fd55599d1a2b17318571e45840caf021868ff05ecc09be53c48f03897620985c

Analysis

max time kernel
123s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.9MB
Sample260905-tx9hfavyfz
SHA256 fd55599d1a2b17318571e45840caf021868ff05ecc09be53c48f03897620985c
MD5 22dd393591efdf34a2ea15457e38d38f
SHA1 9f63ee111edb9f215c6d65d336fad6663a514eae
SHA512 8f2e36f76b06173bbd8ce74f17a1d7fe8f4ed9343592f3739727817defa7f06ee3e88afa6ecd72819f58a133b846c8997e42b908f2e171f57d2fbb7013e48bcb
SSDEEP 12288:7g49H6ARgsNtbAdz6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:849H6wpbMkcil8rO53BJ+AkS8wPRS
TLSH
T17795AE02B7E99134F2F32B31AF7592655A7BBD629D35C60F23841A0D0DB0990EA74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4872	elevation_service.exe
4224	elevation_service.exe
3744	maintenanceservice.exe
5820	OSE.EXE
4192	PerceptionSimulationService.exe
1616	perfhost.exe
252	ReFsDedupSvc.exe
4508	SensorDataService.exe
2340	ssh-agent.exe
700	AgentService.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c15fc8ee8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007004b276533ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000794dcc76533ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007805a075533ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040554c76533ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000014fa5276533ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092418b76533ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4872	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe
4224	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4500	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeTakeOwnershipPrivilege	4872	elevation_service.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeBackupPrivilege	252	ReFsDedupSvc.exe
Token: SeRestorePrivilege	252	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	700	AgentService.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	4872	elevation_service.exe
Token: SeDebugPrivilege	4224	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4500	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
4500	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
4500	2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 5824	3408	SearchIndexer.exe	100
PID 3408 wrote to memory of 2936	3408	SearchIndexer.exe	101
PID 3408 wrote to memory of 4724	3408	SearchIndexer.exe	102
PID 3408 wrote to memory of 5228	3408	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_22dd393591efdf34a2ea15457e38d38f_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3744

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5820

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4192

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4508

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2428 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2880 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2428 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 66c3777edf33d5be6710a37e6de303e5f8563549fefd53034bab29a1d7f34401
MD5 1698c5dfd2e6b9adabdfafd01abaee76
SHA1 1ea50182eb7230b05deaae3766f82040719c5d1d
SHA512 57611df86a114a54ec64b60d8af33831bddb00281a357a68fc388eb3a116ee709ef67da8fa48227e939325f8a4078ba15d703e7ce7de2d88cd4cd42f7cfb4c0b
SSDEEP 49152:sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnNcildNBJMS8OS:W3q60jBp8bBJMfOS
TLSH
T165D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 38b65dfab14e60b632dd412ddd941d3dcbb3796772580bb68d462369cbc69f3e
MD5 25ee8f4be97c98ff978fd7d4ad4727e8
SHA1 a0e8b34bf2d940488e7d8ee3db69d0bd15a8b775
SHA512 160f29c88f79d84f6736ccaa529377b8b3beff9e4c5021bc9e5eff0989c2fb3d7bcd3b4f43122fe3c0afbfe2951dacfdc632784aef05ad379f39a715f057d9c7
SSDEEP 12288:U1XLsswWkxy2lRq2czAd6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:yXYfDtczAdkcil8rO53BJ+AkS8wPRS
TLSH
T18E85012973D108F9ECA79238CDB18611E6337C954760E78B03A49A2A1F373D95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 3df5025d8545592b926d12fc7f6fa8bc8b09d05f9f4b695e59ecf2cd92c33f54
MD5 6332c9970702e35a279b65ff5daf1b98
SHA1 d72203eda2b3912f6673060199db9937b9f85918
SHA512 634c9ee5f084e63e509efb7c2d59112be1fbfdcae4bf3954e5ea7f49e0ae72aed86aaee381773b55c3427bc10390ac650b17ea4548cb0a669f465b7566adacc6
SSDEEP 24576:x0Le5ji0hmxnrMukcil8rO53BJ+AkS8wPRS:xPji0AxAcildNBJMS8OS
TLSH
T150959E16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b824372fbf1313f4a03fca4029194c27e1a6483baacb26a30ee37be23491bb28
MD5 8f408e589baab2bc749f0b37f4454de6
SHA1 cfc02dc625ce684005d828093cbf9595b7613e23
SHA512 12f1cb78003172456a15ef5be86fbc209bce93cd5c0e03c0f7627fc9f58cde9f2649143177e49d48b5eeb044ee7548fba1a56957e6dc2a279b77824b6b283e41
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWr6q8wyuokcil8rO53BJ+AkS8wPRS:O/ezSC6vUzPviHjyccildNBJMS8OS
TLSH
T1CF755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f8116b5715517a6a04673b110443fd00aa63949c10e0807e95cf1683d68efa4a
MD5 6d0c4492e45cb53b46ff7f7e0cbade64
SHA1 8dd2c2b94589ca27290acfda91ba4d6c1efebe24
SHA512 7403de4d2c3662e86554010d0c45fd3593e1f86cd8102ebae08271f24559c68dda9f65c0378f355ad174bcebb36776aaf15621b2eec20965bbc78bff9cdccd05
SSDEEP 24576:qVbqPb88hv/l+bJkcil8rO53BJ+AkS8wPRS:qVO88hXl+GcildNBJMS8OS
TLSH
T15F559E66F6748331D073C0BAC5D2AA9AEE3234415B31CACB0246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 f75b20b371f6c93afc36f144b332dff87c2ade23b9efe98c1df9cb181d3848c5
MD5 84486636c4d0caf5430f9aefc8ba471d
SHA1 e704299ed7fbd81e25c16516b00be7537059cb14
SHA512 9b5fa97162883e47faac1d459f91312dc5d92d4dd94e197db8fbda394b302dfaa3460f6fde5213aff64c865f3e71a6c071134e6c8a02acda33d160e9af58f012
SSDEEP 12288:nxa6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:nxakcil8rO53BJ+AkS8wPRS
TLSH
T15E65230F975605B2EADBB2706A747366B10F2DFC58A8CA1B9617BF2B2C3D527D08C051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 a013e8cb8d8f4d9cc64bb8484129306141a19d4f22967e8013b3839cf01167cf
MD5 58062bd2401799e2a6f96c2ba05a5c2e
SHA1 97a08af2865bd10dcabe1a08356591ce1dec3e9c
SHA512 d1ec8860d2e3fb3aa698474ae400a8c04afbaf2083fef66fe059d6b018a6b37c76d59c62a7f5356e6b4a8d59df19d11fc33bc05cd571a82119f883f2462349d8
SSDEEP 12288:seBNUbTVO86Ux6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:sJIUxkcil8rO53BJ+AkS8wPRS
TLSH
T1FF85CF3BEE28FCE2C27E9DB85B918300E76278704B6193CBD165830E9E275E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 4f6d15ef322f8e63543adae75fede4bcbdeb6e46afc949a504d1bd75b737b5da
MD5 66462f8e98bf332aab03870547c37764
SHA1 14664e40a1bea4737ca44c311fbbb6941324f679
SHA512 09199b1b3eff8ef5ae89b2611c9f1c70a5a8ab907ad0a1d3416e5018cba4d3c7fdb5c7f60fd28bcb5d3363a9710ec36ae50dbf220e50001ee2c32ce652b8dea0
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THf:cQvGAdlCEL8c/RRNw5Cg8bBJMfOS
TLSH
T138267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 988908cdabfc05e650d8414c4cd9862396df4b82a17d37e7e94e7a09db63f7d4
MD5 bf4941e726f7847ed6d6ea3b9d59eb44
SHA1 fbcfec57ed281b8de2a6c1f46c6666a92cddd767
SHA512 4e351e302f91f92a720de80268fb0b6caa01703b997fecfc2728647f0d58dd95f67cb65d3c2aa26d419b79c1b2e9a851b84c0d51802a10c5689caede231f099a
SSDEEP 12288:zAwSfxL/2Dc3FDLLmt0LDQewsAjr6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRK:soewsAjrkcil8rO53BJ+AkS8wPRS
TLSH
T1FA85E031FE75E032C3BF0DB21B35D716642D79604B611AC3E3A88E9E59342D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3be8b740c2133b6c92eb0a15c7eaee85709c6dac302a9114e86d2f8e5ea0144a
MD5 5157afed50cf83250170130b1c992475
SHA1 e338bd6b9f9710e9f27858fe2aca91ba8aaf7595
SHA512 60926f3680787f1fa59613598a3116e76f1b6edabd06d11eb43310281084985d2e8436386bb5804b3a4a03d563e745bc6322c62856acd2d76770918fea5042a0
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHr8bvMfOS:cUEtQevvqc2W1cpV2RI32r6Mf
TLSH
T171474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 31559eb4a231fca5ac62e16c1ea2f25b8dbeb3e1665bbeb204e3e9d197b00d50
MD5 870745e567a8c48341c120053c49be4a
SHA1 ff8c7eb175e2aa4bdfba81db950906c0a4185bdf
SHA512 524d1b9115cd04423d3d747774948a6024be699e1a8cdf7231c390e732ca65f3f80bc61688984736c31e2b676ddf698a3c075cf4aca450bc53e70a7d06972de1
SSDEEP 49152:BCbRquA/m2yL5zifFiV+XenmE3/zQcildNBJMS8OS:uoqHVjnmE8bBJMfOS
TLSH
T1C6D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5919a1f7b9c9a82da11f65ad7a9867b2b2105ddec4b6405654629bc1097756b4
MD5 38c6fbbe21590114337edf8ee69661c3
SHA1 f3b3b91c34776a6edd6f054b45ae52a650437986
SHA512 3522c24ac7afea0ae6a8e02492a30b49430d699b7e451706fc86fe505eb5ad3e8297da556717fa74fdbaaff7a28acfb334d01463f63768a5b4d80b783a211cf7
SSDEEP 24576:GAhGL2IFoiwtA5l7S53ckcil8rO53BJ+AkS8wPRS:GAM1Foiq5fcildNBJMS8OS
TLSH
T101359D81E7F955D4F5B3AAB899B69171EA77BCA95E30C20F2150D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ce3fd0200eabdd17abbc9e2fcc393305ffd67400898b8162dc3cc12c38e73a05
MD5 dbd95fc5d2ee3488de9719b3739bddcc
SHA1 42a48bb3f1f492f9eecc4c8d79fb48648556a814
SHA512 0c6dbf1937257f882f1c3ba9739492558deead6babb6d6fa9474c9d2966a58fd7679cc1a62ed307530107ca3e5a61f3848752a05e5f00dd660a578feb2fe8c62
SSDEEP 12288:ymw5HEjsChNUBFgl0WDm+CI6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:rwulOWvkcil8rO53BJ+AkS8wPRS
TLSH
T14E85F14A73A50CF9E9A792388557C136F7B3BC552A25CB1F0760C61B2F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 81da4dbfd13c84c8286bfba697bf0335691aee189f2e06ac03bae648037aed58
MD5 81818f01a34f21c9c1726cb78d7ba9e0
SHA1 ea49e2d177833fdf38773606139ce8f3defff907
SHA512 54fd9f04c23b9eeb56ae5f4897e066d3721795f2fffba69fc0f75ee8aa4904d353db30e9a6d55916327673fa1127f335a00cae800edeb75ba4d992e7dfe099b0
SSDEEP 12288:rJZ1Iyb6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:NZu2kcil8rO53BJ+AkS8wPRS
TLSH
T15B75124E23A520F6E197A238D9F05705E3673CA9277583CF1225466B2F3BAD29D3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 41ba4232a66a7f998ec5f88bba3706eda2890564f0a1d4ad8ccda3f5a0e3df55
MD5 1f548f26fc93edd52f29071896c10fc4
SHA1 b9091f619725c1ef395dedae34727a114bfa7a40
SHA512 7dc4e5fa2650b8270ba840c43a96012e393272c2d5beef5fa39ace856412fe7547b0b2b7b96350e2516d62dd9ef141cb879f9cfe8805854f828f899fc123a0fc
SSDEEP 98304:aQRQyi36YOcPhLvw2gAf+PN3l8bBJMfOS:RQyiKahX+PN18bvMfOS
TLSH
T1AE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bee68a8c92351bee0e6d7a32594bc296d35c506c2b729196c00ccdb0cf04401c
MD5 8fd471c9e70f933d2109a33d247f5513
SHA1 c1ad4535665ac19237fd97b7e94a7d5ea81ae16c
SHA512 eaf73f22def63d112d4464ef6eeea297afed63ecebd326bcb3121f86b43705ef9911e1a79cd93ec8aba799a5020f3170e3b35d5a6b2da28fe8fc53c3ab7df566
SSDEEP 98304:ZQRQyi36YOcPhLvw2gAf+PN3l8bBJMfOS:QQyiKahX+PN18bvMfOS
TLSH
T105667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 94fab1f31819b96398c79e2646abeebff61fb7451279b322994ec2709ed9dc6e
MD5 53774a495373098af0bcd2473a5a9eba
SHA1 b48597e9776ba87267511db8a66ad0357c92da91
SHA512 9d5bd029359ec77a38316340cae18f7c46ae1ed67cdc376b32166f4fc8c2617be7abcb919a86b7d25ca1c98a95eaac4f0f679e403f0f2815c8d3d0e0b21da60b
SSDEEP 49152:P68Qg55nhceWu7PNU3/AcildNBJMS8OS:JthLRc/z8bBJMfOS
TLSH
T159B54933B2F200A9C44DE1769F4A972196D27C758FE0E3DB851172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c065e1cb5cde79ec9c8f59629f6b51c6b082c61195808bfb930d7c5ff5168bb5
MD5 07ec46a8e40254cc74cc74630d76f8f0
SHA1 82ee1f117ab8bd73bfad16f83de7253beff80763
SHA512 49178ee950813d404e0ef832cf2a11211c42899d3aebd02058087c9f334b88b153c1a49469d310f745da11da5ee93a1dc944a37344498e00e598377306d9b14e
SSDEEP 98304:uy5112gYy5azzVva69nLKnhZS8bBJMfOS:fLIHjWhM8bvMfOS
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 82b8774c03d0faef875a27dcb39478703d5e9830966649ef8ede7f2077fd0be4
MD5 d07bdeec3f764f01059860aaaf2c3718
SHA1 300c68046fbc50d3df0a2ac404c8244cd4019fa2
SHA512 040b692ca930741baaa33bf95aed01ce69d07c6fe3c6e26068dd8141a2f4210b6ac41e706c3c55357dfffeef784b4031b6513179a168c2b287bdd5203e96e72e
SSDEEP 49152:DB+taZ3usBWOBr4tEG20bqx0z+n217aau1glGcildNBJMS8OS:1u6JmUxd2d18bBJMfOS
TLSH
T192D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4d3f0845581cbb897a7cf3fdc076ddddcd4e20da13c124edfc860bc07cff5681
MD5 d77ce7923f1dd7e1dea22bda780e414b
SHA1 7e4d1596fb6efc90aee6d3bed4d1249ba9c4b973
SHA512 4047ba84c2808b496104b4efe49100632f35a1890c13cec20179503e9aa43cd83987b30173af4a6d42061a28f9fcd305b95501781c114867693f48300be75f4c
SSDEEP 49152:S1hpsNoJpF1A6BU44CwH7R4xKcildNBJMS8OS:SmifPkRE8bBJMfOS
TLSH
T184B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd25f3941008606f53cdd74bad3d75c9974b2e941a6b5fb1eefa6e3eeef4f57f
MD5 7f6b0cda3c1a37013e94861426b1b34d
SHA1 f0467e6cf80ed787b48e9458b28d6a4a07544289
SHA512 73916926f7b32a5a1f50f93bc0fa25b4400a6d00c413427c32c194a3d603c1b1dfb0a14d25e5c1ceb18f93e49b9d64ec7a0ba6bb8e9956c0aed482b75018484c
SSDEEP 49152:TSuZQIY0Be2KNRVtOnks6NMHq9cildNBJMS8OS:R5dKvi61+8bBJMfOS
TLSH
T1BAC5BF03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 84a11af37a48846939eaf4c06f5580022aeaec3c6f563f23e5a124d876f2ce26
MD5 19e254f1d8a694e1449cfb4059bb1400
SHA1 b98a431317110cd40c423615ac9a1fe0ac1e81be
SHA512 e1a8f51c8ac8c3250d21b44f8293b6bd3a633040ff4f0c82f92c8d86da7c9a6522d94ddcacfaf664f88942786e2c860033074860b04425efaaf3e16e72f28d2c
SSDEEP 49152:ahtSn8EApI0figXgiDn0AP5w+cildNBJMS8OS:bX2iypho8bBJMfOS
TLSH
T12395BF13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 f4ee1b7ffa9786f6c3b148da27b80ab9822ad3e512013dca738f3ec3bff962ef
MD5 7a2c781f57a0eeacc689c74923311164
SHA1 e9a12b77b8b540b6da4e4ebb178ef7034b1290a9
SHA512 c03187e9b085f9bd6ff67d78892612ad513647bffb6b2f003830775fa18c18946b56588130643794611dd509d8e7be59ea6d3d07ba55288d680c2cf119d66a55
SSDEEP 12288:Pi6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Pikcil8rO53BJ+AkS8wPRS
TLSH
T10065230F975705F3E5CAB2B0AA743355F00F2DFD6868C61BA60B6A2B2D3D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 4f96a0f96effb5f3b740320f4160a35e702496686db3d8699f1b2ceb32e037a3
MD5 1c16b5aa93dc611b1f8ac7ffaa71ea49
SHA1 267c52ca0810473368ff72a8a204a387fb9ddff8
SHA512 82b031a1c199adb746fd38c6b22ecbe70ce0063e20848bf0eb4a5c18ff27ba97e4d3044f5dee9e20b860dc6c6bb2d33842ac7a8548134426bf52c09935905b5e
SSDEEP 12288:Wn6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Wnkcil8rO53BJ+AkS8wPRS
TLSH
T15965230F975305F3E58AB270AA7433A5F10F2DFD6864C61BA71BAA2B2D3D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 634c8e53504b279eb583bc8a11a52b4e36983e2a96251cac8c0337a0354467a1
MD5 aeedd435c9131ce7128278d6feb1d2b9
SHA1 f35b3ee19dcc0a849a4ae4ae7b671bd5f0318383
SHA512 08ad92b2c71613832cb139c43a1402be94047eb6224ccc6433927d1ebf11929c1e762f5119354b3b0480bcc8fa4294352a2f06f518caabd389f37def1cbce645
SSDEEP 12288:rZ6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:rZkcil8rO53BJ+AkS8wPRS
TLSH
T10E65230F975705F3E5CAB270AA7433A5F00F2DFD6868C61BA60B6A2B2D7D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 410e8b603eb67621a5f81f527d05fd3adc79e88adfb94518e7e2467de5bbffc5
MD5 b638f558db416ce921c36b10ce54683c
SHA1 386df82ee02b59cdc3c12a2fdfaa5acb57b34b28
SHA512 f18514765467ce11c02a89d2e92e647b096213697e9fc5b434a28889a6df4e9da2211e25e63f64fd9d5506b3a1d60535c26304a8dad1b924fb6adb0e90738d45
SSDEEP 12288:kV86dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Vkcil8rO53BJ+AkS8wPRS
TLSH
T11365230B676700E2D89AF270DA706361F26F7CFCA635C75F97021A1B1D793A6E46C890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 320ffb99db3dc6e0391e8b10ed0d9caface70633354bc273bafadaff1bc07162
MD5 af14bb9fc21f4e289aab222bf4d9faee
SHA1 20e1ae9b2bc7036706d335876b28b90f406537df
SHA512 ada1a02c334a6280166b1dfe85f611e1908b77f96aec162bca4c343d8a79384255941a7991c032ffa7e232571c7ed107674b9ffcb2b6f5d9be91c7c9cfd291a6
SSDEEP 12288:J06dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:J0kcil8rO53BJ+AkS8wPRS
TLSH
T1DC65230F975705F3E5CAB270AA7423A5F00F2DFD6868C61FA60B6A2B2D7D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 8bce4ef1cdc6722bbe1de9fdb12653a9a8ee927cf82bee85471200130e85e429
MD5 3f9840455809fd02ddaaee4744dd148b
SHA1 460c860f098608dd336043c1151d4053e5ef8355
SHA512 756b837b87493ea2aceb55b78f85e9a40f4877285ce6a36b1f53db793da9c886971ada1a250ecf4c9202150855169917d42c1b9035cd56f57f523fb283e81796
SSDEEP 12288:LT6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:LTkcil8rO53BJ+AkS8wPRS
TLSH
T16365230F975705F3E58AB270AA7433A5F00F3DFD6864C61B661BAA2B2D7D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 12713418a2a5d7aece08bdd9685bb317e4d1dc7fbde9680ed2d9239b91d2c563
MD5 ecf952e5244c8926094f60175011e3ef
SHA1 800456745670036e09b5f4b0b64660b3a7740d83
SHA512 a3a4c2e2424a65622160434b7aa2ea7e5862274121e94b590ad5e6f3e6c0ecb8884b1becb1cfb65775f8add9edf6e419f12bcc18822d2936e7cdae9cdf40b4b0
SSDEEP 12288:R/6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:R/kcil8rO53BJ+AkS8wPRS
TLSH
T18D65230F975305F3D58AB270AA743365F10F3DFD6868C61BA61BAA2B2D7D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 7ebc3f36549e45891792dee56fe94ff888e73d0a35d6d8389911284bcaf3a8bf
MD5 24bfdda7b5557bc660bf049955c2d828
SHA1 5566192d87607be3b5c4b5f86640ee1d5f6d1e63
SHA512 584aa33d99e90a4cc704530109dd401ed7600803af02e64f89a57ca2417aca067e25b72664a4ace45f2ed4419e3eb9291fede4a6fb66675020d8fe1274be67e1
SSDEEP 12288:KiZwbGzzFEoS2cPvyH6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:tZMGzFVSOHkcil8rO53BJ+AkS8wPRS
TLSH
T188850299B35018F4ECA7823ECD659A16E2B37C690B70C61F13A4362B1F373A15C2DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 65c30ae300cc560acff905eaf9fdf48aa176cd1a8c1d7cc0ef3a99e1f53e996e
MD5 e6ab048a02b660878ac381467be23060
SHA1 aa1372076b7d16a3adec09e7f0b21a51d7a4cb51
SHA512 ab250224912db1e15c069152f66a262a04a66635a275e8c72b9063e2e52ff19dd799a049170004ea90d75a92720716c8b7550d1ba9541d14ac2013181774d4fb
SSDEEP 12288:Km6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Kmkcil8rO53BJ+AkS8wPRS
TLSH
T10665230F975705F2E5CAB270AA7433A5F10F2DFD6864C61BA61F6A2B2D3D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5eeb611802cc18fb637bb33da0ed16ba7e85818bae13558a28d7b5cd0018b950
MD5 130b7fe19635f4ec08a98af883681a19
SHA1 5472df7e889d5b44a5b26c7c1ea8f7dd9cbdd283
SHA512 edee530e0562c34e977c766b0d4f2e09a2633c7affbe494f0d1af571070698863666f4307620bda71ce0b6aec70fcb9d1ab36f8c537304c237be5b6d896ef449
SSDEEP 12288:CK6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:CKkcil8rO53BJ+AkS8wPRS
TLSH
T1A165230F975705F2E58AB270AB7433A5F10F3DFD6864C61BA61B6A2B2D3D527D08C4A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 fe35eae3583ccab2f8378bc1d5b58250a9d74e90b2b59918acf77ca9096444d5
MD5 ab91c3093c66c0e14d58889f06140524
SHA1 e07cd8ef18dac5c61fe51f6c7f25131d3745795c
SHA512 53a6919f9e546943b282ec5a53f5563d049683dd700d773ad872e156dd86dad04154c5c849e16cd264d3cc457cb06a23788d210c5e4ceea36d686e264d66d4e8
SSDEEP 12288:LyPz5L8b6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:mzybkcil8rO53BJ+AkS8wPRS
TLSH
T1BB75020B73A220F9D1679234C9611B12F3777CB90724CA6F5764473B2E2B6A19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 707078f652b6d8559d0416d1fabc490ca1d643e43efdbf4d10c97078e1e3f6ff
MD5 3a575461618dc40667bcd5738d60bdb3
SHA1 3af31f75f7b97758a152d655bcc82c3858adeb07
SHA512 f5264153ef624fc11a1889f1a81ac71afee24cda30b1562f6da0f67da1b1453cd3cda43b69f989bb8216ecec626e11dcf7115c17c2e301e463864017ebe01e5e
SSDEEP 12288:6m6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:6mkcil8rO53BJ+AkS8wPRS
TLSH
T1FA65230F975705F2E5CAB270AA7433A5F10F3DFD6864CA1BA61B6A2B2D3D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 73680a0f108da60584218c63be8565456fbb6b1006bd3e99f3af7ffc980d0a91
MD5 a3034908078710adc5ee52310261ef8f
SHA1 9153d05030cfb1ab0785a1268e84e88e5ca8bb5d
SHA512 f5238666882aaaafd5fd680bb6b7c058d0b2efeed3d7a7ab287c69f0112dfd608acc3bf53c3c8cc6a7f6b8488a48ecd05211177499924c35b33f3399609d1253
SSDEEP 12288:Sm6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Smkcil8rO53BJ+AkS8wPRS
TLSH
T1AC65230FA75705F2E5CAB270AA7433A5F10F3DFD6854CA1BA61B6A2B2D3D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c4cf8e3098df7e7239486d6abfc164bd6a4c3eb3d1cac9f727c936308e36ceb2
MD5 f0bebb91e0215990c83894f3e4760a2a
SHA1 37ff4a12b379d250e9d9af6efdb54c23c52e4e82
SHA512 aefbd9825b17a16b7dfd9712ad38439c18017764cae1ba002541a411aada4f35ce3ccad423007ae6d26b9e0d1a9aa8cceb91ee1344fa6cfa3eb6815166d45cab
SSDEEP 12288:byPz5L8b6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Wzybkcil8rO53BJ+AkS8wPRS
TLSH
T18975020B73A220F9D1679234C9611B12F3777CB90724CA6F5764473B2E2B6A19D3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e65a036e0ebdad350cc6100a4c584a123fd10fbdfe58749176b2a08cdccbe4e0
MD5 dd2bd8f6098f1ae17e474c9d95b08591
SHA1 e5b1d979a53bf839c734565dbf33168813659f54
SHA512 0e202885c82daaff6c87c63a05968eeaaaffda39230b91e4e4e1d2298defa43e4a17887677615b0128f9e0337df8f03390f1f1426c6fc6e1a1dff0089f9e6199
SSDEEP 24576:1T3aLl3z0zDpkcil8rO53BJ+AkS8wPRS:1TKLljTcildNBJMS8OS
TLSH
T10E850299B35018F8ECA7813ECD655A16D2B37CAA0770C61F13A8362B1F373A15C2DB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 df9e6e55e34683f4e5b7191f7f0938de08b4d64a30d9dd44e953d9b20d104a89
MD5 51e9f4aea503eb41d59603522d92bf44
SHA1 e5537f4e81e3b300e086828d48c209a313f80de5
SHA512 b8a5d36d98811bc2581bc9f15688dfc3a7e9781cc95685d2fc84bfda788f851d111ed0aa4b4d50838a7a377bf9736df758d6933dba51164536e912cbba144702
SSDEEP 24576:V37d9CHKy7GZlkcil8rO53BJ+AkS8wPRS:17d9CHKya4cildNBJMS8OS
TLSH
T1A495CF91F3E414E4F0B79A3589765611DA777CA91B31CE8F03A8661A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 d55c41d6830c18a276e5851bd832a214c4831a48d9740fd63e472092208ec21b
MD5 3b2c5f48fa3d234850524a7db001865e
SHA1 ba8a71872bade779ff7205847c3a213d0de6648f
SHA512 5e8dfd2b79805f189f34f7bd6c6a4ff977dec12fb103219183d82ee3b9f9a8f9addc8b2db51a5f895cc30d979d25ae26f277c0c542fe5133d0ccb802249bd4f9
SSDEEP 12288:L56dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:L5kcil8rO53BJ+AkS8wPRS
TLSH
T1DF65230F975705F3E5CAB270AA7433A5F00F2DFD6864CA1BA60B6A2B2D7D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2bf23a08a07d4cdb4fe23d6d23b1f12c32b69d8dbe7bdb3d8eb9909d6dac4e11
MD5 82bdeeae1ebfd32c0ce11c88779beec0
SHA1 2a1875ea386e47e08275cce617075e90b645904e
SHA512 80ff2d6b2924d715dbf54da71538fcef59554470e2fb926b40456ca36e5c68a6b95843b31c33cb94887b35743c1909481a177d5f3e2cd325179b72d400833f07
SSDEEP 12288:076dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:07kcil8rO53BJ+AkS8wPRS
TLSH
T18765230F975305F3E58AB2B0AA742365F10F3DFD6864CA1BA71B6A2B2D7D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 d88c16a2cd2ccbe7d68ee975961a0732465d4f2084edb418c5fa5ca44b40ebcd
MD5 0347a3a80b64411084579bd965958ab1
SHA1 89a3c182aeb167adbbb6555eefd698edf9c50728
SHA512 1452441660905c1274d791839a1aaa646a0357024e75334cfef72eccd25776cb912cf87944f11adf0358be8e81ed00e1e0fadbe1c18269850ae18d413c947f76
SSDEEP 12288:Yg6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:Ygkcil8rO53BJ+AkS8wPRS
TLSH
T13C65230F975705F2E5CAB270AB7423A5F00F3DFD6894C61BA61B6A2B2D3D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c4fa995613b8f7a51f2389acc1e3e206c656f3c020f627c890d32790ba660579
MD5 32f0eff0b3c76900b54d425134f7699a
SHA1 b139bd0ebddaefa46df9f790f7adb5d84f9cacea
SHA512 5cdc9c6bc32be6178b1f40450b2c8fbf0a72a487011d58ccb759048aeaeb37ee5f92f5fe98d7c40a8ca1cb3701717b25f73d546e7078253d6c3fbd12719f7d35
SSDEEP 12288:cm6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:cmkcil8rO53BJ+AkS8wPRS
TLSH
T17365230FA75705F2E5CAB270AA7433A5F10F2DFD6864C61BA61F6A2B2D3D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 09213bec17b790683197e7f06dae7cc1016315afe335d6d47d578d80097537ef
MD5 dd9565928ca94a6642d38ca57e50d568
SHA1 9d7e0549521f18189b7a7209bcd80cdc8d88f6a1
SHA512 e16186b7c52e7d14cdf2bf262068bf71b4dc816c28d6479ae9ebbf1f78cf6d6bf5960e4465f0dccdf60446f63ef03be23fbb7cab5cb6813048d2660a0a4e39f9
SSDEEP 12288:P56dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:P5kcil8rO53BJ+AkS8wPRS
TLSH
T18B65230F975705F3E5CAB270AA7433A5F00F2DFD6864CA1BA61B6A2B2D7D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 48d0ce7814ebfb550ffa7db81acde290cb2740492aa16f47dd6a966839068a39
MD5 2528dae46e45cc51f8cc743bf2c5586f
SHA1 1858faa56df6025b92bfccb4c18d1d8ae99902bd
SHA512 100531483688338a193c3b810c4c25e1d3cb3ea7deb399c6b3ce665454f62df44e574513ad2fbc82cfcf4078ebccc59b039ce70afdcd5baab6a72c9f360c4929
SSDEEP 12288:x+6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:x+kcil8rO53BJ+AkS8wPRS
TLSH
T16765230F975305F2D5CAB2B0AB742365F00F2DFD6899C61BA71B6A2B2D7D527D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1f3f6fd05b04dea4d049e80890e67a034f58ef04d8a824657659e01a00e21c2d
MD5 ce9302071ec14a5aa207490eac8a2399
SHA1 c0fc5c15ffcd63f3cad7f78b174522e8f2c58ba5
SHA512 7bf53b6cfbcb58ea1591a73655764bb7a238ca45b29646cfaf8366220268d9dea74999f1719e5e3cdcdeeb4e606ae2727e5272305852a61c1fc7b97ec92571fc
SSDEEP 12288:V06dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:V0kcil8rO53BJ+AkS8wPRS
TLSH
T15465230F975705F3E5CAB270AA7433A5F00F2DFD6868C61BA60B6A2B2D7D567D08C490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 e7b6abbbd4c5b4bf0fd1e672bd63d10e54155cde1feb0fad34a9393a150a9e25
MD5 3eeb79ab9f779d0c672404cadec00ab3
SHA1 e4a683a4fa8ec0baba8fdd9540349791ce4085d8
SHA512 c709bbdbd07f3482b2d2a83cdfd056488388bcaf66273be4feac6049b1532286af290f083af2fb53bf2e2d5606aebf76a1cfab2766dbb9a710bab59b7e332eb4
SSDEEP 24576:9fwvyk9RX6wkyAI6kcil8rO53BJ+AkS8wPRS:hMnYIpcildNBJMS8OS
TLSH
T1FE95D029EBD804E5E1B7913C99B7460AF2B2786D1B31C6CF025A536E0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e7089f956e5f42307619a27aebbec73fa30a2d6e85259687075a67c29141fe1c
MD5 b638fd470b8209aa04122fbe8d40913f
SHA1 397a4db58333a4cbf8bdb0ad1179e33b35c6c4fe
SHA512 fd0e3023e63e23686141d4bef52524cc4b5442479e11b2bc143f84f53efaf2977a0355ae9f7ff6bd71cd584938cc60274610baff4456df1eb72b60742c97694d
SSDEEP 49152:DYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ecildNBJMS8OS:dySzPF8bBJMfOS
TLSH
T1BF067C56A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 76eb093170cfbcfd7dddae5c50b73e4f8523c49749cf82c4db63d7de635f4399
MD5 23a896e6fa09826ba1e8a12d4645ddb5
SHA1 1057aa888ec2ca596e2271059a7b2edb3bbb19da
SHA512 d80a1fa9b23579a092af4b3b1f9185d44c6bba20a3b0339d5371ed005db9082df232ca8bd566bbda71c0fdfe8e4736e00f5df43fc14edb4e2d4cc1febd9f529d
SSDEEP 24576:k47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY3kcil8rO53BJ+AkS8wPRS:k47JUQj4irIhCnDHUPfF/OcildNBJMSy
TLSH
T1A665AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 18c5c4fb13dc5033d71e22026633708cdca1773d49f827da4749e75a5e0732d0
MD5 fda96b5f7d3af0f63a93fd5baeb73a09
SHA1 8b83aa70b69c7d9030af29ebfe14dc62bf3aac9d
SHA512 9c5e497be1b10b5ef55fead0717b14f053aeaa07353d3da3cad936feea08a898b812ef9cb7299fb7ced23353b9fdd913ada5bda25b1443dd59999b37077d8c0f
SSDEEP 12288:kAsf26dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:u2kcil8rO53BJ+AkS8wPRS
TLSH
T10D75010AD29402E8C0AEA275CB655641F3273CA997E1C3CB53C1F53F1F3A6919DE9A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 a32161470bef5ae002e4918e51fa07227e1f3e7251ea41162c4b80167370be35
MD5 864edb57fc712fb5859cb22f307c02af
SHA1 35da54430bba2e84af7d9370c05320b18827eca3
SHA512 37a772dd61f7e32b047002551bea7448b618d2dd1ec256ef4f85e6a4be8b755427c2be64be3cff50a91d866f44ef9d6887adf9915c02242e63c066f2b8c7a8e3
SSDEEP 12288:QZ0FU3fahyNCfzEVXsGicUZgBW0kYz3+/IM4Jb2:QZoUPc0iZg80kYT+/I/
TLSH
T1C33529407666C74FC6AD40321E32D2CCAB707D51EE446F0773C88B3F9576A58BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fde9e3e6277329bd95b23ba4d1372aaf30c67f21a68286427856a902a5dfe084
MD5 acc87a499758b12cb59d34fb76f0a797
SHA1 5ce27b07c355c579b0fabfe2a3ae03a1502dfa9d
SHA512 35e0250d007048f6db4954087c3658176352a3b6788bf626f2712cd9626f99252d309afb7c4e3653e8d03d43954446112d0cf94eb27c64d9bb531de649c76e64
SSDEEP 6144:wjplJHTW3HkR/hGdmffyIWH3m+fdgj7lrirUNSqtMx3SqtMxSuPA7AKbHh4:wjplpz5ymffyIWH3m+fdgj7lrirUwbS
TLSH
T1DB559541A536E28FD1B76071071A9B8CB7A4ED02B7095F27B3C8457ED86BB11A1F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d2b7d5a0f9f1dfcf4112978793a0eef6aa94c510726f630d938a1b7056197ca0
MD5 8c366e45368d894479be64cc3510420a
SHA1 13d61bb54d652cd55972f2eee707078e4b67c4c1
SHA512 9d102a3c02343e84e035bdadc34dc69435a5c0e414921311ded50c101341f6f1f16ec0231580fee7802d4dfa4f4131919b383d123e6f09c590cf4168f7ac5705
SSDEEP 12288:1N7O6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:/Okcil8rO53BJ+AkS8wPRS
TLSH
T1CB65230B975A09A2E8EAB2705A786331B10F3DFC5F54C58BA60B662B2C3C5D3DCBC451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ac0b4a2e0fb85a826884ee4abd1765b72abe05d47a9fe47832788ff9df791a78
MD5 3a86285ce5a7112c43825fc88bd06900
SHA1 34b288adfb2ddf575d2068140cf6534a1ea4c184
SHA512 8b495c52c1651575a313db618ae7d2a09bbbff01ba7575b979a2fd3f4c8f8cf01bfa852ee1eb2815bc8ad8d7086f5ee82667d8a67ba1d4b2f97ff692f91d5290
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bYokcil8rO53BJ+AkS8wPRS:Igb4mBIBhGF0cildNBJMS8OS
TLSH
T15F659E1E22E802F5E0FAE2B8DDAA4417D6B378161731D2DF1151422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 bdcbfd8a6a202d5c5db84a14ea001e2a2db582a206c81afd5018eb28a5bff6ac
MD5 3c051eca0468d4827a8991b5caeba4e0
SHA1 63c9710c81ca8bd77e0f1c8eb836035f1f7809ce
SHA512 61aed93c9260d325bc75f171d8b550cb4fe385b420d441ab1edaaebe6ac746882b6a7c51688bc9ac56c434194f112966cfae8eec6e2cbafed94e38cf66c71c6c
SSDEEP 24576:0G88u8FpJqH1Mzria7/mHkcil8rO53BJ+AkS8wPRS:H7ZFPqVra7/7cildNBJMS8OS
TLSH
T1B795F12577E101F1D47BD13889824663F6B2B8250364EFDF07A88B561F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6c7d5f59294768006d9da36eaeaa2e9ee6a5b2a7be0a6bcbb2c829c47e44f3c1
MD5 35e568273385b3e32db4370ece76c5d1
SHA1 57b27c7eed9cf542f1be00a54f2299406015a5f0
SHA512 57f73847e04a08b1ab52c4632d3915ac4c46c7a69c3b06dd8a2987767893b296482f1ec6470846da9b93d9f92c1fa636fb596c5c99d678a4dfd7c3660a38562e
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIcildNBJMS8OS:cG05lO43ba8bBJMfOS
TLSH
T1B6D5CF6E62EC11F9D0BBD17CDAC6460BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ad8cd091d0d642dfc4d603971a53f8dac1490ec6dadb413c0c2fe40bc597cd5d
MD5 979399a87ee3c200fcdde9e0455f6b73
SHA1 9b0814657b6d79f0ccbe07024fa2f9498c5c6029
SHA512 c4a439b4e3fbb512e98e5a6be2802d3f8d164de894c91da96f9f952f56df9c9af816ab7c68f024bcc990997c80f8616b652bee180d684e1aba4990c762002c25
SSDEEP 24576:Cfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn9kcil8rO53BJ+AkS8wPRS:Ka5POZ39Jt2pasx2+mAcildNBJMS8OS
TLSH
T1C665BF5EA7F801D5D1B9D17CC583461AF5B2346553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c9c49720dd017886f733974a61842d0dac869fcf9dfd4313e577f696657413cc
MD5 9fe1b4eb657760716419f10e6d3ca79a
SHA1 d7f477aedb229edf978e819f249e7d2e104ff6e6
SHA512 e757c6c3c8aa3a8e924dae090ea0a6f681b5c64434202212e313f777abee04f0013030184700ce763f8e079a8b434ae3c879d5102b011c0c843ce16ce8308e47
SSDEEP 24576:yNcwHdjbyQ4nLC18lb/EOjowL7FkPkcil8rO53BJ+AkS8wPRSr:yNc/zEOVHFbcildNBJMS8OS
TLSH
T136857B1623E901E4E5BBE1BE89779646FA71786913308ACF0291851F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 123df0493c0f32f8f5e914ee2fdb93ad9faf4cc61765d4675fa73a89463db6e4
MD5 e70f9074e303c887cdbe6200f871f721
SHA1 f1e26747318b61cba0d19ff08037c950bb5900aa
SHA512 5c567097acd041aed78f800ba28ab2009a6228b02c6e2fa3dbec203a93086a1857b77bd8c1ed3dba5a391c1bea2d2398b622581c30a77d30a576b99c1c4d8419
SSDEEP 24576:XtkNvNnaFeYhJNtmZBmpkcil8rO53BJ+AkS8wPRS:XtMwBtOmScildNBJMS8OS
TLSH
T1C455AF2EBAB806E4D1FEC6B4CD238512E6727861173293CB5290C13F1E679D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 46d780638b67d4ec86502fd1a1e7a34cf52be0689b7ebd1e8e7aa4407f543bd9
MD5 945c6703fb4f228c69bcf672c17c3fdd
SHA1 1eb6ece41551607da9719e1fae9a2a15fb261932
SHA512 c929f9b920d53db7c1a1d09cb5c42edfb02c06cdcf4eeed8cd3f54dbf8009f4d52a311ca57e51c27e13ce8f3e15546dc9c98939eb8173a2b8cb35c472bcb4a6a
SSDEEP 12288:oHvUrBFrEjwaQD6dxuil2GSEYtE5TKOBV7T+sWmk03PSTYfPRSVoH4n:oPUr+NQDkcil8rO53BJ+AkS8wPRS
TLSH
T1D885F11F62A918E5E67AE17C89814719F77278A61711D2CF02E1817F1F27EE8BC3DA10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 1c9e79cd898770900eb25a086d4be159a9b0ef585352fc9aeed9a6fc98de83fc
MD5 86b5af6e00bcc97a8d2871910c3ce8ea
SHA1 9b32f6c1e5a083aa2b4ff879710933424cf2cc25
SHA512 dbc70519f7b9e645dc71cf83e4f977805998abe7457ebf19242c8bede657b94ea356c7b675e03a9ef215e4e877c1c7f631d5ddeee746f7d4cca6e0a50f6a1b59
SSDEEP 24576:QD3FHshBIYQgACkcil8rO53BJ+AkS8wPRS:QDVHeBIAABcildNBJMS8OS
TLSH
T1FF95E13EE75D04E4E57BD1BCDA638606E27238AD032156CB029581BA1F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-97-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/252-91-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/252-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/252-345-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/700-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/700-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/700-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/700-129-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/700-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1616-80-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1616-81-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/1616-310-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1616-86-0x0000000000A50000-0x0000000000AB7000-memory.dmp

Download

memory/2340-122-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2340-123-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2340-115-0x0000000000DA0000-0x0000000000E00000-memory.dmp

Download

memory/2340-313-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3408-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-146-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3408-152-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3744-42-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3744-55-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3744-52-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3744-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3744-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4192-298-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4192-68-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4192-76-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4192-70-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4224-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4224-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4224-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4224-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4500-27-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4500-6-0x00000000026C0000-0x0000000002727000-memory.dmp

Download

memory/4500-7-0x00000000026C0000-0x0000000002727000-memory.dmp

Download

memory/4500-2-0x00000000026C0000-0x0000000002727000-memory.dmp

Download

memory/4500-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4508-315-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4508-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4508-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4508-109-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4508-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4508-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4872-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4872-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4872-24-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4872-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4872-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5820-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5820-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5820-57-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/5820-280-0x0000000140000000-0x00000001401AF000-memory.dmp

Download