b701bf6f3d1c1f6622019a4ff4fe1c5afb51ee967f8b0043e155a06c129e6961

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
Size 1003KB
Sample260705-bfjatabv7j
SHA256 b701bf6f3d1c1f6622019a4ff4fe1c5afb51ee967f8b0043e155a06c129e6961
MD5 e2b978291a6487e4ed9999a7fcabf6a1
SHA1 720e3d9b51b9d521968c9c0baebce76a10066990
SHA512 3764cb13b647163f93d80de1287ef2962dcc9a7b97e5af0d6ae4ac9f7006627b3c465b72eb313a4a8f342beb5731b3f54de145d67b106f3512c8bf3ed3e86c80
SSDEEP 24576:rNEHd0EKpxtJFtY5sFr89TMFZ2qr6TpqHvDLLv9VbNNDQUFjc1y:rNEHJKrtJFamr89TMn246TpMvDLLzxNM
TLSH
T11325F116B780D037C57702364E56D7A8A6B9F5B158214007B7E8AFBE7F301D2AA35B83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2572	alg.exe
2008	elevation_service.exe
1876	elevation_service.exe
4564	maintenanceservice.exe
552	OSE.EXE
1276	GameInputSvc.exe
2576	GameInputSvc.exe
6124	msdtc.exe
4640	PerceptionSimulationService.exe
4980	perfhost.exe
5496	ReFsDedupSvc.exe
3752	locator.exe
3240	SensorDataService.exe
5328	snmptrap.exe
2944	ssh-agent.exe
5952	TieringEngineService.exe
5564	AgentService.exe
5980	vds.exe
4892	vssvc.exe
4008	wbengine.exe
1224	WmiApSrv.exe
800	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b8ef6a3758f5f28e.bin	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd148faa1a0cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a704caa1a0cdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ebc8feaa1a0cdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	GameInputSvc.exe
2576	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4604	2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
Token: SeDebugPrivilege	2572	alg.exe
Token: SeDebugPrivilege	2572	alg.exe
Token: SeTakeOwnershipPrivilege	2008	elevation_service.exe
Token: SeTcbPrivilege	1276	GameInputSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5496	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5952	TieringEngineService.exe
Token: SeManageVolumePrivilege	5952	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	5564	AgentService.exe
Token: SeBackupPrivilege	4892	vssvc.exe
Token: SeRestorePrivilege	4892	vssvc.exe
Token: SeAuditPrivilege	4892	vssvc.exe
Token: SeBackupPrivilege	4008	wbengine.exe
Token: SeRestorePrivilege	4008	wbengine.exe
Token: SeSecurityPrivilege	4008	wbengine.exe
Token: 33	800	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	800	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	800	SearchIndexer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 2576	1276	GameInputSvc.exe	96
PID 800 wrote to memory of 6068	800	SearchIndexer.exe	113
PID 800 wrote to memory of 3960	800	SearchIndexer.exe	114
PID 800 wrote to memory of 6016	800	SearchIndexer.exe	115
PID 800 wrote to memory of 2500	800	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_e2b978291a6487e4ed9999a7fcabf6a1_amadey_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4564

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:552

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2576

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4980

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5496

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3240

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5328

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2944

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5952

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5980

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4008

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1797646245-3139070211-3019596475-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2948 2944 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6016
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2916 2924 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 93fb32e2828a201d5245c9299eddbfddb5de34dd854143ac4790737a99d232f6
MD5 de98ac81951cb5da2a799a9ff05254c3
SHA1 d39c4e6bfd311fd98de8d78d07ee0c34c591dcde
SHA512 507d4b802cd851215bb067561a1e2a7ccef973a47871db10554c76828f41ef3edd0aaa215e0979910507b8d0f699f2772bc80490a9a0734c6eb1f2bec424643f
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnZTpMvDLLzxNDQUJc1:/3q6gjBjPPxNDQUJI
TLSH
T17CD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 79c0462d5a0ea8cc4019394132d53d5d88d70fe39371a31e31bc4352f3d8b8e0
MD5 f9af439a3d3622d36e1e6e6a0f52c07e
SHA1 c5fd8c2c1234dec99e7d402fc6fb27071a5e08a2
SHA512 75558fd17f9eca4af2fad1281e3e49189939e7aa54bc5c2ae839e99108c1cdd3791a6dc525122284170779780cbff7ed14c5f61c3c104979dcb535b35e9b097e
SSDEEP 24576:EXYSD2czAGTpqHvDLLv9VbNNDQUFjc1y:I2cLTpMvDLLzxNDQUJc1
TLSH
T177050229B7D008FDED57427DC8A18516EB32B89147A0E78B03B499764F333981E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 87c5e44c0b52c21a8d74349fa363801d365fca533f18b8ea179b877eaf458111
MD5 0ca9ffda73267ddfbd838b747d44dca0
SHA1 20224b546d5c7f067b228e75a873d28cb1ff3cfe
SHA512 0cb8d249f45f58c123749f3bca7af80032aa83f6b7ad9aa2e59745132df5758e7514d620611ef054f65de0b7e9cb3d7c71d5954d2bd2efc707439f4fe9d98f95
SSDEEP 24576:S03e78w06hxOrMlTpqHvDLLv9VbNNDQUFjc1y:Sl8w0aoMTpMvDLLzxNDQUJc1
TLSH
T18B45AE16F6748775D073C0B9C5D2A69EEA7130821B308ACB0286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1297e606ddebe8ccff5d1d92ed626ff70293a0d407f90014eb1c8102d15c48ca
MD5 00858d6bda0b561ac33463fa2db6678a
SHA1 619cff14906a768f109b6d56c1aa45246e869845
SHA512 69784a67958fc21eb9daf8f4c611fcf351f8fe371440708f5e25db4b5c0a834d0af012e0d7d7e204c3d68633e85d98988e8ed12a1ad09def0bdff388501b96db
SSDEEP 49152:h/ezSC6vUzPvuHjyrTpMvDLLzxNDQUJc1:hezSC6v2XuHTPPxNDQUJI
TLSH
T1BD756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 4ceb98d78184332d8b1e2d8127db3f845ac178d854f6068ced8be3e18e426e45
MD5 ad1dcc55514b8739876f95905d2a3e06
SHA1 8dc980d6593ef80e374a84d3c7593e709a383a2c
SHA512 ad31effce72c2604e10506dbbd8fc218a2553142f8da9c8b0f91f86f9b20dee27d6d448c8f4de891a42617c15b5b6758825bcc77274e5883bdd9918b16d3fd6d
SSDEEP 24576:eAbZPQzOdv/l+dbTpqHvDLLv9VbNNDQUFjc1y:eAqzOdXl+5TpMvDLLzxNDQUJc1
TLSH
T1EF559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 da23eeef2e8eca6d5dd97776f2cfe8e269b103a3e64345fd515931d8d63a1925
MD5 fe7787aca626b5afcd5f4bb72b6717b8
SHA1 055a132d5849aae45417d5a46d1a6cd808e581e2
SHA512 a8924dd1629ec501c9098984c2e85444945c05fe10678f46e95e2c79a07c7660764875f7e8728a282bda58722705551aef09a978a2800ccb33ee2aa0010de278
SSDEEP 12288:AdboNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:Ad0TpqHvDLLv9VbNNDQUFjc1y
TLSH
T15CD4231BE640A9DAFFC90673165D0A1EF77CECF169C499070D253CBACB3412626939A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 b3bb014436d541c127559d02ec9e4e85bf222abd186937cfce9073854f82b369
MD5 0b5d6729e03f8c90763c0029528a1a2c
SHA1 5263df1bcf349c4a6a11c9cd01a2b76592f6bf67
SHA512 1971f11e1612f25ee4737ca781dcb25fa5d01e842d8902db98da77269dd4f7464cd5edf8396e7d8dc5829b99ebd4444d08963e879af426444eacb9240ad0e38f
SSDEEP 12288:9aBNUbTVO86UbfoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:9FIUUTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1CD15CF3BEE28FCD2C67A4DB956918600E77278714F61A3CBD175820ECE235E11E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 5c362fe04810969f022be3b4825a3820bacc62085b52dd7e04ee158653852223
MD5 3982da33b7f9662e72b6cabac2940fb3
SHA1 5b6b39c18adc85bc3dd638c0941164bbb2d4ae81
SHA512 9cc01ddda90126c35da08e6e8d8bc7de61e9391277e1ba20118694531c3ffd9f9e404013b3e2e4b11def4ff69ddf4896c935c0f49cd76ecf13ec195fb96df4de
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5JtNRV3THx:nQvGAdlCEL8c/DRNh5CnPPxNDQUJI
TLSH
T1E7367D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 317d6496a4652f02d5b0f28682507568eacd5e20a0b3f4cf3bf34c949911054b
MD5 d95660f800a83169918d767998489fcb
SHA1 d18fe91a05f799df3239085f648cde63d7c8e629
SHA512 8eb4e5241b093c7321262b2ff07a6154350e5bbd0c93b2e37acf9874d8ac1e064c074bd58143d412d92c06dfb92a20a9f14bdd40c04bef6f7da100d92967df55
SSDEEP 12288:RiwSfxL/2Dc3bDLLmt0LDQewsAj5oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjj:gmewsAjeTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1E415E031FE74E436D7BB0DB21B26C716647CB9604B911AC3E3A85D9E49302D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 beac9f126cb21bb34b6365c82648ba16734d77a948fa4bb1e960d1fea9e9309a
MD5 fd56bf7a12d3acc757a3bac3bb6bde80
SHA1 0320fe49b48bcdd5ccaad7208f8e1bf95025da08
SHA512 91ffd4e5c342c88528ce75e0384f40078da078e1ca690872afdefa57f89763b77f73e8768c27c1baaf2f606d3bb542de3d0cbffe6d253ac029c8c490e54087be
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHAJNDQW:lUEtQevvqc2W1cpV2XF32ALEW
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 42366e65605b9f457e7d2293e02ee1302445e58453f9e0b277c14b2530b03dd9
MD5 8396ea584d8c07165295fe49767543f6
SHA1 6d3a5040e0e278c517d48d6a4d52402b960e35a0
SHA512 ada219fec32802f5f8283a068a88791ebe799adfea8a64537ec27b66d7fbaf794adaad6051517de4ab504356141bb66823c750b301c8c5e308d231b40272289d
SSDEEP 49152:9Q5RquA/m2yL5zMfFiV+XenmE3/zUTpMvDLLzxNDQUJc1:Coq1VjnmCPPxNDQUJI
TLSH
T169D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ebe4e845799ca79ae1df59550afe23f0178aa36267df7a20d2c08253e47c9cc2
MD5 781d13df3ecc67a2e5d83141e83bd5ef
SHA1 b6e9ba88b7c3ec3310a301fee5e1126f13e25dee
SHA512 603f2039e311dc381f86a671cb71629b5d64945f4db82161cb3819137bc907513781547c18c1f2367015d63b12bba4c91a5a731b92eb7083b86c21779035e3c9
SSDEEP 24576:RAhGLvFFoiwtA5l7S53NTpqHvDLLv9VbNNDQUFjc1y:RAMxFoiq59TpMvDLLzxNDQUJc1
TLSH
T16545AD81E7F955D4F5F3AAB899B68171EA76BCA65E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 922a3b739cff21802a4827477d1ba645ed96e408add27985085539d5f6e4af1e
MD5 c04aab0210a71d34969113e0e6c10202
SHA1 943a8d38128ac4c4360a5bebe375969b64b13cf4
SHA512 70055e1569739cbc0529360d4f712b6468b420c7b52c98969dbd8db7641614959f0c13b61e05f26c71ae241a4aa3d94d41a1d88c1101c8f5ed4ae4f227a01b13
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C3oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:uwuuOW/TpqHvDLLv9VbNNDQUFjc1y
TLSH
T1FA05014A76A41CF9EAA7423985478136F7F2BC522A61DB1F0760C65B5F333217D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 78d709573fcbb5886686b7ec03e0ec3c6aba834affa6768be459859e39f2c695
MD5 8059cb9e026cc01121557b6eb4c536c6
SHA1 d98ca3be699664b3557ce123e348c00cb4ff9e84
SHA512 3f454f525e04438255de52c6468fc95996db3047e19fd20ee53c5c2efc34c85e422d6da7ae0cca645a274bb7190d9890fe4398b900c43d6ffbf3bbf16311d1b2
SSDEEP 12288:ZVY1I3aoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:fYufTpqHvDLLv9VbNNDQUFjc1y
TLSH
T199E4135A72D070F9E697023A89E5060AF775B8B2277183CF052519BA4F336D62E36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bccc8df8856862e757372d7fdfaeeed39f4a686c59045b74d60816e304e50bcf
MD5 6fcebb706177932752c0b3735c0c166a
SHA1 39a2afc9e2efea83068ac8a7596131c287cd8cc0
SHA512 470084a08e6e1052ac7a0ad768411168a3465235f4b2390b3df95a00fe73d96ab64a0acc4d62c98dfc4382e01b2abe3dd2e1deb71a0a683e4de6631fa4c62561
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uv:4QRQyi36YOcP8Lvw2gAf+PN3vF+E6
TLSH
T11A667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 51f34e36f0f62487668168535aa67ce5b7495fb0b713f0180ae869498ceb9597
MD5 e7a8c69abd3168c658d937b3c2100e99
SHA1 f46ac7d545d9e555199eb3a9981c9c98a585e3f9
SHA512 0ab25aec624d5012b28736826cafe83308b862ceefe02dba36f32f1fa60e7eb1cec4ad92edd7e8400c0169bef7fed9638eb813ca2b74ab483b51b98822581d88
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UQ:4QRQyi36YOcP8Lvw2gAf+PN3kF+E6
TLSH
T18D667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 99f4e7d3d634837ade794dad586bc7093a4f1799deb5dbfb5c750545d79266d4
MD5 9efe2969d2245ce81f01f7ee41809ebe
SHA1 d0894fe7d678714525fb38c7bb1584e5f74607cf
SHA512 4d9be4c602dc0527d46aeaef3ea6bb1f80861c986f7188c21fb21a134b66d1e272a54104d6ed3e2fa86f0531cc57e8c696e308565f62b861924cd3907d5dcc20
SSDEEP 49152:j68Qg55nhMeWu7PNU3/iTpMvDLLzxNDQUJc1:dthbRc/bPPxNDQUJI
TLSH
T118B54A33B2F200A9D44DE1769F4A872196D17C718FE0E3DB8515721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2153b0a3fa65ede4479a98f11e7ee87ac7cbf9dee06a3d5460fda135b0c821bd
MD5 011fcad33220e2b2cd8d65b39645afd4
SHA1 50500a6d93833cce9dcd9ca2e4f3ea4e67213c8d
SHA512 720e1464c0097898060731f486bdf6844d11ae682ba2604d600f093e0a47418b33cebaa43b056f6cee7d773e9659fbdf65782fc5a7feb4c2271df34778685e68
SSDEEP 98304:oy5112gYy5azzVv569nLKnhZzPPxNDQUJI:BLIHAWhxJNDQW
TLSH
T19E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 472f535dc01d33bd4e37aea0e2ad403143382d9521e2ebf0fde785e9d084f891
MD5 1af7ffc5565f51a8e234e798f9270fbe
SHA1 bcbf63c2cd3e3a53f733325bc430f0122f90fa05
SHA512 df57c4155d077b8050bfad5294fdc08318415cda98265dd22989f9f92f91b758ad7f0018b62384e694aa3307c37f0ae452ba70f16a2b15730bd54753af76a6d7
SSDEEP 49152:wB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBTpMvDLLzxNDQUJc1:qu6JmTxd2d4PPxNDQUJI
TLSH
T17DD59D13F1DA01E8D05ED079974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8ff20b0c7225ad875096a6e4ad92b02a10626a6ae5a7acebd8fd7c9d73cf42c
MD5 8fffa52a31e37a1abcbaee683272d794
SHA1 6ccbd8091bd9ae4c8287eb5110b356ec5c39227a
SHA512 9bd4b1b8072b18d9f9d25771095d728c6b2dc8c014349ffc10a8aa6bf6609af3468c5f03612d1904a221eabc75008023ef541ce725e73eb2a6e0746d08a5c230
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xJZjFWASE6o:LmifPbREF+E6
TLSH
T114B5AE13F29901E8D06DD17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef80450a03076541a4fa73906590fdde581ac0bc025871f07df088251959c326
MD5 cb2a3f7cf72e770671351295c6a6877f
SHA1 dd47eec37c7ccb8464647a108a1a4a5860914794
SHA512 15e649a87c20dea408b4adf6fe82bf7fb8c69df32480887a11fa7eb05c7309ab0ecb4a17a386e93d274a3c5bf675efce403b03d2502a6f47361de7379e25828b
SSDEEP 49152:5SuZQIY0Be2K6RVtOnks6NMHqqiZjFWASE6o:X5dKoi61qSF+E6
TLSH
T1CBC5BF03F2E940E8E0BEE67887659236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a0ada0d00c5409019f42f5dac08c3916eafc12fad3a3523a342d01df1b5ec760
MD5 10f53f363ad7f511c0f4f9fc1104a236
SHA1 89c6cb4168ac2aede0a206dc6b455a88f3a0c419
SHA512 238461168886363ae3025605844175e73d03545545cdbb000838e129a33956b12e8d4b81e831b8d7dc5a24d551a17f480cf8a9fbb950e9b8e748b3b1c77e2736
SSDEEP 49152:lhtSn8EApI0figTgiDn0AP5wYZjFWASE6o:UX2iyph3F+E6
TLSH
T188A5BE13F2D900E8D05ED178C7468632EA72BC160B35A6EF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 70b918ebf24a2128374bdb3ea3222486fdedf44f4ad2b14f54c68da66adc46d3
MD5 7e4c81df89e42984ba3d5b0ab4deb5d7
SHA1 10e527d7864757b263f69d22b45a25f4b81c2aa7
SHA512 9a43cc590d870a260c6b97b3e7e60ec12582235f46b0eef4b6955ce0bf1dd81ac5e3fcd5d325f4e6b62b0b6ea134b52bc312f75794fb61c534425c20fc7679b8
SSDEEP 12288:lnLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:lLTzyMjlNz8wWj+WASE6ozgvD
TLSH
T19DD42391B1809DF5DAE6333EC8D443CDA2FEEE2F18D0552E334898175B0B7027D1AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 55ebd1611ba2ace042cd489174a1f1f21e11ff8add3a46512c0a689acbb4211b
MD5 caa10d2d0bd51ba143956f47d179cba9
SHA1 20390259f950091563a7df032024cf44a2dbac2a
SHA512 9e54743c6caa03e85670906229c1be46b67d4879067e37658814c120a3335c82caa7072a40309697511c0845c70ee822910c91bb863c9653e14befda79979fc5
SSDEEP 12288:DmLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:DOTzyMjlNz8wWj+WASE6ozgvD
TLSH
T1C7D42391B1809DF9DAE6333EC8D443CDA2FEEE6F18D0551E334898176B0B7027D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 1977c7a20d7c7dc1c6c6dd60344d5f5f48557610650080c65d2f6776d08ecf90
MD5 0db3e1bedc0e93d06e3c0f480bed5e7d
SHA1 ceb1e4374f62038ad9326d28a2cffa7926a944da
SHA512 441475027c5ecfee6035cf6c755cb7969d333972f9a19d933ea87de98841aa403772a67001586ba79cb17051481a690849b1eaeabc3cac30dbb40aa372868743
SSDEEP 12288:phLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:pJTzyMjlNz8wWj+WASE6ozgvD
TLSH
T167D42391B1809DF9DAE6333E88D443CDA2FEEE6F18D0551E334898176B0B7027D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 26541658bd29e5732fee9dab24e6b5aba3c8c7719b335ee6d503a1f89ac38710
MD5 0aa2b1d2176df9a812dec173cf300bf1
SHA1 3590429e03278ba4aeeddd6ab6bb101fa15ffab3
SHA512 27664e4757211e6c8df4faab8bf80f4f09f5da0927aa4c532802f61e4869ae9219d8a5a77e36f7e24e1af70bc1e2931ed68bd9a9f7dee100ee04d92ee00efb4c
SSDEEP 12288:il7LTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:6TzyMjlNz8wWj+WASE6ozgvD
TLSH
T152D4229272809DF5D9F67339C8A1828EE3FEFD6A58A0566F3340485A1F17301BD29F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 187ccd969c8ba3555f5b79e90acc6f2a6fdda64e62e3e85ae80978c46d3ec31d
MD5 126a93f641f51cb594468102bc3421bb
SHA1 6057a089db603cb1fb82f1712c744bede6ac03ff
SHA512 4582ee7022c1ac6ca511b7c74f5f372548997aa1c134b4dc46b8b4c417be06f8203f736fbc62313b8825e1c98861120996a2d1113a87bafac7e1e753a8f56182
SSDEEP 12288:osLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:oQTzyMjlNz8wWj+WASE6ozgvD
TLSH
T1F8D42391B1809DF5DAE6333EC8C443CDA2FEEE6F18D0552E334894276B0B7427D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 9e4b43fefb8f5798c655a564a9dc21f2fde20849e90d784c0c8cf00974fce959
MD5 010c3c204d52d9d213a18b19b190675a
SHA1 ff460069122eac73b5286b4484496e0cc65a49fa
SHA512 65e8899447527beceab1f86480d686293516b4a9fd5c04548900f1b16ca5c76c5f6adc6d88fd70bd9fc710081f1ff1c21fda31428e2c6fb6dcbe6f179a5e8e9e
SSDEEP 12288:LBLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:LpTzyMjlNz8wWj+WASE6ozgvD
TLSH
T126D42391B1809DF5DAE6333AC9C443CDA2FEEE6F18D0552E334894276B0B7027D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 f5750c81f118cecab7b395e60207ab04643ce8c74bccfb3644aefeeb88f1e966
MD5 085addf5b2e6e5d6e29b515f8cbd7335
SHA1 da3dda3db0ae69c2a221fc9ef4829c47de2f3fae
SHA512 c4d8005e681890b019b7af916451b41f7af17287a92faef9fea0312d13f2693e58a2dcc5bb83f453e19872cbc6ecaa5cc6a27de06b026248cc0998b83ac35356
SSDEEP 12288:uoLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:u8TzyMjlNz8wWj+WASE6ozgvD
TLSH
T113D42395B1809DF5DAE6333AC9C443CDA2FEEE6F18D0552E334898136B0B7027D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 434859a80710edc6cdd9b5c74115888ad3d5592a9fae3c60cd391baccac5ccb4
MD5 75a6415d8d757ad0288c6e7b904a6f17
SHA1 bd89628123a6967940fac44157090968d8022011
SHA512 251bfebe409729d3a00c2c5d7d0c04188ed358f956fa61d2dde1a062b8a49771a35e0d8f7761e16c7423bfe1225694dd712989139f4edafbbe870682b56d70b1
SSDEEP 24576:RZMRzj8SEBTzyMjlNz8wWj+WASE6ozgvD:RZMRzQzZjFWASE6o
TLSH
T111150295B3901CF8ECA7423ECD55894AD2F2BC6A0AA0C61F13A436675F333511D2EF96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 df18e60d2a2703f5bc8d1b37e582cd501793ade29338b1408f86ffc379470268
MD5 87a50f735a303a09d5265ab63da86fb8
SHA1 c1f493c6cf918ef2eb2f98374aaea9f4e38bd9bf
SHA512 cfa8c5b95eb5056efc260db6385bfbae19334f94df70edce3479548df242536b185d6e2f072ac82ea2e85536f2249497016e6b0a46e70539531ad09a30cf4ca7
SSDEEP 12288:tpLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:thTzyMjlNz8wWj+WASE6ozgvD
TLSH
T1C6D42395B1809DF9DAE6333EC8C443CDA2FEEE6F18D0552E334898176B0B7027D1AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 18906221f0defaa285a1e5e809655a3248b08783e134030b9eacf90050584101
MD5 5a6736f377c9aa2414ecab1cdfd56bc7
SHA1 2576593b919d548d1572f06bc46c123c9ae19dd3
SHA512 edd22556eb389934cc2e34e39fe15961c6f5dbbf306f1f739a29e8f1a4b863dec34b705374a13fdedf6a1cd90d4e22ac9f91880b842b409f3d9df389795d4ddb
SSDEEP 12288:X9LTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:XFTzyMjlNz8wWj+WASE6ozgvD
TLSH
T11AD42391B1809DF5DAE6333EC9C443CDA2FEEE6F18D0551E334898276B0B7027D1AA56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 c5641caf01b60a2037075399c9b987cc367d1019bebc911ba9e61af0976ad732
MD5 542709d2f61afd871cff2526597084d6
SHA1 afb386c811a31b06624dbfb32c853e7ceb436fd4
SHA512 726a6083fdd2149a88c4aa90dc3fef8870f3141b93b244bcbf1894e5ee386d990c35e242ba730fe307a0c2efae86e40a204fe839449da61cb39dacf65486a160
SSDEEP 12288:CLPCnLqTLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:uC+HTzyMjlNz8wWj+WASE6ozgvD
TLSH
T199F41247739134F8D5B76239C8910A46F3B6B8360B608A6F239447772F17791AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 f469c26f367a52d8a5d004d5af92e402278f0989485c944a0786945c7fba4330
MD5 7a00e0398ccd9add55fc9db835f102b3
SHA1 f53ec5448b1aa1953f9d4380511061e21a2c2f3a
SHA512 665ff1708121b76c2bc8579e6a0b81a0a7db6caae37275cfafc9ab3f6c7559b9ec81c134052ee8b56351e416cd3fb8e153757ea3afa194d8e6a889a525e6cb5c
SSDEEP 12288:VJLTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:VBTzyMjlNz8wWj+WASE6ozgvD
TLSH
T10FD42396B1809DF9DAE5333EC8C443CDE2FEEE6F18D0551E334898266B0B7027D1AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 ff2338e48f4904ad732f82658605ff478f78b6a9bd47c21aaba7b15e7912aed7
MD5 f190bf2c7d90fc5344584a84dee21501
SHA1 62febcb124a8703e759c5ef9a7b5b7bf43b42eb3
SHA512 582ec66f7b6b6a864b3561f6b95efafb5be9c95a9a0f83e4b588222d44342e52d6ef355dc36b65097d66ca31051469c3c074c24999eb095a386d1ef78ccaa3aa
SSDEEP 12288:99LTzernrgjlbSsmUN/8wN9PGj+tQAfaE6ozcIcrpvNRYR:9FTzyMjlNz8wWj+WASE6ozgvD
TLSH
T110D42396B1809DF9DAE5333EC8C443CDE2FEEE6F18D0551E334898266B0B7027D1AA55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 e76b86c0eb784c67f2600e0394e696c07edc979db6db29b1540ef49283165277
MD5 11ec23d8b87c8669621c8cfd28b9e193
SHA1 088e7c3154bb5a5eda96b433caa0648589338c91
SHA512 786f655bd40e76efab3b0c7fbef8c554da4a024b64d5000d6edde0da0d00bd6ad5352f3c1c9bffb71c1af2f251166ba5e7d2ed86da274db03fdfb882ba755877
SSDEEP 12288:diPu9LuCcDhxvyTA8EFOFnvqjKuPgiYdI8kd3pLAMK0VL5FqHfWSD:ou8CcD3vyTvJeIdI53pc/0XAHfWSD
TLSH
T104F4124BB6A260F9E67B9230C8621646F7B5B4351B644E2F07F447762F276602D3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 6eceecbc6317a8bb1e567deab1f0784d89f984d9dfbac6785868306bf1946062
MD5 dedabedf61346784846ebdd95800c4e6
SHA1 198fbd3f6422bd9d42a50aa78c9214314927d8a8
SHA512 e4e13e8d1716989f446ad134f0467fecae955e79b86e54610544e0d5cac7880702f0e2ab3ab29876e3672f9a472903f18e677f0b2a0b69be99a86480fe5478d4
SSDEEP 24576:HTuaLl3z0zDmcD3vyTvJeIdI53pc/0XAHfWSD:HTdLljCzvivJ1EW/0XA/WSD
TLSH
T1D815F19AB35058F8ED678139C916990AD6B27C290B70CA1F07F436566F333A11C3EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 a71c1d27737200ca2d192ccb4d80a4e98dd74fc2eec896d80f856ed7c70e68c7
MD5 ce02a6bc58522c60e414285ed517e605
SHA1 c8038ce984f7f5f5764787ab69dc556e19a91459
SHA512 7ee7831cc9a7b3906560f7024d91dbfbafade68148c313647f25b619714a7c9d0ce81e72f87cbaf3a31e08f7991559773ca3695405ba0206c2566ffdebeb33fa
SSDEEP 24576:y3Ld2CHRy7P2ecD3vyTvJeIdI53pc/0XAHfWSD:ULd2CHRy7IzvivJ1EW/0XA/WSD
TLSH
T1F335CF91F3E410E8F1B7DA35C9765512DAB67C591B30CE8F03A4265A2F33A918D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 603KB
SHA256 bb040ddfd76a9324a5b3abc5ad1a584849c9c00cb2921b887f21bfa4c9cab226
MD5 f0dfbfee65a0d9d89f2227762617ccc8
SHA1 7e0159f3ef85533348e8c1cb1dd8829100f24484
SHA512 3215cdd9bead2a93073e4360fd8f465717fcb5cc0dc9637aa9ccebab412958eda282cb7d9c02193dcd0694d57642ad167638bc54ea420ef029b786a95072c753
SSDEEP 12288:w0cDhxvyTA8EFOFnvqjKuPgiYdI8kd3pLAMK0VL5FqHfWSD:w0cD3vyTvJeIdI53pc/0XAHfWSD
TLSH
T1E3D4238BEC47C4E5FBBAE970D81673DF5BBC722839980A348FF481457625960242AF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 8fb7715eaf5f88010f14b849acb0057ce16a6cc1dc393e0346aa38cc2023c7e3
MD5 692206c34bf6d1faf029a3948b9f0d0a
SHA1 c4e8cc3602c9bb02ffe5af0c017e58f49d34fd1f
SHA512 ced5f1277bd0d2d6e781552620b1b530495e3cafaa576ea222ae86c4219ba4e77920b270d39ea39e5ef3d6a1d0bcddf7d67321eadaef3daa6d2a964e2f221b68
SSDEEP 12288:4ecDhxvyTA8EFOFnvqjKuPgiYdI8kd3pLAMK0VL5FqHfWSD:4ecD3vyTvJeIdI53pc/0XAHfWSD
TLSH
T147D4238FEC46C4E6FBBED970D816639F5BBC732839980A348FF485417625920242AF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 603KB
SHA256 870415f3b367d4c650e44588418b6d815341f0d89a067489130532f529a29621
MD5 a411139d360dc6e27137b13c75426464
SHA1 96eb3b516bc59b9123faeaa29e432d8f9b1a04d9
SHA512 df8662cd1b58aa358dd3be92fdec2a99f87850542fedfc928c5b968b1e50502472582499fcf6c0ea4c0880a14e35b628e67da358ca18d10d9e951182c2bf0eff
SSDEEP 12288:JmcDhxvyTA8EFOFnvqjKuPgiYdI8kd3pLAMK0VL5FqHfWSD:JmcD3vyTvJeIdI53pc/0XAHfWSD
TLSH
T172D4238FE847C4E5FBBED970D91663DF4BBC722839980A348FF481457A25920242AF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 603KB
SHA256 2240687d247f720d38029e1a5226a44d929fd404bd1bf21bd15f9e40eb492000
MD5 058e17563ddf85cb7f556e68ff624e38
SHA1 4861c4fe68d3193f4ba32c86ce4a95515e237d76
SHA512 0905d6909de77e68315ff96e996d0a20beae6ec67eef5218ec8ad96134cdecfbcd49e28cb57aa3965cfa6400f600a7f2315510bfdc4051091138493a87fc20ca
SSDEEP 12288:KNcDhxvyTA8EFOFnvqjKuPgiYdI8kd3pLAMK0VL5FqHfWSD:KNcD3vyTvJeIdI53pc/0XAHfWSD
TLSH
T1DBD4238FE847C4E5FBBED970D91673DF4BBC722839980A248FF481457A25920242AF5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 67853f273ff22470b1284f832926078eb5befd96ef54d8691d3542bd96bea4b3
MD5 d1964db93d1ecc0a97c64ccde609dde4
SHA1 3af391a4dad6bc5bed756da00e9a2b2f84176c1d
SHA512 c04b8379b303759851ca2ba8581c054ffa32040007a9984f84b06e7cc29ddc35231b57dbd95e8cd3537e98e51359da2fed6d96511937c3cec9b112f0db43f49e
SSDEEP 12288:jl9fegoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:neJTpqHvDLLv9VbNNDQUFjc1y
TLSH
T15EF4011AE29402E9D59E1276C74A4A45F3377CA297E1D3CB16D0F83E0F362502EDAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 71ff84078086d88e5906396d88265796b5973fd3076748689bfaafb9f4fa63cb
MD5 05e47deb51aa2688b3516ecaed9e80f7
SHA1 ac5a771aed555b4837ceb4aaa57d944aa6d37b43
SHA512 b3735f488b27f7c872dd9fc54918f0962e76ff12f3d779a633807b306e7754d016a1956e523087271a0885788ed89bf3e39da74f83809d4baf6d0fb81072238a
SSDEEP 12288:RU77oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:eUTpqHvDLLv9VbNNDQUFjc1y
TLSH
T12DD42317F6449DCAFF990273114D462AB73CF9F22FC0D58718152CBA8B306652AA3A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4eb49ce3a5aa1c8fdab31b50f2e014d61256f3a784bdadb742cd8e7aafa234c3
MD5 0cf398dfeadf918f4fcdd3af2d448d92
SHA1 238c3d3a3b39bd67a03da6a26e42c2e640bfb11d
SHA512 a35b793e5c786e3d3346f729c326c40cefd37b26fa22faecc12653c2e95bdd977678a4dc6402ff73dfbd5ccacc2256160aedf46b32e5e1e0faac470fab0dae04
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bY95TpqHvDLLv9VbNNDQUFjc1y:sgb4mBIBhGFK5TpMvDLLzxNDQUJc1
TLSH
T1A765AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 205dc6fe9f142dec271609af15269b9c661fa370dc4fb42c73e0a66eedce58e9
MD5 e1168e1016d23797772ad28b913ce92c
SHA1 cf400333550514d33efdb524fbee228e526a991a
SHA512 b7ba6f710c107c8b8d7e734bc7117f112a3a89bbb9c68d133ceb4c905ca433f32be1050c0fa01ac94368f28ef1eb558f88279f7c99253ea684edb1b9629a6dff
SSDEEP 12288:w2GnoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:bGoTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1F9E4232EB5A174DCDA7943370469062BFA7474F12B5065EF0CA0A87ACF316F13636DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 493716362197763fadb044525a8b0e1bde5413f23bdc509b030091442b3c30b5
MD5 b3c09efc0c6570e71ee9e1395a0bef19
SHA1 4db0b6246094155f420ebfb0bd9e2e7b0785aaf5
SHA512 ea6a0b7810296d64f5932d955f7e4b57128096ea3779d000781d9725cde937c48d7bac179a07f311599723341ad3c3d9e9705289a6cee6654d055bf9e41aa903
SSDEEP 12288:vwoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:vZTpqHvDLLv9VbNNDQUFjc1y
TLSH
T10AD4231AF540A9CEFF89067311490A1AB77CE8F22BC595C708253C7A8B355F62673DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6f4927dd3f574e6a72b5b3fa314dbb295df167253b383c6c79dd3772f7ce6168
MD5 7a4cf2f12bd3ac45e10c40182935b143
SHA1 efc1634075b9e623fbda17618e7543df6ed140ed
SHA512 f478ec35de841c542222f814a8159218c04b632bd67e43d4b9795b5b27949e588fbd8b0bbe11d982cee50dc153ad4ada1e2b22d12c5f9d97d9ae3e7691203382
SSDEEP 24576:NPq8u8FpJqH1J0riA7/m2TpqHvDLLv9VbNNDQUFjc1y:NZZFPqVLA7/BTpMvDLLzxNDQUJc1
TLSH
T179350125B6E001F5D47BD13889864667F6B1B8210364EFDF0BA88A551F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 752f72da546984fff1e795432ed3b6d5209fa6dab3582af661f59a17b2686805
MD5 59e9e41a1499e306f946daca52d846f2
SHA1 18eb9907759e4fb5a4e10147bc5222f2729bac83
SHA512 48e5fbcd4d681d7823d8e5a0cf259bdb6341da8a4f72f269de7f4ccd87ebdc5ef0ec19642840ec956b62c7993e7ed89486bc5f2c5a2eb7f8c16630fa3a7012e7
SSDEEP 12288:JHvUrBFrEjwaQ7oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:JPUr+NQUTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1C105F12F72A81CE5F67AA17D8586470DF771B4621751D2CF02A0817E4F23AE87D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8e51534b563d9342537414911062eed3a380f53e8b06fd9d7101094fdb8791bc
MD5 75ebbdf7bca5d164d2b65b86e042be24
SHA1 37dc06b443978a688fe46f6e90df25795be2a7cb
SHA512 d25fb20f8de9c5587b88238d71a82be33b3c7f365974d7418ab7b24d8439c8df09efa43d51ca3b9deb2e4b73f0fef5a79aef74cd3ae75d63ed398ac43b70e70b
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHTpMvDLLzxNDQUJc1:1G05lO43b3PPxNDQUJI
TLSH
T192D5CF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 3df5f43670c0ba409e74cceea56bfbf6041dd3170d1aa095a79f749bfb650fde
MD5 eb4f25ea7b43318f8dbf164d5e62947e
SHA1 e1bf86dc33bfd8fb8536549aa08c0199b2a6e8b0
SHA512 5dc2b86176dd989cc3949b424cc046c78b4025cb143edc6c5c486332bd91782bc51f35859f1dfc2c49aa0deb1c0898e5cef52cc864d0fd34176900de1d69a553
SSDEEP 24576:2ya5POZ3dpbWVM50JicR2hG0lasx2+47eidnkTpqHvDLLv9VbNNDQUFjc1y:/a5POZ3wJt2pasx2+mOTpMvDLLzxNDQp
TLSH
T17265BF5EA6F801D5E5B9D17DC583461AF5B1342253329BCF022182BE3F27EE85E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 971783d8dd089eb608967dc24d67fcd13ba9ae3090f7de9e8c45a7bec0311544
MD5 302c0baaedd6bd4cd25a978105ee25dc
SHA1 2f14c32c20d8da3244e867c650ac07f48a07b1c3
SHA512 0966d8b797a286e85ae073db9bacf30a716e0518f16b130ea60511570da582f6caef87278f303db23c918c91e61bbebcd71046d5dd5f60b1dbb5eb5669f119c8
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkPTpqHvDLLv9VbNNDQUFjc1y:qNc/zEOVHFkTpMvDLLzxNDQUJc1
TLSH
T128858C1623E901E4F5BBE1BE896B9546FA71786513308ACF0291851F1E73BF41C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 93fbb4499e252bb7a19a6e8739e816b7f6bce54040a105af1c2bdcbc564409f9
MD5 b5c5b5f1e42ad7d3a3b880ee7a6aa018
SHA1 19e695da14c737bd547ed2cd1387254345d903b0
SHA512 a2d4e9e65cc36b5f7797704eafe21a8075c5bbb03d30c947973e1ff8b52227405ea749063dfbe3cfc9532c4abbdc23400a67e4d731fc07b28a8f3dfcb7fc7094
SSDEEP 24576:AJnJPbzB4S5TpqHvDLLv9VbNNDQUFjc1y:AJnJv6S5TpMvDLLzxNDQUJc1
TLSH
T1AB15DF2DD2A810E8E4B7C2B4815A175AFF31387D2F2169CB19B4D4353F12EE06A79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 c69dc9c97d96ae8fd4d84a83535cb36eb8da694f8a6a62f82286daf744d3306d
MD5 f815c0d3f8330cd2f9bed3ee85c276dc
SHA1 4767deff4a74e6e67b6219e1e8c747e553cd87ff
SHA512 d837a6f640757ac8e661d26d866036ec4b6fd5d9f688bced0710a22304f52c27100734d84e84be65b21b7e8c85df99c49df8bdd523281b6b5a453e26627f8d7b
SSDEEP 49152:FCLHGeeV5ijCmlDWDkGTpMvDLLzxNDQUJc1:cZPPxNDQUJI
TLSH
T1F0A56B05E7EB5188E8F3CAF5CA2694169A327C509B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 c2ae8904738127ba82fec1b3bb5fef60b7eb15c11c7070b94d59b9518e634aa6
MD5 94aace280da583551c4afd4d048233ac
SHA1 b7e35f7009c23ea08184d97c3c884a376d272e26
SHA512 f3fc4de7237c922ccd305fc8e3729acc05451473827ec0909246b3aaf9b7a35bb46d19c8da3d2438f47ab647322972a4ad13d1eefe846b1b2368b120a1c26522
SSDEEP 12288:J1H6kgj5ZI7azoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:TgDIXTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1C605021D737610F9D16B903E82830506E2B1B4B197525ADF0A94C8BE8FB3EDC7939E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 eaf0bfb6e215fa3dbdc7e5ae99322f8ee50f6ae235acdd29e4b658f4f7bc9ab7
MD5 bd5f2967f92406f49c62a7498361f54a
SHA1 4e14c909877f6ccca7b28773ca8bd8c017a763fd
SHA512 9a40bc9097258d459ec4c66c279b9a29e5c5fa7fab198a485baf0cea6e2434728687e3ed55447b42386a2623763e8d61e0b2072488dd34e0bd6fc224bc619044
SSDEEP 12288:tG6kyIoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:UtyhTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1C2F41209A38064D9FBA902364A664265EF38BC706F5193DF09A0B93E5F317E53932F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 b0862760e7b2119290895fc255d9eb5877244229b6c798d7e3bc0672c366afdf
MD5 5e608f165aa320b184b62ceb78f6a61d
SHA1 d193973a7c4387b04cc279687166ee26ccd5811e
SHA512 690717bef229bc72f1f584bb5ec2cbc0b8dd3b34c69d04ba19e87211bfcc19257ca34a1344c4f816a7f00bddfe113957805aa24b18e031d10b27a6637f1559dd
SSDEEP 12288:7+ZoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:C+TpqHvDLLv9VbNNDQUFjc1y
TLSH
T1D7D4231EB550A9CAEE880677010D071AF378B8F22F9565DF0C656C7ACB312E62672D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 81d1a7536cc8a58d2973f4ef91d675601065c765fc2009ef71f3d229028d6be3
MD5 f8f2bfa541593fcbb5d858bd5d4b2034
SHA1 2a11899113ac91dfa14a0eaabeb7574aefe1b880
SHA512 8556a702589ec9b1f1fd7589c7e179c149425fe7812861606621333c4cec10ac6a4312220eac681f38f9898bbcc041fa55b0ac1cad351d7b89dd8be06021e754
SSDEEP 24576:W6gv+VoTfaidZJTpqHvDLLv9VbNNDQUFjc1y:5gm+TrZJTpMvDLLzxNDQUJc1
TLSH
T1DF559D1DB7EA05CAE2B2D275D8621493D633B4315772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 b1c7f5fe8bf4d586e321bba1708647b3f0632d215c70456ead68749a25f4e1b1
MD5 e96bdd9f5276c787a33d1060403e2699
SHA1 c609e812238a29fad91aad2e0dc7166f08b107bb
SHA512 f30a0dc193b77479ddc7acfaf8b7d8947201a4ea8221cdaba75d79d7fadfde3ed44104c2d2defd711d67b4d57c2d71fce1caa07b7bc0df8b89024c26cba3169e
SSDEEP 12288:7pJcm8CNToNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:7rcmR8TpqHvDLLv9VbNNDQUFjc1y
TLSH
T11605010FB26A00E6E2B7813C88454616F7B3B471275267CF06A1CB7E4E279E93D35B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 91a4810f26927623e9e98fe67b4d185b06628a44ae86d8ac47bb3c77c252a13c
MD5 758ef5ed6e6be952d98f2fea410ed2a3
SHA1 a19b8120d98300eacf0d2427a3c4559b7c86222c
SHA512 073b8d66b68dbafe584b44bea45c03d0105e59126681e052fd7f1b54a386b63c803e384668e9e334d4f128fa2b6a32b5a1f97a8d687dcd6dcb53f3e4ea87de91
SSDEEP 49152:jDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS33TpMvDLLzxNDQUJc1:43Upow8sBLPPxNDQUJI
TLSH
T138A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-61-0x0000016812C20000-0x0000016812CEF000-memory.dmp

Download

memory/552-63-0x0000016812E10000-0x0000016812E76000-memory.dmp

Download

memory/552-62-0x0000016812E10000-0x0000016812E76000-memory.dmp

Download

memory/800-393-0x0000016D4B550000-0x0000016D4B5B6000-memory.dmp

Download

memory/800-396-0x00007FF635F70000-0x00007FF6362AF000-memory.dmp

Download

memory/800-455-0x00007FF635F70000-0x00007FF6362AF000-memory.dmp

Download

memory/800-395-0x0000016D4B550000-0x0000016D4B5B6000-memory.dmp

Download

memory/1224-454-0x00007FF7024D0000-0x00007FF7025FF000-memory.dmp

Download

memory/1224-384-0x00007FF7024D0000-0x00007FF7025FF000-memory.dmp

Download

memory/1224-385-0x0000014E90C40000-0x0000014E90CA6000-memory.dmp

Download

memory/1224-382-0x0000014E90C40000-0x0000014E90CA6000-memory.dmp

Download

memory/1276-315-0x00007FF7EDBB0000-0x00007FF7EDC79000-memory.dmp

Download

memory/1276-240-0x00000264ECE50000-0x00000264ECEB6000-memory.dmp

Download

memory/1276-238-0x00007FF7EDBB0000-0x00007FF7EDC79000-memory.dmp

Download

memory/1276-239-0x00000264ECE50000-0x00000264ECEB6000-memory.dmp

Download

memory/1876-42-0x000002C316610000-0x000002C316676000-memory.dmp

Download

memory/1876-43-0x000002C316610000-0x000002C316676000-memory.dmp

Download

memory/1876-41-0x000002C316610000-0x000002C316676000-memory.dmp

Download

memory/1876-40-0x000002C316420000-0x000002C3164EF000-memory.dmp

Download

memory/2008-33-0x00000255C00F0000-0x00000255C0156000-memory.dmp

Download

memory/2008-34-0x00000255C00F0000-0x00000255C0156000-memory.dmp

Download

memory/2008-32-0x00000255C00F0000-0x00000255C0156000-memory.dmp

Download

memory/2008-31-0x00000255BFF50000-0x00000255C001F000-memory.dmp

Download

memory/2572-15-0x00007FF666E30000-0x00007FF666F53000-memory.dmp

Download

memory/2572-16-0x00000265D14C0000-0x00000265D1526000-memory.dmp

Download

memory/2572-17-0x00000265D14C0000-0x00000265D1526000-memory.dmp

Download

memory/2572-73-0x00007FF666E30000-0x00007FF666F53000-memory.dmp

Download

memory/2572-18-0x00000265D14C0000-0x00000265D1526000-memory.dmp

Download

memory/2576-325-0x00007FF7EDBB0000-0x00007FF7EDC79000-memory.dmp

Download

memory/2576-249-0x00000148BE830000-0x00000148BE896000-memory.dmp

Download

memory/2576-248-0x00000148BE830000-0x00000148BE896000-memory.dmp

Download

memory/2576-247-0x00007FF7EDBB0000-0x00007FF7EDC79000-memory.dmp

Download

memory/2944-394-0x00007FF730960000-0x00007FF730C03000-memory.dmp

Download

memory/2944-327-0x0000021AB4400000-0x0000021AB4466000-memory.dmp

Download

memory/2944-326-0x00007FF730960000-0x00007FF730C03000-memory.dmp

Download

memory/2944-328-0x0000021AB4400000-0x0000021AB4466000-memory.dmp

Download

memory/3240-307-0x00000223495B0000-0x0000022349616000-memory.dmp

Download

memory/3240-305-0x00000223495B0000-0x0000022349616000-memory.dmp

Download

memory/3240-450-0x00007FF6F5AB0000-0x00007FF6F5EC7000-memory.dmp

Download

memory/3240-448-0x00000223495B0000-0x0000022349616000-memory.dmp

Download

memory/3240-383-0x00007FF6F5AB0000-0x00007FF6F5EC7000-memory.dmp

Download

memory/3240-306-0x00007FF6F5AB0000-0x00007FF6F5EC7000-memory.dmp

Download

memory/3752-372-0x00007FF69FC60000-0x00007FF69FD0E000-memory.dmp

Download

memory/3752-296-0x00007FF69FC60000-0x00007FF69FD0E000-memory.dmp

Download

memory/3752-297-0x000002609C3E0000-0x000002609C446000-memory.dmp

Download

memory/3752-298-0x000002609C3E0000-0x000002609C446000-memory.dmp

Download

memory/4008-375-0x00000235D2770000-0x00000235D27D6000-memory.dmp

Download

memory/4008-373-0x00000235D2770000-0x00000235D27D6000-memory.dmp

Download

memory/4008-453-0x00007FF7DB760000-0x00007FF7DBC67000-memory.dmp

Download

memory/4008-374-0x00007FF7DB760000-0x00007FF7DBC67000-memory.dmp

Download

memory/4564-58-0x00007FF7D7980000-0x00007FF7D7AE8000-memory.dmp

Download

memory/4564-56-0x000001BF8D950000-0x000001BF8D9B6000-memory.dmp

Download

memory/4564-49-0x00007FF7D7980000-0x00007FF7D7AE8000-memory.dmp

Download

memory/4564-50-0x000001BF8D950000-0x000001BF8D9B6000-memory.dmp

Download

memory/4564-51-0x000001BF8D950000-0x000001BF8D9B6000-memory.dmp

Download

memory/4604-28-0x0000000000E00000-0x0000000000FDD000-memory.dmp

Download

memory/4604-0-0x0000000000E00000-0x0000000000FDD000-memory.dmp

Download

memory/4604-6-0x0000000002DE0000-0x0000000002E49000-memory.dmp

Download

memory/4604-7-0x0000000002DE0000-0x0000000002E49000-memory.dmp

Download

memory/4604-1-0x0000000002DE0000-0x0000000002E49000-memory.dmp

Download

memory/4640-343-0x00007FF6D8850000-0x00007FF6D899A000-memory.dmp

Download

memory/4640-267-0x000002BD877F0000-0x000002BD87856000-memory.dmp

Download

memory/4640-264-0x00007FF6D8850000-0x00007FF6D899A000-memory.dmp

Download

memory/4640-266-0x000002BD877F0000-0x000002BD87856000-memory.dmp

Download

memory/4892-452-0x00007FF68F230000-0x00007FF68F701000-memory.dmp

Download

memory/4892-365-0x000001EA36120000-0x000001EA36186000-memory.dmp

Download

memory/4892-364-0x000001EA36120000-0x000001EA36186000-memory.dmp

Download

memory/4892-363-0x00007FF68F230000-0x00007FF68F701000-memory.dmp

Download

memory/4980-359-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4980-276-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4980-282-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/4980-277-0x00000000008F0000-0x0000000000959000-memory.dmp

Download

memory/5328-317-0x0000025E32C30000-0x0000025E32C96000-memory.dmp

Download

memory/5328-390-0x00007FF78FA40000-0x00007FF78FAF4000-memory.dmp

Download

memory/5328-316-0x00007FF78FA40000-0x00007FF78FAF4000-memory.dmp

Download

memory/5328-318-0x0000025E32C30000-0x0000025E32C96000-memory.dmp

Download

memory/5496-370-0x00007FF6791F0000-0x00007FF679934000-memory.dmp

Download

memory/5496-288-0x0000024DEAFE0000-0x0000024DEB046000-memory.dmp

Download

memory/5496-289-0x0000024DEAFE0000-0x0000024DEB046000-memory.dmp

Download

memory/5496-294-0x00007FF6791F0000-0x00007FF679934000-memory.dmp

Download

memory/5564-358-0x00007FF66DF20000-0x00007FF66E241000-memory.dmp

Download

memory/5564-412-0x00007FF66DF20000-0x00007FF66E241000-memory.dmp

Download

memory/5564-349-0x000001FF3FC20000-0x000001FF3FC86000-memory.dmp

Download

memory/5564-345-0x000001FF3FC20000-0x000001FF3FC86000-memory.dmp

Download

memory/5564-344-0x000001FF3FC20000-0x000001FF3FC86000-memory.dmp

Download

memory/5952-335-0x00007FF6459A0000-0x00007FF645B35000-memory.dmp

Download

memory/5952-336-0x000002BB8BD80000-0x000002BB8BDE6000-memory.dmp

Download

memory/5952-337-0x000002BB8BD80000-0x000002BB8BDE6000-memory.dmp

Download

memory/5952-411-0x00007FF6459A0000-0x00007FF645B35000-memory.dmp

Download

memory/5980-354-0x0000021089BC0000-0x0000021089C26000-memory.dmp

Download

memory/5980-353-0x0000021089BC0000-0x0000021089C26000-memory.dmp

Download

memory/5980-360-0x00007FF7CA4A0000-0x00007FF7CA72B000-memory.dmp

Download

memory/5980-451-0x00007FF7CA4A0000-0x00007FF7CA72B000-memory.dmp

Download

memory/6124-334-0x00007FF6450D0000-0x00007FF6451EA000-memory.dmp

Download

memory/6124-257-0x000001E782570000-0x000001E7825D6000-memory.dmp

Download

memory/6124-256-0x000001E782570000-0x000001E7825D6000-memory.dmp

Download

memory/6124-255-0x00007FF6450D0000-0x00007FF6451EA000-memory.dmp

Download