d9a746b5aa52e78a0b650606c95630
MD5 18b3db0f6a80f3b7f0af2a2ec4447513
SHA1 c9699c1e64d76a86a909e51f19a875a56a412213
SHA512 138b9754159d95aba0508ee8d9e55429043c0752f03415a9cbb354be778067b287a62091d17b9858f2b7eb06f738cb8d22c95714a963b5b5fb87fe9bbdaecc16
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U1:UQRQyi36YOcPbLvw2gAf+PN3MuPs5oE
TLSH
T127667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ce88d61a81d116af9d79a08c6208e5e285fc4a0889707a84e6f143b27079db8b
MD5 c9c090f4e8e3dd057b0ba8f712f1504b
SHA1 b5cc0a717307547c32d0a705d94bd76cb4571b4f
SHA512 62f0f7a393feb79556265f81272b3deca2d934c2cbcc4f0e948127af1a89a8e640579434096e01cbb47346545506e6f3bafaca84b6440a120b7f81b8178f9ab6
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0wMcuXpQkM7LEDrQ:V68Qg55nhceWu7PNU3/qDpQP7gDdoE2
TLSH
T17BB54933B2F60099C44DE1769F4A972196E27C718FE0E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 dd039beddb0181d879760ec962f935557c4d6b5ddbee29fe8899ce74908a0939
MD5 e1fc6f41df3d9dfc4a9d53f0d0145e32
SHA1 0f4b91fd9c81a19a2f23b7195589948e239feb59
SHA512 f7102164eecb4e6c8e4a4cd73d7713ed4f240c862b019665b6817de4d9c8745b2d172b01ca0f6774a9b69498c455c8b1378b7178d11db53af760d2cda7e34cfd
SSDEEP 49152:i3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99z:jy5112gYy5azzVvt69nLKnhZtuPs5oE
TLSH
T1A3168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89bb3c8ebe0fd080096a44a7e95fd21e54128bda9996cbbf1e8e258720f8d12a
MD5 fd2b8e083fc6e755fa847c300aa6201f
SHA1 238911ed0a430872dc3e47de8d0c5b763a9ce28a
SHA512 79cc8f6ac2e614b9679ce2ae5f7ca2a60d3e709322def503cb0815117fe0fe77642fa8cfd9f59c348cb2ff29c2d728354ce857e87da5b216cf8f87ccb4c9f049
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl0DpQP7gDdoE2:Ru6Jmdxd2d0uPs5oE
TLSH
T101D59D13F1D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6649b25420b391a734f5ab7b8cfe93daef2369a45944b00593cac68af2afdd0d
MD5 14dbebc1ab5866173cdb7ca193b420a0
SHA1 8c50996ba8a6b31dfaa40e6889e17fbea4a20a7d
SHA512 b770f5ca6d1930c8c6cee20eca9e279c90fbcd5b550ccc8ebafe0eb95514cbdba3a55285713e42de6383e6b6003b1f57bff4201894d15b85bdbc44c2d12388cb
SSDEEP 49152:l1hpsNoJpF1A63U44CwH7R4xgDpQP7gDdoE2:lmifPWRHuPs5oE
TLSH
T1E3B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e74498c96832118b3d3f319f163c2741df25202b7b4535375e0abba6f3da1d4f
MD5 a5f3a6e61edbb437084a43c89b864ed0
SHA1 7cbafdfcf65753dea2a1159a649bcb8b0e1d178d
SHA512 dcdba7e3d5c902fffa2712c828957bfb49dc0842465bd5c7b9eb2f8bc434710729cb037ae3d389dec19ebf4aea463f132e391a105f01a02fae9e7957549a887c
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqhDpQP7gDdoE2:a5dKii61huPs5oE
TLSH
T12BC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 239497b6b178126928e563fe378f8e3647ac7cfdd740ba401984927c95220d64
MD5 b882e31e5134eb6b0041eac9486a6fa8
SHA1 a88e5fdb8ab461b55d68f28240a6166b62454ed6
SHA512 e15e07ca1f6948435dfb3804fc4d892bec677f0ff4fc24a2546ce91a30c344bb8c05cee70b3b39a8f5642686bf4693bb9d0ca18cad7368ab0ebeab7d54f793e6
SSDEEP 49152:NhtSn8EApI0fig3giDn0AP5wkDpQP7gDdoE2:cX2imphzuPs5oE
TLSH
T1E495BE13F2D900E8D06ED174C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 583309659804ac47bb09ac7cbf1a46577d258cb976da783dfda2c73ddf30157b
MD5 534a68b405c568ae484ca81c6e9b7129
SHA1 8ba8baff7d6653a2494d7cfeb11a2f032dc3fc78
SHA512 91b32d406b65aaf597de005999ea6f9b2dbee54191dcaf684586c11a397e8702d9a062a984c5c0fa538da146958dc22802459671d6794c047acf68c0bd8c07c0
SSDEEP 12288:9stwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:9sMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1B7C4234DE4D90A4EFAB38471F56735C4DC624CE19BE90BA6B12EB0812C7B2E4DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 b04e27d8df92f9d829c5d6839441a168669faffbc76725256366ab0f4efe0911
MD5 b3254037f23bb747d652f23885889fad
SHA1 cd575b1cfc5bc5e09acd3d23764f41c5d65790cf
SHA512 901dd8a6fb2f80e16554469c303e68baecca5fc62d3f70b363ffc93676b521d66415dbf8fd9d014b761379baf8adfc884a71c31c7384cf1dfc8480bb5b6dba41
SSDEEP 12288:lxtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:lxMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T12AC42349A4D90A4EFAB38431F56735D4DC624CE19FE90BA6B12EB0812C7B2E4DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7ac7f1db919c208e045eb3c505d1e12e570f2a35a11d9ce9578c8272d083c033
MD5 65cf96bb86f618b6ba1a6e6cb13667ff
SHA1 b9785a5151389368401f7b039b5fbeed666b9d67
SHA512 ad6c5f4b1a94c6a4bf7b8035cdbd070ffe337f2ba73cb528e01687f93feff7c8b475f68c807df229060ce740c4ecd51092a09ab2740ef3e3fcca2d9965c95220
SSDEEP 12288:J7twBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:J7McuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T12BC42349E4990A4EFAB38431F56735D4DC624CE19FE90BA6F12EB0812C7B2D8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 d406febf00e3b8b8604418e8e10be6a9cf7890962a2edf0646887183b7c0a966
MD5 91516e1cee7c75177d64e556736ad1ff
SHA1 1c6327a33724434964186fb49e8a877d04fa1a3b
SHA512 c35a5b38822b1712ce4b768da3cf19b0995cb5850753fd308d99aa0e6d224fff6c00903405cbe5fa9de147a6257856707313ceb9ff110e4367c36c118dc4b775
SSDEEP 12288:qVmtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:BMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T12ED4234A61A905CAE9B3C130E9736591ECB2BCA09BF50BEFA21574851D773E4DD30B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ade0a24683ec58d5d73c6cf424f0c71d2a64fcf379c21715c4d611ebd9bdd9c6
MD5 ed533c0dc698aa54f3dde73c7d32e9b8
SHA1 9af3c8b6aa0d8b2430a5bef0d85a74dcc06f45be
SHA512 83abb4a5ddac3731791b424d5009f50cd4555f6909163dc897e8b374ea109798b66e1138246d2e36b12113c8f0e2b214b479246439cf92862c4dec08ecb37482
SSDEEP 12288:QOtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:QOMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T174C42349A4D90A4DFAB38431F56735D4DC624CE19BE90BA6F12EB0812C7F2E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b8663b1d677d59521442c82b2068207ee35d9ea3ee161ef32834355e2766671b
MD5 102883752588f3d844fdbb27d9aa15a4
SHA1 b4bfd0c490cf2d46ca42fbe49aa76ce1a81a05ff
SHA512 90009c520b9448a99f59c8b15f13be3cf4cc14c3fb1e9a0cae05b545c4fa93df920df41cf34bee485de3180429a221bc8dd1d27269d4f420d2320fd1d59f9039
SSDEEP 12288:r9twBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:r9McuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1D9C4234DA4D90A4EFAB38431F56735D4DC624CE19FE90BA6B12EB0812C7B2E4DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 903fc3e5cab3f920b03ca4b3a2428bb9e7ea36941fb44c5f4dd8ee7503cc434a
MD5 312e088a95e0656f2a5d836bf64a2d3a
SHA1 845f4b310fd5304b4df72dce80512e5bfef589f4
SHA512 e824d2964ef8750b8864a5700e2bfc02f86cf0f9731befee420f16c565420da4f909951f38dfa95162dd119e412a792269f67f44b616806f0191228255824cbd
SSDEEP 12288:0ZtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:0ZMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1A9C4234DE4990A4EFAB38431F56735D4DC624CE19BE90BA6F12EB0812C7B1E4DD31A72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 9b0e6c384efa04ba07322092b7ddf959c69989f8c1f0abed24b2eb21cb0508b4
MD5 a591646a024ce79fd7c8339c53be6d65
SHA1 c2ce96d0318d648e0628e639fff5ea0d45cba0e4
SHA512 4c266fec4f87f984ae121a415b102f245aebc3702059dbd07f65859cc85c8154032f63a2fcbc131eab7901b61b77ed58f2ee7932211913dbff6b76d497a423e3
SSDEEP 24576:0ZMRzFVSORMcuXpQkM7LEDr1zHHjRLi5Y4MfO:0ZMRzfSDpQP7gDdoE2
TLSH
T1C4050195B39018F8ECB3813AC9669906D9B27C550BB0CA5F13B836571F333A15C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3bb4d0ed17a571eee72ec876be83cdeae87edbe2b68fdbd44352049a4a2f6757
MD5 e6aa3b27bc83ac096fe6e9b11a9bc419
SHA1 30f7c09dfce506c2ab5cc9a474c9c950c632b5ba
SHA512 8ebf089515151d65c19a00512ba2a1133e179c7de61969441e3447b7343c3c72e9b49a064aad0c8ddabe967626d2588a018b383baa3d73f82bb1e4a14fdfa3c1
SSDEEP 12288:CQtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:CQMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T130C4234DA4990A4DFAB34431F56735D4DC624CE1ABE90BA6F12EB0812C7F2E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 110e21161d68b108ba8bc83f2a9299684483186e02a2f69edc8c5e5437bc7192
MD5 6d97f9f840a16a9362b07f1bbf2894ef
SHA1 d96ae006cffe7dffc7150b447bea54f21f7d1fea
SHA512 016394683261baf0c8ccd6e087f9dd4906e79736d2457afa2541ba7b55dbc4d32182c12db64037281d7479a04fd009a745e9e0af522364abd5707ea1d004284c
SSDEEP 12288:uktwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:ukMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T173C4234DA4990A4DFAB38431F56735D4DC614CE1ABE90BA6F12EB0812C7F2E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a9929c809ef06083ae33df68ccf6b03097b159de0ccec59fb831f5b41a8f531e
MD5 1d15a0b5d543d612592ab8928058c74e
SHA1 04b7d29c8a481dca2d7f553d391bfecc7968569a
SHA512 4ff36bcbd407ef684b5c48c2247374b5d88ba9113c89aeb08dc9ec2a11121c8f48da82e88f7fe459d2b2143ae2289af24bde21b809e055bfc2768996f4252823
SSDEEP 12288:ayPz5L8VtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhp0:HzyVMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T162F4024772A530EDD5778134C8621A41FB72BC714BA44BAF536456B62E372E0DE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 55169ea042db92bd938452f9c0f79e80bd6d16678e30e8331f47d06c5581991c
MD5 4cd45200fb55e7b79e29a6ca81853dd1
SHA1 a726b9db5ed283f36fa44fa8931faa6ffc61ebb8
SHA512 4a4d9751950a132af9669e5a710fca77579836d2a57ce1b4280ef2d3db0413f5de200f6a62eab124987b2d159053a3b89d443486f951cd780a26de0b0106f82e
SSDEEP 12288:HQtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:HQMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T133C4234DA4990A4DFAB34431F56735D4DC624CE1ABE90BA6F12EB0812C7F2E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 bdc1a68dd198f75dd2f8347670dcba7a3feae59187a67b448623db7aa9ba23c2
MD5 2966e743a9e35e30fa5424c63cad4b10
SHA1 115ce50e198049468d3338ad7543af83affb6581
SHA512 564ca2b9a299a2030dd31ab2600adef164bb654ddd702579bd5b2dc4b1659c40f950266ada012b2f10a58d25084653da77fdbf683fa0ebedba591fe6e91340d0
SSDEEP 12288:8QtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:8QMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T176C4234DA4990A4DFAB38431F56735D4DC624CE1ABE90BA6F12EB0812C7F1E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2d70d70026bdfe0a1f84264f3dbd5752deb4e4023ddec577d3f79e2293220c68
MD5 4bb882f7754bcd60f5dbfdfc75cc900b
SHA1 1b31642cc3f9fb643a5330541900462a4c4dd6f8
SHA512 ac0c92c290aba59d31eee20f27ece1835debf8092e1c16d95beac634b7efa7769f801708431f67bf98cc8c6fac5986ae06ff5987ad3a708f131e5da2e7af86df
SSDEEP 12288:byPz5L8VtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhp0:WzyVMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T198F4024772A530EDD5778134C8621A41FB72BC714BA44BAF636456B62E372E0DE3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 0c7947b601d4bb93ff52cf9eb4f3edb5570b5068a2473cc11dfa027d22f4e294
MD5 00033ac29b890dc39edbab1076bcc2da
SHA1 0a57b7b1a8c272d2b4599a179b52fa8613f0a59a
SHA512 96e03bdd4c1d5f244f0f8ae673e6313ee2e1effe7ca7a8bd4c2da641366d83745de1b47cafd42f3b19393a98df90dcb8c51468c6d0ed35280643c0a852dc5776
SSDEEP 24576:dTDaLl3z0zDLMcuXpQkM7LEDr1zHHjRLi5Y4MfO:dTuLljrDpQP7gDdoE2
TLSH
T1B5050199B39018F8EC67813ACD669906D5B27C560BB0CB5F13B836561F333A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 3d09e41fa9505cae3901881379de09f38a3e45e27dd212d1f57d580fd70c7257
MD5 6842d114536fe4857418b4cc478e58a8
SHA1 14b3f8ef3092900c6223d87f1aa34a56bfdfe23d
SHA512 b9833b320ace2846bf360fc8df676afa05b668cb22b54ea3beaac08aae7735c70ebb305588228724c841d5746a4277b5cccc48de9341211dfe1e1dbad691d8d2
SSDEEP 24576:R3vd9CHKy7GZHMcuXpQkM7LEDr1zHHjRLi5Y4MfO:Bvd9CHKyaSDpQP7gDdoE2
TLSH
T1D525CF90F3E414E8F0B78A35C9765511DAB67C9A1B71CE8F03A8265A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f945c6f29449d2592c643d971495dc15d00bf77d7047743bf029bb0bdddec063
MD5 4ec62ef706655912983ec31384e01e75
SHA1 6a7d6ff8a87605e097b524378940675ab531645a
SHA512 66f6bf1ba0c7456996608cc7eec58f6cc913aff898f7eb4148cff0e9dec2c8e48a4a050612347ee1e44a9dc1676f61bb7dd2957014ff88c1f53668bb7fef52d1
SSDEEP 12288:5btwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:5bMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1E8C42349E4990A4DFAB38431F56735D4DC624CE1AFE90BA6F12EB0812C7B1E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 cfbecdac9ec36cc6d29e795851d64d8d8d72946d13723b7f60ef0671e9866737
MD5 8bbd6bad0580396ed2838f3dfac3e450
SHA1 0546f0790209b91ef9ad56ba819afd2b30950867
SHA512 f9972beb9ebd8659cc8d0ef9778c87e4a110e9b8ae01e2ec26ca69e724a10c02653dd4f34d4e9556180ce92297f0853f036484221cc0d48f2db2a3539dc75998
SSDEEP 12288:v1twBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:v1McuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T10FC4234DA4D90A4EFAB78471F56725C0DC624CE19BE90BA6F26EB0812C7F1D4DD31A32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 efc8bef2ec74c3858f8e3f86519c595fe7963f34e653bb7025a5833e80cbb85d
MD5 8256bb1571c2fba2f121d1f431f7e109
SHA1 cadf17cd36a72b7b126f1505ba4d7bd28a1c9d56
SHA512 bee2b21070213b178745fc22ef3cf1b192daa77b82b1524a63a43cf80d4b64f379d723c2fb7642270e08822906d27d264fbb4f033153da7ff45b5bfeca0e37cb
SSDEEP 12288:96twBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:96McuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T194C4234DA4990A4DFAB38431F56735D4DC624CE1ABE90BA6F12EB0812C7F1E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 8663d2bae08518b2f17b2a924e09c2ca8faf3f18784f045313c14b6e066d6e22
MD5 696bb0860f86a6f133a721b294428083
SHA1 661df101cc1556599b291f85f70c903ca3f72101
SHA512 fe115e12242cf3fc06de5413e10a8d6b2ff122e8056652b27a6268cf7be427affafbd18f53e766ac71f424068422aede7f5162e4eef4c3705b2501452fd60583
SSDEEP 12288:hQtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:hQMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T165C4234DA0990A4DFAB38431F56735D4DC624CE1ABE90BA6F16EB0812C7F1E8DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 32f89fb3c64e675e75c89bb3c04fe37b79edc4ce0ad7c809e4ac01f417be32f7
MD5 6896397bfcf04b07320e10fafbc19fc6
SHA1 f9eec1824c372110188b620955871bc3543f8a35
SHA512 0b7a6482fc41a0a60a307a0454c1f76d603f3552f5035aa33679fa3e43d7b101ed81fb2538e2bb7f3099d3eeae3a628cc43fcca265b79f7a8306cf71a3e396b4
SSDEEP 12288:FbtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:FbMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1D7C4234DE4990A4DFAB38431F56735D4DC624CE19BE90BA6F12EB0812C7B1E4DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 2437a37d767f1734d89b8c9c63303c31e1401945a90363463f8134371d9a5706
MD5 0d0351494d4c8892adfb0ee8bb35f04d
SHA1 0db5d0ce84290524a1c22da13cbcbec320100e5b
SHA512 9da54885a2ce5c4e134cefbd54f634cfe7f8a7633e5bfacd21728a67c314a43f94d1245b5ddd66f7f8447af8760890c79acaec56df52226f293b8a59ffa16877
SSDEEP 12288:HYtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:HYMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1EDC4234DA4D90A4DEAB38471F56735D0DC614CE1ABE90BA6F12EB1812C7F2E8DD31A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 591a415653d7c71c3e8a76a1adb40f577ce19e7bcdc4ac91c1f4fa4c2e3863f7
MD5 b005c4c95dce9f945a3166d233b29356
SHA1 8369bebb8fdb01f6dc6c1a4aa21505ddb7e976fd
SHA512 d1a3af1d10bb684676f3d579b0be41c933a68d81c6d2c7438c2c543478de9afa525757feae913d3c4f5af870e773bbd67fc0734a227f6d7dcbe2657b49326276
SSDEEP 12288:NOtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:NOMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T1D8C42349A4990A4EFAB38431F56735D4DC624CE19FE90BA6F12EB0812C7F1E4DD31A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 b80213568a0e34a38e14d2833823f62148da9f564b625e34ef400d9f15365e57
MD5 6b8559b6ab09c7a114800c951358e2fd
SHA1 7e364caa24258273c5830d907aa42faed69e8eb9
SHA512 01a63c316708917c90739aa4842b82b0ec669376be4a71dca76339504ed9a871b61fc6167c54979fa7d471181cfe78f22145b69622552a78919504b2c47fb3be
SSDEEP 24576:SfwvUk9RX6wkyAIUMcuXpQkM7LEDr1zHHjRLi5Y4MfO:CMnYINDpQP7gDdoE2
TLSH
T1CE35D029EBDC04E5E1B7813C99B3460AF6B178681B71C6CF125A53AD0E37ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f5759abd2cb01a952c0312d747ae3d6d4f12470951eb156435dc0ec08ae4c0f3
MD5 b47c564995d341effd0140cf03e9065e
SHA1 fc9488b359bc7188d528a897ff3b4e117f3ffe88
SHA512 1a2c337e5ce95be7a4d760488eddf9a8b3883031b757f6308b97647d1c877b5fcabf06ecdb5fc35a874b9fc786a4f8a2813f6780d2bde14afa5852004f626717
SSDEEP 49152:3YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EDpQP7gDdoE2:yySzPsuPs5oE
TLSH
T1FC067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 049c8dbda02016ee685e176553100aac51833af4ca933164c958d6cc848d2a5d
MD5 e290ef7f25b9a5a51fa3573ecdc34293
SHA1 363ffaa5d02f02234aed2255d40764dbddf0c0e0
SHA512 580955a40dfe83e4c85c8b6320b2ef21e77baf69d5c3ef9b6919c4b5af57a02b7d08ab09aa5f6e8a4dff1e5e3c3c6ce63872ed278a33b794966e4fa8221a9f3d
SSDEEP 24576:A47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYBMcuXpQkM7LEDr1zHHjRLi5Y4MfO:A47JUQjTirIhCnDHUPfF/0DpQP7gDdo1
TLSH
T18B65AE1DA3EC01D5E1BA927885154A5AEA71782D1F31CACF2270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 56c52761efb8acd9a7b04aae54b3247e2963ea4c4306e8a4eb5e0c9f58de0fb1
MD5 b74c1beeee3bb1867135a56f5f33d905
SHA1 a13c0109b2bef8507b3011760ac1a1847eec7401
SHA512 8aef46b83b6e24a64a9d1d929082f759782ee5dc02700d08e85ac55e43b5dfe79052a2e7ba557dab281aae86c4abd4404cf3dd5aa7ad8fd0890391341f3d1620
SSDEEP 12288:LbsfgtwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWkef:+gMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T174E4F00AD29802D8D0AE9135DB565A41FB337C6187E183CB62D0F57E1F7A2D09DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 a1ef01c9d698f055ead0807524216e5b5d6bc9073c50a75af594b627b2e827e5
MD5 8c30757f294edf24318b2b2ff438d206
SHA1 06f6fc8fe3321f308fe76add32b3b75d8d27bd51
SHA512 1ef370ad5288851bb4918bb7f872fed71d59220ef8f264ce421312e22878ce595f5511efa92deef66704b8184bdb5aaeb9cc91a8d70407c16e6c40eb3df3d08b
SSDEEP 12288:2j7g8y54vIug8CjyddKTuPCgDDra876xPn:2I8RIuHM6zDDr16xPn
TLSH
T113450750762AC75FC6A940325E32D5CCAB707D01EE456F0773C88B3FC576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7ad0d09009c82ef8a84340de1b20a69f39309f396ed7622c375b2a974a88d598
MD5 030ecc4b6dc41f64e33afc4934af7628
SHA1 1091eaddc94ccdd06bb532ebb37ceea4a4f79e20
SHA512 963e595a5bfaa2729dd1a73aa3f7ec8451d76b684c0f27517a3c958dbefb60793620d67c6c655921bd9e79e10c279fada8f94f11b6b2e2e0423ea3b12fc9481e
SSDEEP 6144:2fvlm2IX2Im2IB0A0Ff/+gpfgYcUaKDexHBaKDexH8tef8tpER43itS5nHr0SfaI:SlA/RWO22RKngaW0
TLSH
T19565E881A137A38FD5FB5032032A9F4DA764EC06B7095F26B3C8453AD86A715B0F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c5ac3340657505fdf2a1e9b60c81de2cc5ca95616cb524fc2a14efee8ea602ce
MD5 4a82296ace98a5f01e163c6a83492cca
SHA1 1f5cd29f62907564ac84617106713474ec750348
SHA512 13a1c6fedbb4f142ab3dc5aa1b78d076ab07666a946c1e1c7b29bda4eea80180ad56d23a7b5932ac1bd9ac5f8f76723e8d6b1c97f4cabccb84201318bd26089c
SSDEEP 12288:YF7otwBMXuFBpQkM7LuaCDA9CrIpWp4yzHrIwLbUFKRLKTp5yDtuiOMnfhpWke4c:8oMcuXpQkM7LEDr1zHHjRLi5Y4MfO
TLSH
T15CD42346A19C1A0EF9B74530F46B6560AC62ACB09FE40AE7F11971C52C3B6D4DD31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 738435f412232294817a38b360de5a1c906e61bf67f5a88cbb5d96dad4273b8b
MD5 3de83b2802532df276ddb6c6a00ce60d
SHA1 95c274d9341e33e1b6b446b8b5b848e7116309af
SHA512 3d39654dfbdc2a0ef955b8d9c05afe580f7e8cdb81c6cac414e95f0ec4069a4a14b4ff59d4f27c887dbe12b000cf9bc5c4a5c308db0365914771e91d8bcc1d6b
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYyMcuXpQkM7LEDr1zHHjRLi5Y4MfO:ngb4mBIBhGF+DpQP7gDdoE2
TLSH
T1A165AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 00919b94d3f615a50060dede58dcd79f3d62a938dc458e84f9fa93b158763019
MD5 e91a281bcccbc08629ebecab06a86e6f
SHA1 6c66c8656f3c8c03700b3a3d8664af3c68e7ce7b
SHA512 21dc143498aba8425231dfac77cf067f16f3fb3721ffedf909300b278503dd175453d264afdd0736809ef014a64fb2e0fa20f59af0e820e91a01d58111152a39
SSDEEP 24576:CG88u8FpJqH1bzria7/mRMcuXpQkM7LEDr1zHHjRLi5Y4MfO:Z7ZFPqVea7/DDpQP7gDdoE2
TLSH
T1E135F16576E101F5D477D138C9864663FAB2B82103A4EFDF06AC8A511F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 49edf5d0fdac4643d40cd82e91d8a9beeda9862938b412ba91b568cac57f28d9
MD5 826a4931c8eddc0df9adcd6020c35ca5
SHA1 6b85c6e9af07b810034f659dfd8c44952ae67112
SHA512 aa564e1e040fe2ab7aa7e735935ff20e66b27e3171f92c6ffca758d2383cb952f967901c6b6d78c1bde039b023d8db328aa83c4f62163eb68f91e5acdd0a8467
SSDEEP 24576:TPUr+NQtMcuXpQkM7LEDr1zHHjRLi5Y4MfO:TJQSDpQP7gDdoE2
TLSH
T10605F11F62EC18D5E676E17DC9824709F772B862075192CF02E1817E1E77AE8BD39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0886bbae8f2257603989ef0b756fd414bbd6bcdcf7888508ddace65231bb8ce9
MD5 3e1577783c67707de25548768de8e284
SHA1 71b81cf110c4614f50e79d6a10829e6f89372180
SHA512 d2861e7945ffab5cb33d81152af522de0f1f49bce3e5880ae03ff10c5a07c12774aefe1824a91fda05728c87e88d821ca6ac1a0d0d1ff5faca0d9c82d46952a4
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiDpQP7gDdoE2:lG05lO43bluPs5oE
TLSH
T18CD5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cf59097114eb8d3ad42879bbd478e3cbd515b5ac5d27449a69522f4be991d80f
MD5 9f704e4fde1009db86b96ed72918a1b7
SHA1 e293f72a8caf80d5038f1df11b0f2ca25f95ffa1
SHA512 df3d6c5bcc80621b1a765de77ecf89b1a0cc19c66784c4a98e2954dc28bddce0e6b9282345993e5771e3656e66d7095cb3de4de68121217d4be3b7f4952ff7c5
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnPMcuXpQkM7LEDr1zHHjRLi5Y4MfO:Ua5POZ3BJt2pasx2+mqDpQP7gDdoE2
TLSH
T1F665BF5EA2FC01D5D5B9D17DC583461AF5B1382153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 adfd845020bb549840fd3a2f18c7a4c92e1c869811cd9cd3b524f72bef8467f9
MD5 768d30ef238091aa5358b6c740b9ae9e
SHA1 61932ea9b95e931c29f6e57f6bb0e5fc2681cddc
SHA512 fda6ec8fc46324a759c4b9ae06246f2014eff79162fa626e58770d3c98011190dc3f0f81ac7be6ff9450b0ffb508dfc294f8345c35933db031c5adc58a120c48
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7FkpMcuXpQkM7LEDr1zHHjRLi5Y4MfO:RNc/zEOVHFjDpQP7gDdoE2
TLSH
T197858B1623E901E4F5BBE1BE89779546FAB1786513348ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0ce17bd1251b535cc884dc1271f8c5f3f140a4946bf090dc9f8e226ce028ffb6
MD5 7189cb3672f6984ed947e30b903888d7
SHA1 d7c2bbbaf59171617d74f32a92ce403d08bae2b7
SHA512 eb53be50c8cc44eec9a7b415346b1c1d76a53b3892220bacdb98cfbc74f57861eec956bcc98ce64d6c19d5128568746a0143f32413619dfbd8e484b0a3165e08
SSDEEP 24576:kTkNvNnaFeYhJNtmZBmTMcuXpQkM7LEDr1zHHjRLi5Y4MfO:kTMwBtOmwDpQP7gDdoE2
TLSH
T19455AF6EB6F806E4D1FAC6B5DD238512EA727861073253CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 6e408ac723fc7b1c0bd0694b1054a9e733b68614950b69bada32093e2e402ae0
MD5 e04a5eb52f5288255b6ee047aafef043
SHA1 c52fb363c130647ef23b1dec5544e58684de0515
SHA512 d37c6f88b3d00d3cad8a0ee62f4ff54e130eecd8db119cccc51f3b4ff0668847a3823318ecee10a3659879888640a46dfb0d6e697cafcdd46654f2b6cbf1ab82
SSDEEP 24576:PD3FHshBIYQgAMMcuXpQkM7LEDr1zHHjRLi5Y4MfO:PDVHeBIAAVDpQP7gDdoE2
TLSH
T13225E13DE69C04E4E57BC1BCDA638A06E67138A8037256DB12D4D1B61F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1300-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1300-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1300-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1300-316-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/1680-294-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1680-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1680-54-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1680-60-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2396-6-0x0000000002490000-0x00000000024F6000-memory.dmp

Download

memory/2396-86-0x0000000000400000-0x0000000000665000-memory.dmp

Download

memory/2396-0-0x0000000000400000-0x0000000000665000-memory.dmp

Download

memory/2396-7-0x0000000002490000-0x00000000024F6000-memory.dmp

Download

memory/2396-1-0x0000000002490000-0x00000000024F6000-memory.dmp

Download

memory/2624-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2624-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2624-101-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2624-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2624-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2624-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3048-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3048-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3048-77-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3048-82-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3140-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3140-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3140-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3140-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3140-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3380-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3380-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3380-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3380-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3380-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4256-132-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4256-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4256-137-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4256-126-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5056-329-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5056-94-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5056-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5056-88-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5056-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5056-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5600-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5600-120-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5600-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5600-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5676-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5676-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5676-21-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5676-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5676-13-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5932-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5932-66-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5932-73-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5932-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download