c43b700a97b1f2b619382084b58e57f83b55d564ec287db7b13ec583fdfcbf2c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Size 1.2MB
Sample261102-mqa8qsgz31
SHA256 c43b700a97b1f2b619382084b58e57f83b55d564ec287db7b13ec583fdfcbf2c
MD5 b8dac0338d3a724a4f66b629674e111a
SHA1 ad3c856590c09e0603d5cbc22389b8b6142eaac0
SHA512 89568f790672fb4155f3d13c0aa1c60848ab00e29beeed27d4fd1ada40dcaed07d3d9ef01e342998c179de4625f4916e1979393308cafb37b4fd84fe3be3d70e
SSDEEP 24576:9kMl0Xd6Ylgt9jzABgioiNV99L5S1fd0b:306Gg3jzQgilV995S1V0
TLSH
T12155CF11F290C864D8E10D30CCA9FEB414277DB0CAE1969BA2D0FF6F3A76D917669613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6136	elevation_service.exe
3796	elevation_service.exe
1772	maintenanceservice.exe
4768	OSE.EXE
4112	PerceptionSimulationService.exe
4284	perfhost.exe
4260	ReFsDedupSvc.exe
5476	SensorDataService.exe
2072	ssh-agent.exe
5648	AgentService.exe
3536	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1e2c54077465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba9b8b81b66add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af9f1082b66add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000416c5f85b66add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024490282b66add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000668c3d83b66add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019c841c5b66add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe
6136	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4260	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5648	AgentService.exe
Token: 33	3536	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3536	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3536	SearchIndexer.exe
Token: SeDebugPrivilege	1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Token: SeDebugPrivilege	1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Token: SeDebugPrivilege	1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Token: SeDebugPrivilege	1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
Token: SeDebugPrivilege	6136	elevation_service.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
1260	2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1136	3536	SearchIndexer.exe	100
PID 3536 wrote to memory of 1596	3536	SearchIndexer.exe	101
PID 3536 wrote to memory of 3552	3536	SearchIndexer.exe	102
PID 3536 wrote to memory of 4840	3536	SearchIndexer.exe	103
PID 3536 wrote to memory of 1080	3536	SearchIndexer.exe	107
PID 3536 wrote to memory of 1728	3536	SearchIndexer.exe	108
PID 3536 wrote to memory of 1980	3536	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b8dac0338d3a724a4f66b629674e111a_elex_maze_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3796

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1772

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4768

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4284

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5476

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2072

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1556 2532 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3552
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1532 1708 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1080
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1532 1708 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1728
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1556 2532 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09b784cb040bfa8326e258f2705b3ad8093ef103dd63c8ea9cfd5505585b0a99
MD5 881eb847f2907de95678a43c6cd017d0
SHA1 e13c56787b554653647f55b3217cbbad31f9c73c
SHA512 5e624ff1a014f4d034e0013fed6a47c8051bdcaed2a984616cd4a0762be073b52077d5d486aad00bef51d98eff7288da381e17c6f93c9c66538c25c8b8ecb9a5
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvjzQgilV995S1V0:m3q6HjBEjI
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 122895ed8a78d6105f96837284cdd6e05c2b70af7e8dba3232841581c34adf19
MD5 5cbe10805c3f86edcd54d23a73b7bffb
SHA1 f1136a94d62239c0b8a3f3a15c12585aa1ef52f6
SHA512 b0108f4695c3b086266d4f38d483343ca57273ffdca917b9d0a909a327e0e00289dd09a4fab4a9e1f9a15335898204f462db203ad494607e9a1b1c4b5db84dad
SSDEEP 12288:81XLsswWkxy2lRq2czA78jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:KXYfDtczAwjzABgioiNV99L5S1fd0b
TLSH
T17C65F129A3E448F9ED67817CC8A1C506E6737C914760FBDB03E489261F236D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 3c3bf06012113f00e1732b70bcc766cba372541489437c616e7a2df66a17225c
MD5 6aac4c97c96a973305bcfed921a26ae7
SHA1 7a8954535487d761a8711110afd99925f2130d5c
SHA512 c5977ffdb54415f9ca39b2610a93ade2af6985e7b089f702f39a8184f11c7ca12f226e36409c2ab278d099ea6985189703f2c7b9fb2755119146353b910209e1
SSDEEP 24576:90Le5ji0hmxirMHjzABgioiNV99L5S1fd0b:9Pji0AcCjzQgilV995S1V0
TLSH
T1E6859E56F6748735D073C0B9C5D2A68EE972308257308ACB4286C77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b11053ca1e087baccb7786f5d3a60a9aa09e73700d68fa2d2bb3870b1f028923
MD5 0a0ba5dde04bec2c6ca1aca78d9cf475
SHA1 8da00cd3fadeeebe69376d98212a4b87f10f80c9
SHA512 7051efc65e2925e494cae33aa2cbd7b362a1735d3f2bac95ea531023248d2e7cd1c3956eed414bacb74176b6b1465a09008a34b1ddb60de1fe36f2db7f037c49
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWE6q8wyuVjzABgioiNV99L5S1fd0b:8/ezSC6vUzPvxHjyejzQgilV995S1V0
TLSH
T14B756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4b6c9288b1df1aab3e11466454b4d0e26fe0369e15d6a702d34c9f85f102e184
MD5 777c01e83f148d749fa0f1c57a5faa47
SHA1 3cafd8403a64f639af7b861316d4901343b7f0e9
SHA512 24dbfb70510dd6f1540f3864eb0124722ef876ef3657fa4d51972fbe4883b0e69f39e3c113a1b05c9e84a0760c8faeef0eea9c6040fb074538b8f35830c44bd5
SSDEEP 24576:fVbqPb88hv/l+6UjzABgioiNV99L5S1fd0b:fVO88hXl+zjzQgilV995S1V0
TLSH
T182559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB4246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dc0f636104d114ff1f2735f316e10c6ad866e570e89eae2709e3d5d820d336cc
MD5 50b5a57a2445196266cfabba1590a399
SHA1 b9d079aa1310ac92e853f501f23b9b0a69069ad7
SHA512 e8cfe374c2d4445fe1843abaa8817a352d2cabc8f36e7867a66bcb5439fe5c0355f0b0f0a6fd202bb9ccc133ed989da9f3682653e926ee65bddb2d31ea547d7b
SSDEEP 12288:dRy8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:dRbjzABgioiNV99L5S1fd0b
TLSH
T1464523C78268C8CEF3750879E4A8F80FB0B36DA086407E9FC3E1196A4DB9DA1C515697
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 94b785f3c186df99df6b85d4f04c10c31c02a7e2f99dcb1b674027cbbe5c18b6
MD5 6d1cd759c0614dd38ac9b531b81b47ea
SHA1 d2a7af0815088d923c63c012531a4dfd5c034d82
SHA512 46d46c2d236ec37f0c23e5d0b34b29f426cc988b250f92f110e89f86a41b1d8a745bfdcc4958af4b8e49c774ce7632e8527ef33f8cb38bfeaed278b6c506fd38
SSDEEP 12288:8eBNUbTVO86U38jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:8JIUsjzABgioiNV99L5S1fd0b
TLSH
T1CB65C07BEE28ECD2C27A4DB85A91C600E7B278704F51A3CBD175820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5eb08655750566bfd3b1a89c205c751b1b09d64c36dcc03c006b288eb4d0dee3
MD5 222e11d4f1766c3e363b7057f9295a66
SHA1 d578d84da1626c7f1b43a774864fe27a3054b983
SHA512 0c8a224d83ab0c33a2a90dd6d961e4da135a326117b889d09c15e7c754b7f7c516ab2ed1cf8c0e606e4058743ca2e03eaa5ec6a3cb649abd7ebbeecf38ca9ccf
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:DQvGAdlCEL8c/yRNw5CljI
TLSH
T1A5266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 41ffba670c2e7fb9bfcca4fce55899cb0c38accd094ad5dc00bc13b83d9c198b
MD5 e2e9e5fa92b7810e09a26705fd72e036
SHA1 0a6f644ff11fb1c16327a63763621c3bfa43b3e5
SHA512 38c0bfbb9e7e4113030cff28639b3220f7b8981dce611671186d59b80a852ac160729c287ffd948c898d0787254402f2c49847ed8748305d944ace5c6e80cf34
SSDEEP 12288:XAwSfxL/2Dc34DLLmt0LDQewsAjh8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNf2:wdewsAjSjzABgioiNV99L5S1fd0b
TLSH
T11875F031FA74D036D3BB0CB61B35D70A647DB9204B612AC3E3E84E9E59706D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 17c2340458a153a61128a55b8e890e522b7287bf87f24188497adaaac32d0c30
MD5 b8f1b23707c6e4c4e16d58a998439c2b
SHA1 c8c009ecaea76ee359d139fb9116e2cfbadfeefe
SHA512 f410fa86201aa09478dedb733e4353a95fd19cc0f4be2c715064f19a41387d2d3a9963d9565a39f60daf102e3ddc1cf3c59853b90224a797ce01679db30af04c
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH6:vUEtQevvqc2W1cpV2EI32
TLSH
T150474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f80a2f36a14631e5bef4053d627b4318941cccdf564eef6b34cdd52d7ba95ad1
MD5 691edae747fec9f5332fa1549f8c70a4
SHA1 42c9d4aa28e84596f0ec5ccf5fa23feceb0da97a
SHA512 28429f496b4cd60f3284b22fb9ee527b4538c7441e75b450550b51930828e5b4c627a9a06510927239f1c19578f48df42928f42cbef64331994a75ec8cb27b6b
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/zyjzQgilV995S1V0:MoqtVjnmBjI
TLSH
T1DBD58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 99670118835ad5cd5f965e0fc48ca40634faac146fc67c11db89cd0b77eeecf9
MD5 17029e4b1bdb178418e0bcbf1e12ca78
SHA1 2469dfe0a91984b2355373df14023bae7805d4d3
SHA512 e6613bd63de21fcbf1bd257b27456823b1afda18017c1bf87689ebc9304b4651a2168cf20d468023e5fda0ed78acdad80af7bcac3829261be9f379b63ca6bb4c
SSDEEP 24576:lAhGLJIFoiwtA5l7S53hjzABgioiNV99L5S1fd0b:lAMyFoiq5RjzQgilV995S1V0
TLSH
T18A359D81E7F945D4F5B3AAB899B69171EA76BCA65E30D20F1260C11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 a4c6e32a412ef42da25708b9c29d109da8858ce2bc5c985f2695f52ac5a2bd73
MD5 e1e7abedb86213379fec14dfbf0c24d7
SHA1 d88bec002fe8835451b708deff26d7066bc7903f
SHA512 4bd8138a7b03f1f6b98cdf452f21e297d8d2280877321597722997cf749d1653f15ceecce6ac063f38b41aa2e0fd8650e691f47ff86ca5a9cf972269af425163
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CI8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAP:vwuoOW+jzABgioiNV99L5S1fd0b
TLSH
T13165F14672A84CF9E6678138C597D536F7F3BC112A20EB1F43A0C65B5F37261AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 2bb76566eb76af7fc0af896cfce85013dab265eb1f10e0dce895b3588427b6a2
MD5 facf55dd3f88a68b858eb297dc229357
SHA1 b857958e84d9b9229de5fe5bf43a6322def8f757
SHA512 8acc377262da926ea5faf4d17c42c303fe52b780b4d2f796b0353535677c74ba55e346623b695f8b75e29672b903ef609fafe9dfcad64704e7d731666f029678
SSDEEP 12288:TBZ1IyR8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:9Zu/jzABgioiNV99L5S1fd0b
TLSH
T14C55128A23E890FAF262457CD8E4950AE3B37CA2573167CF4261056A1F77ED18D39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 edda533ec1eef9e5a043a0a47e2bcce5f4fcf4ce54ff629a05c239498c638230
MD5 ec8542d552efb431ce26acad78637b91
SHA1 2205e27d5a64579051e12c3de912833b5ac2d073
SHA512 223262a5063afd033b0ed5adf1245b4663a54d6800c0e4c32488745123834b4187ecceccb5776109d7e8652b9d4380823329bc3ac67b888f8102a0a28ab116f6
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:tQRQyi36YOcPQLvw2gAf+PN3ojI
TLSH
T1C2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c26fd71b0db01cc0173bbe5d870ec21857e05ae8b8ce966e769b5ec2210fb4c7
MD5 bd5f6656bd67c78f8ff28ec1d4b1eb09
SHA1 d72503699d87bc62b3dddfa5006cfcd6e3103636
SHA512 2da1569d165d1320ee462951a1ce9ac14bd789d5041671691372a2d7c5be1fa9e83f316e265bf261f6e5a346b54bb85884cfbac9cf716836e99dbc50f8168721
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:xQRQyi36YOcPQLvw2gAf+PN3ojI
TLSH
T173667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5cccd80498bf8a19abd884596929a4f91358377caaf3fffd1e6e0033d393ffad
MD5 635e8ce421a25bc398a9875fef6d8f66
SHA1 1331386f6659fce9ca9ae775211e514f2307aaa6
SHA512 0fef16182c2fd1dd18485556d26dc2ddf798fd022d9d9af2526e1c39c2678e4853e3e2940b22a5cf6a58b3197cadd06d5845c97ae55971f4d815f25080803f4c
SSDEEP 49152:v68Qg55nhheWu7PNU3/CjzQgilV995S1V0:pthWRc/CjI
TLSH
T185B55933B2F60099D44DE1769F4A972196E27C718FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0280ac76854f6b7b15fda7da2e5906440c6839c6f11339ec0f0b7de971d1b732
MD5 c1ae29435d5c57c01ec683c617fbdf8d
SHA1 3016938d9527de29222b25e3f7ac753019310439
SHA512 7babf6a036233b9e8fc5ee9bf15e0ae14c2859988c3936b8e6c148e61ba6969059aba296334b044ccf45acd0a2029023be91be2d516126490948ec64ea541ad3
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99X:Vy5112gYy5azzVvL69nLKnhZbjI
TLSH
T185167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b3803cebd01498f55826fc0a246c6a73de8c2a8dd3387bdd461f9d246ebda6b
MD5 b47f9b5ff1dc7e5cef51d866d2d898f3
SHA1 e4f6a9aa12dd3d5cda64b26c1a3ae987f18c4771
SHA512 c93f92dcd305de3f450547109cae3d89ae1a14c805e040842cbbdbe157e0a20966be722c6e9781a090a93d4a070acb42291ab33284f178263131d3c0ab589906
SSDEEP 49152:UB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glgjzQgilV995S1V0:Ou6JmVxd2dgjI
TLSH
T1D6D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 469b6ee93bfe05a8afd88c197bd37eb4d64bc240bd86abc528d323105801ead6
MD5 408e30487a5301a37122ade23c8c88d6
SHA1 8938a25cc8626dbae0069ff92feb9d5c490ae1ed
SHA512 7a50dab7a2dee874281f6c2c40e23efd6687657f9b505dfff72018c6be2f3a7a07d0e459062fdfd032f653b6d874df9a1d82d5056032ef93452e0aa3b486863f
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xMjzQgilV995S1V0:kmifPbRBjI
TLSH
T114B5AD13F29900E8D06ED17887569232EA72BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 fb254f08bdc4fbb956e50b2adb14c466635980283dd6c1236646a66899c908ea
MD5 67f5ac8598b15963e342d0ad9d72939a
SHA1 87afe4a36cd816151e7a16b56c53c589668112b2
SHA512 ffea3352acccaee864d1fd867b925c2e7820ec1f55d39d1bb22d336aad6ecbac7dbc0d34c23cb694caa821b51dc96753bc286da94700eff5e50b33c2dfee2b06
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHq/jzQgilV995S1V0:M5dKTi61/jI
TLSH
T1C7C5BE03F2E940E8E0BED67487659236EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 42e774f107f3fd91cdaff76e8f44ec7074dcebfe43bb546f57e147dbff6da022
MD5 5a3511d9a8a395e58775713a8c77a5b6
SHA1 f6d6034bab86f8bd519542d9b3b96573df6209bd
SHA512 94761724a5bc2961415362d70c9a7143b4164a3c5184bdf7436479e780ec475d92c4396d6aac3a722515a822e8c637a35cb99cf5849e60857a75315c71f03812
SSDEEP 49152:EhtSn8EApI0figngiDn0AP5wwjzQgilV995S1V0:FX2iyphNjI
TLSH
T19295BE13F2D940E8D06ED178C7468632E972BC150B35BAEF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f495532e3303acdf5ee36b8ee81cc2ba2ab6243ebd513ad23385407447e7f4da
MD5 56720c824b10d3e3473fa44f31ca9e04
SHA1 bf9a32dc1d8355d427cf4921305e40c10187a84f
SHA512 7fc8d589b53480f0ba14a5382df17a723901d5573311f3487717c2a709096959495e4486be57774520b62be589aa5ac6be42a98fd93b99f09069ed580353b766
SSDEEP 12288:968jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:9zjzABgioiNV99L5S1fd0b
TLSH
T1DF4523C792A9C8CFF32048B9D494F54FF0B36CE596003A9FC3E604265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 87e948ed02ddb3608ac315e4b3f50816efff0d7f581ce145735e1ca9edeeee8d
MD5 6963721a41ab3c40deca0c94f03acff3
SHA1 843f91a7cce9e19704d3368d32bb2598701c57fd
SHA512 c47b22f771837faea0aa85c9b606149eea1b10115f2014951beb992c018de82bc654be85699850e9cc34d3a8e1343f4bdc6bb4f841d2f1f07f9eeeb2209dc25a
SSDEEP 12288:vV8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:vGjzABgioiNV99L5S1fd0b
TLSH
T19F4523C792A9C8CFF32048B9D454F44FF0B36DE596003A9FC3E604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 139eaf5fa2755abd89c6b18f217656c6fdee7cc61b25f588aa332e6e4a1c77dd
MD5 398b26e2cbaa8b485b4133fb918ca6f9
SHA1 d999c4afab525294687b8a261870d19ee810c233
SHA512 1cfb8f1286a2e18a046fb430298d6103bbbe99e6dfab4deb07333d17bc145291b8d9f76b5d1954c81755c84e3cea92eb2dc60656e2e95902ebe986c0d481853b
SSDEEP 12288:t/8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:tEjzABgioiNV99L5S1fd0b
TLSH
T1054523C79269C8CFF32048B9D454F54FF0B36CE596403A9FC3E608265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fdee95d7fdf67e6f41da2aa970605f74798256772c9645ff46515d12ab1599f5
MD5 4beaddd148e6488c2c99585ac8a9cfe6
SHA1 90cb90eed34ac13cc95947bf5e429058b5af0503
SHA512 21f915a34bff6113b9ffc85382b2c08f8b44237e6a53c6864740ba19f71ef5edee44a9294c03cd97374e71be463092f8a3562560f421eb44d434d045ee085051
SSDEEP 12288:EVk8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:4jzABgioiNV99L5S1fd0b
TLSH
T12745238763A9C4CAF2718579C460A50BF0F37CE597217BDFC791085A0EB6FE08924B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5425edd68acc0377bd545ae3e7b88c51efa688ec724a9affe41e3fb23f37b258
MD5 a8d916c9e0187efcf25b2bb01bdaf606
SHA1 05db148f7015914b4550f4f2eabe2ab80c391d9a
SHA512 cdb3857caec56533761e5d112f796251964013b1caf403dec3daaa159cc66726221e2047c61ce6b87038a93abc16e0df6fbd2779cbc012a408b83178440fc0f7
SSDEEP 12288:wc8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:wpjzABgioiNV99L5S1fd0b
TLSH
T1FF4523C792A9C8CFF32048B9D454B54FF0B36CE696403A9FC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 79845695f6090905698b8beb6c0d00b68f4948438acc28d3d31960c439e4c87e
MD5 af940608a58ba9c040a22be18c94a5e1
SHA1 65f4daae96cc42adecaf13537138734d282b7a29
SHA512 d06824b217b6613fb996f031125f4300c82bd977687e2f10703519edd592807e79504f55a8ec092356782a696d2cb4787fa4fe08dd262f750a85fecb800e5c95
SSDEEP 12288:up8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:uKjzABgioiNV99L5S1fd0b
TLSH
T1574523C792A9C8CFF32048B9D454F54FF0B36DE696003A9FC3D604265EBADE08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b1edb289e645eebaa43e50d3d30ccfc8e311ea054b7b25f88009a8686a0e2263
MD5 ab8fe671df673cd483330bf364c12d2e
SHA1 57941d13f64e059881610a99786b1ce6da5799a8
SHA512 2e489f80ac107baa0030415146b6a137d78f7e1c8a582f16f64f6e80f5c2220a41d2a2a5b4b983900838be16ffc96669366e1d35dd87fa6bf5efbb69a5112dfb
SSDEEP 12288:at8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:aujzABgioiNV99L5S1fd0b
TLSH
T1404523CB9269C88FF32008B9D454F54FF0B36DE596403B9FC3E604265EFADA08515A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 37683f4b976904de644a87aa01323f2623a58d4725f190b3edad029762f83597
MD5 c50f6ebb59a0dd55e86ee851616b1110
SHA1 fdb2eb2840ddd5c91b0f681d89644d506baa4b97
SHA512 1bdb6f1f1fa48ceded7c20ecb23ea9d4ea0fee1ca17f4790c01e66c83cb2379a3faf259f4546cc949aa7412ceb3c1d424604fdfddfe50b43c68a8086e23777ed
SSDEEP 12288:tiZwb6zzFEoS2cPvy18jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:wZMSzFVSOmjzABgioiNV99L5S1fd0b
TLSH
T107650195B3904CF8ED63813EC855990AE1B27C6A0760DA5F43E436275F737A10C3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 59524cf565ac42182414abf8e850982c89efac4d940644dc257757a6cd80276f
MD5 2b92da11e62a2edd0dd06d19cf308485
SHA1 55a6d20fddaeb685ea6181105ffec122dcd35db3
SHA512 ebe51fee20322289ada00f32ba97b1509ad86890a4408571bb5d0211629d6bde1b45b893d9a8ffc09d572806caf9a51b14761868770dd8eb2ebeecf8a6fbc100
SSDEEP 12288:q28jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:qPjzABgioiNV99L5S1fd0b
TLSH
T16C4523CB9268C8CFF32008B9D454F54FF0B36DE596403A9FC3E608265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 94212ab3ad7736de2e22af0a95249db33722cf10b1ac42752692133483e97385
MD5 6755ff2a662944c4cc50695af725d6bf
SHA1 db4de636b903f060515ac6f0f14d30e03201ff9d
SHA512 e40719090eb90977c62d1b087ae94e219e2276a4da47bfba323ac718d1c80ef598880c2c558a422a9706ee7c0732b644b7d0fc3fb71f4a0defe6e69e3661d9fe
SSDEEP 12288:6i8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:6rjzABgioiNV99L5S1fd0b
TLSH
T1AC4523CB9268C8CFF32008B9D454F54FF0B36DE596403B9FC3E608265EBADA1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 a706af9479e06b8b55a5069d21e7a9030e4bfc51ccd4325a839b455fe6af1939
MD5 9f4590b069d961406d1f3c1e605c8bc9
SHA1 6ea8f3fcb2a8f9046524b963023d66b2e36069c4
SHA512 5ca6d7035eb95740113c23cf81645e20192db394aa8ee0ade54d78ecf4b0f2020e26203a44c40b86971384257235af5947cfd0eed7e5e9bb89ac2de63f5913ff
SSDEEP 12288:MyPz5L8R8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:VzyijzABgioiNV99L5S1fd0b
TLSH
T10E55024773A560FDE1368139C8A15906F3B27C724720AFAF43A406761F77AE09D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9a771a8b931b356edf4e2422a00a3e9e9c5788bd5ef3758aab4734a152a7e256
MD5 61431a09585ee46f2b2f4ac440bca9bf
SHA1 095c62806cdb0ed7a8d2955865fa67d3b2c03c52
SHA512 e32b78ff559a5e4cf9bb1d2c881b881d4bc86ef44f06af16f7a37d7dca432bba3a7d94c5e330ea71dbb866f75a19c160abfe0f73341dfe2df079cf7a2a496a20
SSDEEP 12288:g28jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:gPjzABgioiNV99L5S1fd0b
TLSH
T14C4523CB9268C8CFF32008B9D454B54FF0B36DE696403ADFC3D608265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 692bc55f6cfea03b6f135b45bf582464f9593116a7a019f7b6173f37e111859d
MD5 ef66c10ce42315468634ad6343b8cbac
SHA1 d2aa275ba769882bc6560d24e446fee5c6f77df6
SHA512 926e08e1c4fe687735b6c2e0d05ced31e19006312d00c37a9cb04f103f7e3a00552441c4e8db68d005c7296a672b2b1cc02b7db74470fb4dae1424ff11ae00c7
SSDEEP 12288:Q28jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:QPjzABgioiNV99L5S1fd0b
TLSH
T1684523CB9269C8CFF32008B9D454B54FF0B36DE696403ADFC3D608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3762fd81e6de925809f2bd2f303df1cf2f3bad6ed4d0288fc800851aebd7603a
MD5 f926a99814c50d038eaea6b50e4068ea
SHA1 454eddfb403fc241ac5950e23cb70409706e7fb8
SHA512 738333e76d0f73df228d69c0c6d8425b4d9c6b5f0a70a3b9c37d4a90a48d1558f7413249342edd9617cdf8f92170e1b89a70cc408642bb81f6816af8e07357ef
SSDEEP 12288:ZyPz5L8R8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:YzyijzABgioiNV99L5S1fd0b
TLSH
T14A55024773A560FDE1368139C8615906F3B27C724720AFAF43A406761F77AE09E3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 06d2a600562580f96327870cd6cfd4751eeccd06d270e78939c6bc7f7696fda7
MD5 284a5a26c1e2ce5dc21f2026e7fe996a
SHA1 59019b8cfdbaeeae5aa65e02c2c445f2c0c5da74
SHA512 130f66d131b8c9fb7042c1e9ebeaa0b1ea3d2372e0cdceb0501aaf9048c78b62480b87c437a08311ace77e0e5bf5046f160725bca71b27324ea1f75734ae2f29
SSDEEP 24576:MTHaLl3z0zD0jzABgioiNV99L5S1fd0b:MT6LljVjzQgilV995S1V0
TLSH
T1BE650195B3904CF8ED67813EC855990AE1B37C6A0760DA5F43E4362B5F337A04C2DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9c106480a24c80498d19dc041c2a3890a9043b082cc4de0f56b48ea3ab46f4af
MD5 c35d3dda8180f789459163a4b29493c8
SHA1 860e14398d19b2d025a38a6b6ad244ad2a4afeeb
SHA512 42077146698d1bd7b0aac998e454e8c6e33bd1e112489c61f58549a4d9744002b5adc45d685b3223b4d6b4b073cc6ce2d2517fd6e9f3a7fe0f0b9050aff8026d
SSDEEP 24576:t37d9CHKy7GZIjzABgioiNV99L5S1fd0b:N7d9CHKyaajzQgilV995S1V0
TLSH
T10675CF90F3E414E8F1B78A35C8759512DAB67C9A1B31DE8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 137b04c1d5e794b79eedaf00d18724e97e0cb6cb4e62fe5f64ad5216e8dc64c1
MD5 029892c6002ce324fd60009e09516662
SHA1 cbc15582465f92730fdbdb6b18d4ee5648ac5880
SHA512 e14ea1ad1eaa34ec6411e64e0f5cad4ff603b8e5660a0cf67a2a4eab980f5551e412f51dbf6a62bcbc44d099e97857352c1f6cf4ecdbeca3edb0f730282701c5
SSDEEP 12288:Vf8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:VkjzABgioiNV99L5S1fd0b
TLSH
T1FA4523CB9269C8CFF32048B9D454F54FF0B36CE696403AAFC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 33e1f42396b62d82d2616ed9239118f3be45615705d212072ec486dde29d12b8
MD5 6d8c63d7c3866d31b39f25522afa3bfe
SHA1 c144539e9b041224d43e923e17676af93d7eb110
SHA512 7aac05d16006882f1634a4de69b33950a7525edbb926be5d2daec82d07942c0ea66b66545b95cf3545aebe7b352dd7bb509eea526a89e36d52bf2ba259e52433
SSDEEP 12288:Sx8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:SCjzABgioiNV99L5S1fd0b
TLSH
T1324523C79268C8CFF33444B9D494F50FF0B36DA596003B9FC3D608265EBADA1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 a1dd9e43a33a6ae1384255f43e88e630b386ff3f060ea741f162064fcafb367d
MD5 c6ab199f7c5206e41c59634718b6bb66
SHA1 fb83a6cd2e8dc643d492d30d32b7d808be0fb51d
SHA512 6649b81d0d5b0947c75112001a90854084457e534776667dcb707c78e8fcb227ba342854ac54a0424bbed1dbb856cb5ee4d8c00ec7ad2419ab73b1955a3f2b00
SSDEEP 12288:lg8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:ldjzABgioiNV99L5S1fd0b
TLSH
T1994523C79269C8CFF32008B9D454F94FF0B36DE696403A9FC3D608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2933d88a6be1c7ffb322a267fe26d5330b752f539b6bcefaca5edd3ac5b33de1
MD5 abed91e6cd46c043c2bd11c0934c722f
SHA1 5495368cf209757a3ebd30907b4c7704c19bd548
SHA512 b4337ab27d6214a1d61809b8c1824931d191777979f0c4702361569a43fb4f8683c0484b07b0489a7d006a28d5cec740150f0fa905979655b6501ea482d2b4d1
SSDEEP 12288:628jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:6PjzABgioiNV99L5S1fd0b
TLSH
T10D4523CB9269C8CFF32008B9D454B54FF0B36DE596403ADFC3D604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ab465d0a6ab98450b417f320d1423c97ecae1f2da78fb43537c2da75a8279c90
MD5 9057d6d9c7b85256ebee0ee4ca795fa2
SHA1 64717acac1ab73a96255ba78172491c5611be4c6
SHA512 589be8dd89b322b56e6a1836aedd7f52b2724e5a0c9ccee148a1ae184399bd7cb21c20a7573786527214b43b97fbac5eb7d08d307756dca3e1447136893706c1
SSDEEP 12288:6f8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:6kjzABgioiNV99L5S1fd0b
TLSH
T1A04523CB9269C8CFF32048B9D454F54FF0B36CE696403A9FC3E604265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 422db06717cbf30b53721c2e625a70857cb023e18918306cc7cabb89533fe20b
MD5 0f24c371aabb2492aa88b710b3e2a6ef
SHA1 03825307f21a343751e17eb89ac149bde0f99fa3
SHA512 1691898bcb5a244ed362a9ca3f1d69fe44d43970a472c7997c8d6f6407aabbfe5f1b9cb5601c82e06ca6b347ea4a92de7123b382fb67f96fe6606cb1a6498379
SSDEEP 12288:sO8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:s3jzABgioiNV99L5S1fd0b
TLSH
T1634523CB9268C8CFF32048B9D494B50FF0B36DE596403B9FC3D604265EBADE1851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 02f87a07d050ebaea04c5a70272578404b05f71cb4db360ad21841f29b98da33
MD5 96729f65d90a8561e8ed074c0ada42e5
SHA1 2e538fa956cacb580b1a051de6de4aff2917c918
SHA512 119180ce905813901f638401ca85c7d6ca4a6c51429789282696276b11545b77462831f330d0b2c4d4566a84aafe1f1cf72e3968b53f45d7b5e8b52963f8f968
SSDEEP 12288:Nc8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:NpjzABgioiNV99L5S1fd0b
TLSH
T1784523C79269C8CFF32048B9D454F54FF0B36CE696403AAFC3D608265EBADE0851569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e0351165deefac1d5a677d33848ffd58372c050a0e87ddbd38e16757958b0803
MD5 f2f4d523dbca8566775a031049f98566
SHA1 933d3cf4ea09a681b2fc2a0a055e52ae46adb959
SHA512 93b512c7a0ed89d221230806cba2bea44048b177dff87f0b24a9694c1a5f684d3fccd6af4f6870b813fbac32acf47b9bed442b3fb8e2b5f3a7d8729bd1a3d1e3
SSDEEP 24576:dfwvok9RX6wkyAI7jzABgioiNV99L5S1fd0b:bMnYI7jzQgilV995S1V0
TLSH
T13685DF29EBDC44E5E177913C89B3460AF2B278691B31D6CF029A536E0E37ED09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6d02cf408df8620ccb69d456dcbff85125d95ea84322d938a81efbb3bca90fa5
MD5 95676e419d429e2458bd9b189207e2e7
SHA1 55523bd468a38f998659f36b58fcb67515b63f15
SHA512 219addeab2ef8d5b34095c7ce42ecf8d16c26f6ea7c1a1cf1feac308e2b30477250ea2e07820ad2f24dd5b6499ad927846ee077ca0082957fe2d1b20b682c101
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QjzQgilV995S4:7ySzPIjI
TLSH
T17B067C97A16841D5C1B9C1B98B0BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3e3264e87986cf23f6d54c88c79e316fa6412fdb465bc1725aefc128358e0313
MD5 353d640ca1fdac57dd26d3f3e68866ff
SHA1 49edf0d6d7ef3d161805afc59328df2cafb107e8
SHA512 fc8e08470641c46dd91bec769e7318f9848d35a27c9be1b96708a52c54528cfd93995a586e0be1c34c5ac404cce3b4d2491ac820d2774caf4fb82b7b0ab5a073
SSDEEP 24576:U47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2jzABgioiNV99L5S1fd0b:U47JUQj1irIhCnDHUPfF/gjzQgilV99B
TLSH
T1D265AE1EA3EC01D5E1BA927885158A1AEA71782D1F31DACF12B0437D6F63ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 432f24fed5f9d2fb7874f8f24b29c98020a46cc3c972f54d23287b377bfe7eb6
MD5 8ae64f731e38390a5f5049a286de0c80
SHA1 fd64590bb6b6400e647c3022024799d474816077
SHA512 f0d55b223d95905723d9c7e15414a78beb401568f332469a97b4e5eeaddb74dc680082249e5d9df43b02154faccdc60d385b5c2f86bf36f8b94b63dac2046f7e
SSDEEP 12288:JNsfG8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:O/jzABgioiNV99L5S1fd0b
TLSH
T17255F04AD29881D9E16E5179C7559A06F3733C6583E1A3CB83D0F43E0F76A908DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7d6fd4e3d64a2f9edb3324a7255b500cb8b96b21e90b1790f19b5bb7835ee3a6
MD5 0d70675c48eec8868eb8abc167692e95
SHA1 31ce522fea40fe76694ce5526ebdbe9e8cb87d28
SHA512 7548c72311f8a0906b9054660c7113d5c206a54a0f0f50fadddfeff38b5519ad9718db41d1d5a7766ac13a25d871ff387d4de562e0631b7ccac05b40d44614e3
SSDEEP 12288:nZYY0XiU3fXKfVl+tel0zx9i15PBuWAaRuhfmNR/s:nZYfSUPX4p0a15P9AaRkeNO
TLSH
T11E4528417666CB4FC6A940325E33D6CCAB707C01EE046F0773C98B3F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c6a4bd43ff13fec40e666163a6e1b2a57d2d174db4e5fb356eb185fbdb9b679b
MD5 dd2cf3583e1b5e606f2129780fe0a359
SHA1 853843b91944c68dad0be35f24bcfae4a4ee5b13
SHA512 e7975ccb25f3d863eacf407ce76a95cad1e3885d83e0729bc829cb120611d657f9bbe3bd6385e256afb34366b8e5ed817c37d8d97c1b4779caae315c8fd170e3
SSDEEP 12288:5rPWuDCaD7i6iFq8oKeq8MX9w+nvT3Q+z0ryl7Ej4q7fMeuBtDfUwVfdXAKwnSn:5rPWub7i9m3uEvi
TLSH
T15165E9816136E78FD1F76032072AAF4C77A4EC06B7495F27B3C9057AD86A741A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3f9147791bdd3262c5e8125253786d19264f39edfdb355ebd1ecdb5942f3e9c7
MD5 06bad48652852f362ca26d98e61a6b1b
SHA1 61825eeac074a2c935630a152a81202218c4c617
SHA512 145b32187146853e2fecdd7256c909a33a6c60c375cca44aa476e474e342f1beb5d4539b3b0d0861d6d223324094a43cff19fdac741fb56a9927fa6a7641ed2f
SSDEEP 12288:BM7e8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:anjzABgioiNV99L5S1fd0b
TLSH
T14645238793ACCC8EF27509B8D468E51AB0B77DB48B007ADBC391046A5DB5ED08D35B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cbb37452eec2d4f6efc7f3a43615898a4dd6e4de7b36e56eda267737a378282a
MD5 9a721ab483fccf828e4d0263d0402685
SHA1 388363f366faf7ebf80c9c3172cb962c80c04535
SHA512 6a66e047fc52d73983e73345e949facd36b95c59a2f043181b1371ddf8748fbd25cfd4efa43e88c56f0fc876d4e80e9fcf75e2ba2cb3a921f33d3866544ab40f
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYVjzABgioiNV99L5S1fd0b:Kgb4mBIBhGF2jzQgilV995S1V0
TLSH
T15D659E1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 78901c862379e7ee6427e1b0cb04915b51f03589107e74a6432099806dbfbe63
MD5 c9b538a5e82e2dae46c9b2d60ee73480
SHA1 68b0e100192c3912ca42dc6a70ed1cb4df918d20
SHA512 8f239df5b8b624301a893de9e8b9e24c95f19260bcbb825901ff0319e249376ae68b88b25bb3f6b80e14e69572e8311a5f0e02954d91befe6010711166eeba29
SSDEEP 24576:TG88u8FpJqH1bzria7/mmjzABgioiNV99L5S1fd0b:i7ZFPqVea7/9jzQgilV995S1V0
TLSH
T19385F16667E001F5E477D138C9864667F6B2B8250360FFDF07A88A551F23AE14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2dc9c9b59dc47c239b9d33abe111425cbcad4fd9834dacfd20e83f0572fa2655
MD5 6028dad477ca638d617c1b2c0175eee6
SHA1 01213095232c8d2441ab6b1f45baa322279811ad
SHA512 e055de617ba98c115d59abecb920125991db264cb9db0a6e4850933fe5a42139ce83c195c682e4badeed32039be1f169e8f6ce72d9b0ed59d3749a88b17c5fdd
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKjzQgilV995S1V0:+G05lO43bDjI
TLSH
T181D5CF6E62EC01F9D1BBD17CD9C6460BEBB23825032556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6e30e331cadf801ecd20520b7e51cccb7a1d87120108ae8c3df56508c48ebeea
MD5 633627d3f6cb9a64fa6bc865fde7c18e
SHA1 8bcd8ae7f17c92c458b5962e3b841345799f6afe
SHA512 1449a597efb35d0a9c8c387f8b53bf83930892dc12e1ff88e57ca2c09acf4d5f28a09d045d0c3a4065b97d99eb72af8a60919ee5fde87b5beb7e74f3d77ac610
SSDEEP 24576:Gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnQjzABgioiNV99L5S1fd0b:ea5POZ3+Jt2pasx2+mCjzQgilV995S1i
TLSH
T11165AE5EA6FC01D5E179D17DC583861AF5B2346153319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c154c0de1f116df920e977a7f2bb85b5235b42e899341209a7cb8a5562d7306
MD5 1cce1e6196474e03ddf9f8e903bda265
SHA1 ed847740db9351a5e9d5a5bd2d239b2dfb4cf26a
SHA512 a083140d0e041c4afbf7b6584e371f2a3e260ff203528c53034c6c2650b023350fddd84934eba9572b0369a47936d0a5874760d5ffe9f6ccf7ccd56fdf5afbd3
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkejzABgioiNV99L5S1fd0b:PNc/zEOVHFdjzQgilV995S1V0
TLSH
T155858B1623E901E4F1BBE1BE89779546FAB1786513309ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4fbffe5186b4b17aec35eda0515f3c8b53bc57d42166c658b6d231cbaf8589a4
MD5 b68632820e7142049bb11be2705c6319
SHA1 5823fe6db7922fce705fbddcb6487675b88c0d35
SHA512 b2c2e2969a7c0cb42a65f3e1e714dec27485738b8b36ee0bdbfd090ca5649e42930d27f04e2bbe6e3a2d169b5133cd82dba6d9538c1429979e796eede6d774d7
SSDEEP 24576:68kNvNnaFeYhJNtmZBm8jzABgioiNV99L5S1fd0b:68MwBtOm8jzQgilV995S1V0
TLSH
T1D155AF6EB6B845E4E1FAC6B5CD238516E6727861073293CB8390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e26d0ec481a31b206e9ebc4642cf1eb10bd648fb9f229a014dedf7c14f58266d
MD5 84c60f61fa9236d474c8389d6699d068
SHA1 09f828e812503126e11d1f81637fda4fa4ee1992
SHA512 832ad704b5ef85e506d5a53f7d1cb4287e066aafb63d96e26228e2840f7bd40dbde504dc32715c5ee7e80fb138a58cbc108e771e47d6a714d2399be42b1e1020
SSDEEP 12288:+HvUrBFrEjwaQZ8jBFAbdnowDTlR2DZSsiUYoiNV9pHL5SPNfd0bAPA:+PUr+NQajzABgioiNV99L5S1fd0b
TLSH
T10C65E15F62AC1CE5F676A17DC581860DF672B8620311A6CF02E0817E4F67EE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 22152d63fab288c0fa713a6e90045a5594db617880ec5c06081c1428749ce0c3
MD5 20cdb0a9b8c5e72a1bfbb02282d80429
SHA1 e5fbbee8c104ee0362bd6d5141913568d9cdbc0d
SHA512 a7b6459519f3cbce5e3cadc28a3d95a9927404c335ee820398ad2110044082f57c2b9f691a48e422559357f78e4284a34b69293f7f50602dbafad351267dc1ed
SSDEEP 24576:SD3FHshBIYQgATjzABgioiNV99L5S1fd0b:SDVHeBIAATjzQgilV995S1V0
TLSH
T12D75E17EE79C04E4E57BC1BCD6638907E67238A9032166DB02D481B61F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-7-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/1260-6-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/1260-1-0x0000000000B70000-0x0000000000BD7000-memory.dmp

Download

memory/1260-86-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/1260-0-0x0000000000400000-0x000000000059A000-memory.dmp

Download

memory/1772-39-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1772-45-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1772-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1772-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1772-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2072-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2072-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2072-311-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2072-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3536-315-0x0000000002EB0000-0x000000000314E000-memory.dmp

Download

memory/3536-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3536-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3536-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3536-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3796-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3796-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3796-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4112-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4112-72-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4112-66-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/4112-267-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4260-296-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-328-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4260-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4260-94-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4260-88-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4284-82-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4284-77-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4284-281-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4284-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4768-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4768-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4768-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4768-220-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5476-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5476-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5476-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5476-106-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5648-135-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5648-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5648-132-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5648-126-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5648-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6136-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6136-20-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6136-21-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/6136-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6136-14-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download