321a47113386ea379d9fa1c770d1795a978a4dff99e11f21550a9f30e79b061c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
Size 877KB
Sample260721-ddntmads2j
SHA256 321a47113386ea379d9fa1c770d1795a978a4dff99e11f21550a9f30e79b061c
MD5 10a62d839f7f53960d4fd6fcaf3890cb
SHA1 f2aba75f2acf9da23b5ca3e6ade8a6c4dfa79cc6
SHA512 f404bcabbd60c0114228053626cae865b24a4a945947a565d88869d82f4a445059994b3938129bd786f079ebe9f51b17cff736dffacfa13fb2259f9f470b4a62
SSDEEP 12288:umyquiN/HbZ57sqQgc7Nvzy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:1v/Hb/xc7ZyRW+HcitzVYb9
TLSH
T18E15F02177E08071F17719719A369B324DBFBC6A9972C48E63D87A181E32BC1D934B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2212	alg.exe
4144	GameInputSvc.exe
4716	GameInputSvc.exe
4468	elevation_service.exe
1488	elevation_service.exe
1036	maintenanceservice.exe
5924	msdtc.exe
2736	OSE.EXE
2580	PerceptionSimulationService.exe
5168	perfhost.exe
2568	ReFsDedupSvc.exe
5588	locator.exe
756	SensorDataService.exe
2908	snmptrap.exe
2832	ssh-agent.exe
4180	TieringEngineService.exe
2536	AgentService.exe
2924	vds.exe
2796	vssvc.exe
2652	wbengine.exe
4960	WmiApSrv.exe
4452	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\26fb58508f8562d1.bin	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bc27fe3ebc18dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1f2913cbc18dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002999a63dbc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007f9f1a3ebc18dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4716	GameInputSvc.exe
4716	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4128	2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
Token: SeTcbPrivilege	4144	GameInputSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4180	TieringEngineService.exe
Token: SeManageVolumePrivilege	4180	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2536	AgentService.exe
Token: SeBackupPrivilege	2796	vssvc.exe
Token: SeRestorePrivilege	2796	vssvc.exe
Token: SeAuditPrivilege	2796	vssvc.exe
Token: SeBackupPrivilege	2652	wbengine.exe
Token: SeRestorePrivilege	2652	wbengine.exe
Token: SeSecurityPrivilege	2652	wbengine.exe
Token: 33	4452	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4452	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4452	SearchIndexer.exe
Token: SeDebugPrivilege	2212	alg.exe
Token: SeDebugPrivilege	2212	alg.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4716	4144	GameInputSvc.exe	90
PID 4452 wrote to memory of 5232	4452	SearchIndexer.exe	111
PID 4452 wrote to memory of 5288	4452	SearchIndexer.exe	112
PID 4452 wrote to memory of 5240	4452	SearchIndexer.exe	114
PID 4452 wrote to memory of 4072	4452	SearchIndexer.exe	115
PID 4452 wrote to memory of 1396	4452	SearchIndexer.exe	118
PID 4452 wrote to memory of 3736	4452	SearchIndexer.exe	119
PID 4452 wrote to memory of 1672	4452	SearchIndexer.exe	120

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_10a62d839f7f53960d4fd6fcaf3890cb_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1488

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1036

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2736

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5168

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2796

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1776 1764 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1648 1656 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1648 1656 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1776 1764 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 081160ddd85ae8b062fc40b084377443b90c0fcdf133bebc0e0bb2141d71de35
MD5 1377653db05fc77f9b4c71cc4366fd60
SHA1 4958137e6792891d4862bae5e9d3c5f6f0c6eec3
SHA512 69b03a04c5f0a9d6c5cbbc70600d7c1f7011e6adb2b5d0409131fd2b08eecb85d910ea61b53286db4cdb6f31a2ab9368561141ef865061004bd385930b5c6d20
SSDEEP 49152:4cz632BuPkFKRrdE6oh7stBhuXjfS4LWxnRoOrzV+:+3q6gjB/O
TLSH
T154D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 2392bd2a5eb07a1b6f9d207f1ffbd506bd2a31fb34f5d51c7cae1eb684614858
MD5 c196c1b6a770a001680468a37d3a5cf5
SHA1 0760f46b827e6439e8f0b29e8d79576912b92582
SHA512 dc46844d524b5249ca3dd0de71a90d5089bb9e0d5eb21297b0e0fe556f2d3209dd0379ecc2d42ae63db3ee4ff60c9c27fbe3412c50b97c48383d4adf72fc3aa9
SSDEEP 12288:P1XLsis8kxgC81flczAqy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:tXYpZcczAqyRW+HcitzVYb9
TLSH
T13005011977E009F9EC678178CCA28512DB73BC458764E79B03E49A251F233D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4aa4054310ab3c041c26c022ad765149681a47441944de5b43160edfff3c1c3e
MD5 7c53ded300b64e14e92e0f9ff6a45a59
SHA1 f94018cd13ba58a4cf5ce5922cddcab05cfc43cd
SHA512 2ecc19410213a2cb184d7d1dba1d8b3093e551fbf870f518c353ee4b19d31e2e67deb581675cad2eb69001e44eaf6e2569d778aa0415707351834d9479fb4db5
SSDEEP 24576:v0SeXOb0hmxOrMRuKjyQsJ7ykNU8UXls+jlco:vuOb0AonUAwkuVvlco
TLSH
T1B045AE26F6748731D073D0B9C5D2A68AE97230825B308ACB4286D77C7F676E6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 420acfb07fd3c04ef4f07f58fe6b115f101748013cbfa082d83fb7971718b452
MD5 f26d5b934ea5b4acd24807fbb41cd40c
SHA1 1c1f8b53265759156e7267e48424d55aeefaa963
SHA512 a4c1549d49370b136785c1c8dc7ce2e4a7770480af6a75abbba302414a8523db20cbaad1bbc725e4a71508c55b52b7af4ddc5e16bcfdc1078e764faef88f0b55
SSDEEP 24576:8Vz/ezSC6vUyD/aqgrvW/6q8wyuhVuKjyQsJ7ykNU8UXls+jlco:Q/ezSC6vUzPvuHjyyMUAwkuVvlco
TLSH
T147756D25F5788323D0B2D0BAC5D6BA9AFE323046573089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 517e25b830521bd8e1e36279e029cce23d02c2f9f33d66e32a7aacfb91d26fa9
MD5 3e78e510191b792e9c6c3ab581ffb0b7
SHA1 71e82d59162895a90e40816ffdcf9d67bf84622b
SHA512 0d3d2091e540df937ca16681536843fcb9db57f25d9d4f03de8447104ec05b260eda4a8ee5d95ba01e7a90a0393b670f12e591ea612a055fb8e57b4c17ab3f5d
SSDEEP 24576:5abmPrHtov/l+dNuKjyQsJ7ykNU8UXls+jlco:5a2HtoXl+SUAwkuVvlco
TLSH
T115559D66F5748331D073D0BAC4D3AA9AEE3234425B318ACB024AD72C3E676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 f643b2e06e0365ca6fd1c71db43e58d076b4dcf8d907964d9459012d28836bdc
MD5 5534e99ef9426c52bb93709b5907c29c
SHA1 5015d6c4e4a8eda7540c2bdef82eeed7c529c355
SHA512 4e3b38184fc86f351cf783c99bc59912a2687fa7c409ac6db0093e761529c9b507e4db598f7bf10cf9e19d2415d637c7ba8f5bee46466c360773ef9d52862fc4
SSDEEP 12288:Az3BMKjyQiCKZHJqZYyksE36lJ8jx5Uh5vXRdZrJs+CGqd+lcAJP:Az3uKjyQsJ7ykNU8UXls+jlco
TLSH
T117D42362C8755854E9F138B1B94FFF97B532DE35E5E05B7F43182B3EAA36042E1A0142
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 dbd93101d58acd2bdf0abfc6a13556b44d58222b64059af5b52f5cbf86156d60
MD5 76c3a75d86ca67ba7a756712fd598552
SHA1 c2f0f9d8ce8401c66ed2cb9e962ec035cb58e069
SHA512 e91e9a12b90e317a04c0b1e16b444614909c49674960977f074fe067ff6e53d5cfeda38adf04cc771a58b40a6b2bd3bdf86cf4dcb3d920dddafe1fbbb11b882c
SSDEEP 12288:seBNUbTVO86UjBMKjyQiCKZHJqZYyksE36lJ8jx5Uh5vXRdZrJs+CGqd+lcAJP:sJIUjuKjyQsJ7ykNU8UXls+jlco
TLSH
T16915CF7BEE38ECD2C27A9DB85A91C740E77278308B61A3CBD264830EDE235D15E75815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 8ab9f33bb68f5994b024754300090f72720b4f22f7d7b7042de24131272b782c
MD5 5e5d84ffd6dda491dd78c161f5371b48
SHA1 b983a4fa64943d3baf1bab43b173767078769437
SHA512 1fff808a1958e6e4bbab337efa8ac28dce3ff383b96aa23c327a3ed89b972240b439fb8d7874006e9fdbb49726f18a8c58c74f5f1e3d3645617b7183c40eddff
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJd9DN5JqNRV3THF:nQvGAdlCEL8c/dRNO5C/WNR
TLSH
T18F366C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 fe847ffcf56951be68c8ccf38725bf4a2b8effcfdf7d784c7a7e2b5c6f61a39f
MD5 1c85514df1ada20fca5fae760573a961
SHA1 c158ca64df364381a69bce91a3c406e23d352f28
SHA512 434b121adaf1ef3149f519942157073b91b7aab3d3e82c8c7e0c9d6c43dc8443f805824bf35da3ac9a7362dbafab4abc2c605b6093a5971b4f382f3a971928b7
SSDEEP 12288:mxwSfxL/2Dc3bDLLmt0LDQewsAjx9BMKjyQiCKZHJqZYyksE36lJ8jx5Uh5vXRdl:emewsAjvuKjyQsJ7ykNU8UXls+jlco
TLSH
T1FD15F131FE74E436C6BB1CB22B26D716543DB9208FA11AC7E3E84E9D59301C26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 320cf6f88683a4b9c811833fe1a8ee9ca8623952baa11d88119b54b15031abe4
MD5 c85f0fb5cfdb9b8d9a870855a72ce1dc
SHA1 48756cb044d135a1d545e684084db90bf5a23c16
SHA512 3135b5a38a4af626c1b7bbc4c735979db6d40318ef90de9fe5a6caa809945bbf9b843412dfbe9dca30264798c54b545faf4310923736766336f099a7c63fece6
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHm:HUEtQevvqc2W1cpV2XF32
TLSH
T1AF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f4dca8228144694ec68cffb73dba7813b51a3fcf931b46e740119858ea7e6b47
MD5 9ba3fdff3acb2181b8d6e31c4ba3f910
SHA1 a0b3df4cf6749af74260e1a95fcfdf9c0a8559f2
SHA512 d48a6b1db2c0134dd46fa314c88b5cfc79b499eb207645d48bb3848f6e640b150a65081a693c4a41de7ea9b1d76d5e75f17ee2ecbae702a7c5432c513370b765
SSDEEP 49152:G2bRquA/m2yL5zMfFiV+XenmE3/zmUAwkuVvlco:Xoq1VjnmTWNR
TLSH
T182D58D0976B8C1E4D1F6C77896A2CA47F37178158B30A7EF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d3819f01be954553f6d956ec0517cac4acca27b512290ec7232daf3383bbef0d
MD5 a3ec439dc86338d5db4d370a0d63a900
SHA1 77c9c9b6d85da528ac14dd3cbb940e868b3b945b
SHA512 cb1544313fe0e3523a686aa3c4943019f2e84a3dd744b930dfc01ee7ed3a89e1e30a34d5c2836a2c41be14929bcb6b3c14dffe0c96a292cab1082dc64e1eaf67
SSDEEP 24576:RAhGLvdFoiwtA5l7S53byRW+HcitzVYb9:RAMpFoiq52oOrzV+
TLSH
T1A145AE81EBF945D4F5B3AAB899B68571EA76BCA95E31C20F2250D11F0E33E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 68c554dd695d96217bf0b8e87793ed359acb028b4450fefaa34f51abf97e7dc6
MD5 9216a1169e2b17105202801a8a2a4db1
SHA1 d4fc7aa6c79cdcecfea67021154c1429257c9b9c
SHA512 08ce47d881369dd8b82b45c4cc73a278e7ce78de0829be51d067d1f6037212b352829d576f93bbb178fd825874fe674b93feb06edcdfe608e7fd07942d0fafe8
SSDEEP 12288:Vmw5HEjsChNXBFgl0WDm+CGy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:QwuuOWVyRW+HcitzVYb9
TLSH
T1AE05F14A77B40CF9E9A79139C597C532E7F2BC012A25DB1F0360C65A6F33261BD2A760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 2a8cc3bc3a909b726fbb6914fd1f8fade9504b893c117f92bfd2b68f21c6fbeb
MD5 3496b3af8acf313d5ef8aaa2e865e5fa
SHA1 57e806b1f70b5b0129f38a57afcd94a0d643c35e
SHA512 6ff5c2017a56fb931a7f20d069c33b62a56b089145d09a2d28dcc7f9e13aa057247a66ac1ada007c414c1025a2c93af32a897be1ff89c53f521685ac4771ae43
SSDEEP 12288:ppY1Id5y2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:TYuXyRW+HcitzVYb9
TLSH
T151E4128B3BB421F5E1975178D9E24A43C7B1BC86E77583CF136842681F23AC66E35362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 84baa7d4b886bc7dd1c24a9ee86ec0986c93bb0f364af3d4ca8936a4ecca9896
MD5 d856d201461e8af5f2cd3d79ab5c3a6f
SHA1 ce98e0c2abe6ab0627a8405855c4104510a63753
SHA512 f34a3d589748fd6a7b95c5dd62736d100c8de10f49e54dfd8ba81967cc78eb844cb8d7eae84330b0e66088da1998011015f9ae9a4a94569dc9683122ce387572
SSDEEP 49152:04Qdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Us:qQRQyi36YOcP8Lvw2gAf+PN3eO
TLSH
T1B9667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 74e8c508a781a70963b3634f96ec2f9734f2ce82d7c0305141c41fc38b542a16
MD5 2a0e668c211c2b351fe183f1b3a2378d
SHA1 1f3aa4ab8be908dc6172d412fa5846bb349de652
SHA512 c6436a6b3b43bac38e91c62d61a2a31d6c4e0f242dc2e5bec9567838f89ec1554b7fe1e7ce526f6a50240cfd104e08a5d507ce400424b3f2c8735227c1d0e5cb
SSDEEP 49152:04Qdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uf:qQRQyi36YOcP8Lvw2gAf+PN3rO
TLSH
T16C667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5ab2d1e412a4933853bce412635cee806adab08715f67ba0b978ca14958a3ac8
MD5 bd2792b3a7e85b5c0c0595c33246ed69
SHA1 949ed57107e348582ff2a593ac58012be90d665a
SHA512 944ecdb3dc7f77e9f193e868d5fc573df8ac4e516890d903de1cb5460702a04262ddd7b9a19a1281093414eb0042a409759cddcc39b8cb429b75fca25dc0b57b
SSDEEP 24576:xwvqRf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0byRW+HcitzVYb9:T68Qg55nhMeWu7PNU3/ToOrzV+
TLSH
T135B55A33B2F200A9C44DE1769F4A872296D17C75CFE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d2c9916aa18d1ddc6cb378568c84b440a43429f3adf7bc92053d0b5b4b08fc48
MD5 b798fc96046c9fecfad6bdfeca2f2e53
SHA1 f42f734ac7e309028dabdfc1aaf12e317a826a38
SHA512 4c4b6e7b0282d0a1641f868272c9a8307ca784eff8629ff453ec70ce7ce5cbebf372e6239cbf2fa1f0dd52ec1907a18676d8006c0289e344467ac8fc0d7d4560
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99z:fy5112gYy5azzVv569nLKnhZ4O
TLSH
T189167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c8c33b67efc47cda2147e61587cc4b4688a942c793053d0fd1b950e7571a6790
MD5 144682eea1c7bbb441c4551080c0e072
SHA1 7f57fac35193aafaebc9b738fe4471af9a6819e8
SHA512 fd3c2214a399160ebeb98151f3ac6f0012b38d94c907f2c593dcdd27af3f3d0ecfe0b995a55d8f1cc5abc7965644e633cad11d517d0efcc74e319437eef57318
SSDEEP 49152:Le+taZ3usBWOBr4tEGp0bqx0z+n217aau1glEoOrzV+:au6JmTxd2ddO
TLSH
T1CDD59D13F2D901E8D06ED478974A9233EA62BC494B34B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1059bdd01099bbfb0bc291407afb8d79c7a61d96eed6f0f3978c8a939a60eda5
MD5 fda076b1ea0a032aa8aca4b1f4439874
SHA1 e534d6cb5f16231bf8119e19a015e627cd4bc985
SHA512 9c5b69260017ab1a013f3a76ece5c8c4b1d01c9ac7f5f706b88771b1dc6a59071d1635c14754ad4a46ef57ee2f0100a594292ab70ae686ea53036f20300733f1
SSDEEP 24576:ThvME1hps0+ogd2z615uCMVF1Agz6LUQ1zNOgLLwH7ReaQXx3hyRW+HcitzVYb9:t1hpsNoJpF1A6UU44CwH7R4xQoOrzV+
TLSH
T11CB5BE13F2D801E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8145bcbdf434bfc3b8921415d04d70312144e1055ad1dc123f4d9b1505ad9aba
MD5 934c71c7e0d397b1125abb772cf80a33
SHA1 457d31360154a5c10659e59a00baad7d58013c8e
SHA512 c2189b32ce076ab48fc57e7ccabde201d5fbbe0e89a80a5eb257cb0e7efe9eb668c2bfe403772c7bf59bf9a88641c0d1d8aa706955e06954b4590524a701682c
SSDEEP 49152:3SuZQIY0Be2K6RVtOnks6NMHqHoOrzV+:t5dKoi61IO
TLSH
T114C5BE03F2E941E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d55cb310bb916a0f6f0eab5d90493a1d0c7ba21866f3dd5439fc050b69657008
MD5 affadb87f5713b92092340f2d00c09e5
SHA1 1b2c0cf7b5375fdabfc0e09e9ef5e1a037047c1b
SHA512 7b2c3921a22d7cc8789893f19d6d8b3b65b28f02a58ad87fe24344bca120b09f215f7cb9e8eb73adbe192becd3eade825a1edf5ba34b5dd1353ef02d6b4c356d
SSDEEP 24576:gniavTPSLT8EARn+FgyUgd0fJY6BTi3iy9CTn0AP5+2QL9yRW+HcitzVYb9:gnZSn8EApI0figTgiDn0AP5wgoOrzV+
TLSH
T115A5BE13F2D901E8D05ED174C7468632EA62BC054B39AAEF0A90B7551F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 603KB
SHA256 574cadd78282dca5f76daa8afb825f2b66cbd1c0152b15f7232bcced6a937630
MD5 63c943dc87789dcbca24142a072e79df
SHA1 79fe176e66dca9d4c18488cfcb354863bbd4195e
SHA512 17a88cf4c48116bff8911caccabb644509bdacc2900672c926a51463584c68acb51bd08de7ad60b1745a302f470e34f8aa383e79b0582753d869abc0a77da254
SSDEEP 12288:+ky2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:+kyRW+HcitzVYb9
TLSH
T128D4238BAF308A95F40558F1F5930F83CBA8FE8DEB69E55F63AC52242B531C976011C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 603KB
SHA256 0a90740100137465fa134bf49ebe5a2ceaa6c8bad19a3689d4fd98798678b96d
MD5 10fe5fe029b6d7ac350abb6880764798
SHA1 1ce9810fd91ba223d9ac1dbc9c6e38f1175fdaf3
SHA512 b37d67708586e12f0ee88b5bb94ef868974e7e818dea30c9afb7f11f5ccae7ba8c106b0d1e08bc370dd505a8eb69b22c0610d8f326c9e2796e95750e8d9c5e23
SSDEEP 12288:cfy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:cfyRW+HcitzVYb9
TLSH
T1A4D4238BAF308A91F40558F1F5530F83CBA8FE8EEB69E55F63AC52242B531D976011C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 603KB
SHA256 989434a0e359002a6db7fa658152a3cf0b45e25a9f17aa3aef0c117ad06e7914
MD5 419b323ae0f7a4bc2f9a76dfae40b793
SHA1 c34e63911a2950cbd4ec98664141a2cfb165eb5b
SHA512 01de546e674def21c529d0b9123fd0f049630f4da723638c147fcbdf486bb4873ee98321a9f7b7685ef92c54db9b5418ab6ca65f84837fd22a8e3ba699b0ba93
SSDEEP 12288:ecy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:ecyRW+HcitzVYb9
TLSH
T1BDD4238BAF308A91F44458F1F5530F83CBA4FE8EEB69E55F63AC52206B531D976021C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 174a77afec029c760039f48f6ec1a56fad1b0ce076c679f8ca36650daa197178
MD5 eac9761656494f14becdfd25560e87e2
SHA1 781e2baefb77b8b5c70760a5540258cb10e8c526
SHA512 c62a2a711c3465d68acb7d1e41c78e03fb5f54fa4d3c32a8cf1eeb89c11398093c10d183f33cd33ef49f6fb7b067ba9eb74d9a16198abcceb8b5c3dd43bc91b4
SSDEEP 12288:Nlsy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:UyRW+HcitzVYb9
TLSH
T1F8D4238B6F7445D1F856E5F1E9A34A03C7B4FDC9EB39E65F535806280F63288BA112C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 603KB
SHA256 1f60edbd5fb26f5193055bd6009179715d9c73228778a0680526b91a58f1494d
MD5 04a76bde57c4e47deeaaaba7a5fd9d47
SHA1 814cdd1494d1d524e843f0640d96115c26886b0c
SHA512 3c621cf31746691f264094e9564e22c08a4a143cdabe31ffcc51a9c314fd1433d0361b1d878a36dbdad108148dc7e6d1fa8dd7cd5b966120eeaa4b3670713cee
SSDEEP 12288:FIy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:FIyRW+HcitzVYb9
TLSH
T1DBD4238BAF348A95F40468F1F5530F83CBA8FE8EEB69D55F639C12206B531D976021C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 603KB
SHA256 c7870476fa45521a162a2ea9b4bc6580b610c5c06b1447b68be4abb2b60bf6da
MD5 e2402fdb417a2c7b85eaa2de1b2af039
SHA1 e3227257b364329a72d6de97543f1765768bf4b4
SHA512 3e563afa486fd3ba89fbe9abd5b6d195ce29e6b41d0589c1ad46d8fb481e039b242e5fe479b72a731fb1eb841919b54cab894b1eb52e3d71c70b69d99eecd1a2
SSDEEP 12288:Gsy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:GsyRW+HcitzVYb9
TLSH
T1BAD4238BAF308A91F40568F1F5530F43CBA4FE8DEB68E55F63AC52246B531D97A011C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 603KB
SHA256 eefa285423d5aede26ed39357124956fbf61e3aac92e9f341c15c8cc935dcdfa
MD5 9d2d043d815de1691571b22ff44edcaa
SHA1 a7b80e37dd81042997d55fefa149d106509fe7a5
SHA512 94fb1245eb28a909b06d1bac16917ba142815e276af44bc3a085df4c33d0da25cf91b2f74130cf903cbfeb02f73276ed4bb650c7362e9f18d197c44825a4d8ae
SSDEEP 12288:Aty2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:AtyRW+HcitzVYb9
TLSH
T1ECD4338BAF308A95F40558F1F5530F83CBA8FE8EEB68D55F63AC42246B531D936021C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 1770c13664329b960de12e03706a6a6f342a9366f9ba02b85677f28c7d23c4f1
MD5 9c172e8d88daa701970383d603e79974
SHA1 56daa865ff52bdf471f2fca2142845e16972e911
SHA512 3575d7e9057ea411569793beae4a33bb72e5b0b8470e186b1d71a04a64cb4cbf2aee6977e72734fb0010cc944a1110703b5801874b8d45eb0b3608fffdcb5f8e
SSDEEP 24576:RZM+zaVSQnhKixY7IpO/xu8hiE/8MOgIin6:RZM+zEGn7uCudazOE6
TLSH
T1BA150295736018F8EC63823ECD269909D2F27C5A0AB0C61F17B836672F737511D2DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 603KB
SHA256 db605942de86992ceecfac1ae3a4b2b3f819b42e8473945b47474981fbded020
MD5 d1284d6f85eed37e66d654cef2deda44
SHA1 3d6e43289cf533e3a0a7c2cc788a578e3f130da8
SHA512 7c859db2baf888cf3822b362115a4a881572cc361f31a77ef90dc342d451b99274151b563ff339eb6908fee9445208391dcc125a212aef24b7551b2ca5398fab
SSDEEP 12288:UAhKszu/zvZNASUYe+KUIpe1/pLu8aaic7/QBnqyMOKh9o4EizWo6:UAhKixY7IpO/xu8hiE/8MOgIin6
TLSH
T1B7D423270A712269F2905339D83BA3CCD3F53D5BADE1D12EAE2C39A635B1D47611023E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 603KB
SHA256 24d70926dfd90f4c9cc98461bfd879a17792d1c11914746000f132b0efcc4db3
MD5 97045ab345810d400663b02312ee9155
SHA1 e332a4b65402b26b3ded6c4e89e98001cc72ecf0
SHA512 18a41208d8cf02a12fb0be696d9f56747ca4a70995c153fc009c0895efd88d3d92ce50c70a55ea263dac3bbf1caa55edc9bfe2c8715436ad6f52be17936c3c3c
SSDEEP 12288:uTKszu/zvZNASUYe+KUIpe1/pLu8aaic7/QBnqyMOKh9o4EizWo6:uTKixY7IpO/xu8hiE/8MOgIin6
TLSH
T14AD423271A612269F2505739D827E7CCD3F53D17AAE1D12EAF2C3AA635B1D47610033E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 2280ebb3b674038a0860dfe652fcf70445e2daefb4be1eee0c5fcdf6d42a3591
MD5 4c3c6b70ea8bde27c3abf3fa9bf635f5
SHA1 7eafc174ee3895fa21334be20f0d4b23f71c19f2
SHA512 093a369aa2b2101ffa93e97593a00841ac78e20999778b963d14eb2a820a775bd702b32dcdb8700ed6dc21de8bfd4f3c915e381db2b6569690604eaaecb13148
SSDEEP 12288:sFwvD5ue64Lk3tRX69qkyAI5Vy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:sFwvtk9RX6wkyAInyRW+HcitzVYb9
TLSH
T1E935D02AEFD844E5E0B7913C99B3460AF6B178595B31C6CF029A536D0E33ED46E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 bd4db4e01892d07eaa88d1460d3a684dca00bc5f7c93759b2a2b26960996c004
MD5 7547a09934f3ad3028e4ca421a5b8cb7
SHA1 fd333ccb7032b2ea8e65cbbef91ca36efcbe39fc
SHA512 10d5af3e4a0d34383b2c7b4be93c5fc175a71ee5e3b4db926aff31f331ddb104719b600d0360eaae6e9880cccaf5b0fa6c7e13c023de56f820fcbcfaa9a4131a
SSDEEP 49152:EYS5Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0IUAwkuVvlco:oySzPAWNR
TLSH
T1EF066C96A16801D5C1B9D1B98F0BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1425c31ec32e9b6933144057c9c9f0cb70b425f69ab723443573ad0dd020c9b4
MD5 5d5fbab15c07f036eab5a2135062494b
SHA1 0d9c4f8f47abafb7cd11dbd1f2946c000d798a54
SHA512 bf8fe09ed8e960c4ecd5ce9c7a2562b82d1070ce75ad41ac9288e3ee636e26889b686f98e64e31085fb040802f7867e3742b2a4492b1a939239079a1355849ff
SSDEEP 24576:JB7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYpYuKjyQsJ7ykNU8UXls+jlco:JB7JUQjXirIhCnDHUPfF/LUAwkuVvlco
TLSH
T1FF65BE1EA3EC01E5E1BA927885158A5AEA71742E5F31CACF1270437D6F23ED09F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 cc87cb2059b76f0c15e1109f37756e0c88b21f63ec6dfcdd8907d883b6161cea
MD5 b06d627ce616432fc191fddfcfdaa07c
SHA1 c45d6a03af5b8bd3232be8e56111067f82c0e37b
SHA512 bc5c90170b9ae96828b757f025b22218be9cbd94b90ce9772adc72a2544e8c7c25b79bf084dd86ec83a5f2b784e7bda65a7dee99ccf677b959229e55647d0b0c
SSDEEP 12288:/cOfwy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:ZwyRW+HcitzVYb9
TLSH
T175F4F04AD6A402E8D06E6175CB524A42B373BC59C7E1D3CB53D0F53D1F72290AEEA683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 41f7d77d70a720731a3a28de71effa6ebe721ffcc6caaaff2d5f208704e2174d
MD5 1b2a3e1e247e2b1a4bfaa78ac477c9e1
SHA1 5b85abb0ada9a1a1003ea5c008b565c717df54dc
SHA512 fff97194f5e1f5ab8413dd7d108b368da130936ba4c84067638d783aa340bee40e11bc7bc9038c80020f81d5391042c8f11e683333645b7d59a8f8e279ef8c76
SSDEEP 12288:Rc7Qy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:SQyRW+HcitzVYb9
TLSH
T1AFD423479F388E41F86969F0F4674A134B59FE88CF68D48BA35C13246B235C9BE212C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fffc694419e13ea54e6ffe4e7ae5b059445158b9d290bc9698480a9b14849a5e
MD5 6d515810edbcb6f49a7d5273ac258622
SHA1 0343bf9db0a5d95b6c3f4079bf8c1b92fe45bf20
SHA512 d94fcfd89adfb0a7e6a5856962dee9e040a49bb46513c3a9c4a9364aa8d926821fe82745bc354417eb5529cb6ea396b23ed1a1bd5de331d02a8f4e0889c86470
SSDEEP 24576:ngb6bmBIi49WNNFpg1rSvFv7bYYCuKjyQsJ7ykNU8UXls+jlco:ngb4mBIBhGFxUAwkuVvlco
TLSH
T19265AE1E22E801F5E0F9E2B8DDAA4417D6B278164731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 9ea948a83892a9a4f1877c08650f266afa46523afc5d4c7f760b20fdf56d36ef
MD5 69169a6d83a02d8d7d8c09d7b549bbeb
SHA1 98ba68a0667a17549559f6230cf225e28e54b21a
SHA512 233d84a93d79b3e95e86d57e37d388d2ed396e9c3a882206193e9409960047f8c491a4feacd463f8298c487b358b3edd449d3e10eb507da8a13d9a6103d8eb97
SSDEEP 12288:D1GWy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:xGWyRW+HcitzVYb9
TLSH
T11DE4234F2BB065D4D839C6B5E4634A53ABB0BD80DB28A5EF07E892348F235E07635DC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 25e0862bd1370f8f8a22f02987460055b01842e4cd776dd0a519fd8f99da9a2d
MD5 d1744de78962ca8d84680a71893b591c
SHA1 c8bde10a3a50ea35ad609988cd92c941a5f85d25
SHA512 6a761ea35647220bd333be0d56e9ebf26e993905d5cd4f82ff123671c8e232d5d2df470f04e1fb60182696961cef37bfec1ea8b87b3cc9f205e93ba549962e78
SSDEEP 12288:FNy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:FNyRW+HcitzVYb9
TLSH
T114D4338B6F348AC5F41568F1F4530E038B94FE88DBA8E5DF63AC52245B531DABA311C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4277ca228a46fa00ee74fbfe1045b9970310f69f24acbf75cb5219a421b87710
MD5 91fec2dc5d02f734483b0ed06534b56f
SHA1 ec32533353289ab44794d18f23d07e785f71334a
SHA512 8d2e54dadf50f3edae8993f2c6f6f1568f89bcccb1bb96b3adbbe2b499d32d5ee3137e2ba95b5e8991e40ac797e2b524e887fe79e38d122ee65cf749d7b0c5ac
SSDEEP 24576:A7+8u8FpJqH1PzrE87/mXyRW+HcitzVYb9:O9ZFPqVE87/FoOrzV+
TLSH
T11335F15677E002F1D47BD138C9824A63E6B2B8150364EBDF07AC8B551F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 5c9e01dcb9fa7b235ae6436f9d6b4539b8c2f829ec81125779eb63e9ce1afce6
MD5 d582d7c9fb79d6b4c37a9b9df1be7bba
SHA1 786e8caa0057c67f2c9bff776fe09bc6fe94f88c
SHA512 139aa72d43f6f35274422d789a2424c90d7344259fbb181aa17f7d50e10c0938968bb5673bcc89a964580db37b8d4066949119e837a1745cb7ae2b2fa083f03c
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjUoOrzV+:VG05lO43bqO
TLSH
T147D5CF6A62EC11F9D0BBD17CD9C64A0BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 0db44537823ace4c1f18114d356e3ae12360c7124cc2478464b6c89ce9a677fa
MD5 810dd613cc3d40694c2b82836093a020
SHA1 c3a8f7265654397797f48c5bcf501cb730fc9ab8
SHA512 27a72d2a8187e38f21cf0cd4607bc88c9abc40485671e2dcd242339333748b0aae908ae43c0c4b7a0e3e4d2c5c4759b40dbc319a0fe24d81e1229129d6323ca1
SSDEEP 24576:+Va5POZ3dpbWVM50JicR2hG0lasx2+47eidnsuKjyQsJ7ykNU8UXls+jlco:wa5POZ3wJt2pasx2+mFUAwkuVvlco
TLSH
T12665AF5EA6F800D5D5B5D17DC5838A1AF5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6723d2e7f843409964fdfefbf4b946ee037317b739b50bda335730f9b445e6ee
MD5 9f6fc5f9533ad336dda6c721b7d9b944
SHA1 f09e1ca2eb392b128ab12d07f150d6a91177d7c4
SHA512 29b1a55abc8ffca4a70b9bb4aec57c5b1afe48fa9a896ef27b803b2494872d1d26a49e9d630bbe482b2449c2fdcd756975bd6ff27698ce64acaafc52b1851c92
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkJuyRW+HcitzVYb9:pNc/zEOVHFSLoOrzV+
TLSH
T149858C1623E901E4F1BBE1BE89779546FA717869533486CF0291811A1F73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 433bfa7f0f2ef05552d9c873d15fd609e808516ab4c74cc12b6d6b2f035f2902
MD5 1c45b3ae2811055475632873f6be9b89
SHA1 c2a2ccbf2be416fee8d07109ec0da63d12612a9e
SHA512 ad69b531e654e987403eae0940101e1fb95d66a28334fdd12d302e49fa542e63854bf6d90d25d8b092134e24fa767b22d6199504eed18d2e6874ffc97aa69702
SSDEEP 24576:fJnJPbzB4S5uKjyQsJ7ykNU8UXls+jlco:fJnJv6SoUAwkuVvlco
TLSH
T1EE15D03DC2A810E8E4B7D2B4811A5B5AFE31383D2F2169DB19B4D5353F12ED0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 807c5b0e5723d836e4950f696767668605f3960645d7af10dd93707df1be7cd7
MD5 e8199376275ebe825479613a13698f29
SHA1 b9081e2291f5a7e34bf301f74241b2a8d2b8cb75
SHA512 440e66eb704449c5fb976277a260600cdc912846530a890a5bf4add33ad24bfc2b35d57a2d32c598f9612f455db69eb67f2595b991362d90d51a3cb9464b1d8f
SSDEEP 24576:MCLHGL0MoeVtFumTijCmlKQWDkLuKjyQsJ7ykNU8UXls+jlco:MCLHGeeV5ijCmlDWDk6UAwkuVvlco
TLSH
T19FA56C05E7EB4184F8F3CAF5C92694169A327C549B34F7EF4A80CA6A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 22be82d5fc62d12f9e7057087e74f2d28def0f88807d93b32aedc5e9935fbe20
MD5 c1f8448bee9a2ec3fdf704906aa4e010
SHA1 c6f0483f2e968a575dfefb748d207bff5e5f76f3
SHA512 43fe9d6099b66df55bbae81df0e63545cd8e42d31b47071adebe27ec272d55470d856c41e5812c149195eaad3c3cb03d425ea3cd9c2cb11df0781e9f76594049
SSDEEP 12288:o1Hrkcj5ZI7ky2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:5cDIoyRW+HcitzVYb9
TLSH
T12F05014E277A10F5E06BD07ED6830503D2B2B4A4C7225ADF07D8C5795FA3ED8B939A81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 631313335e5867a84e4d123f28b151099e810dc57481582ce2b9945c4ed266ef
MD5 b43f587a1b960172a0aa62f01d23c4b3
SHA1 e9c66edee2679c50f9c68b867b9a523ccf536f6c
SHA512 46c298cede145cbcfe2fea125924daa4bfa7aec9d4455438852734fa321a2d0660411adb0540d3b10501b8e67687911bb07cfa2598b73e1cc45e7754e85fc4f3
SSDEEP 12288:CG6kyzQy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:rty8yRW+HcitzVYb9
TLSH
T13EF4120667B454D4F9B916B4EA6382A28F34BC10DB2192DF52E0A73D2F337D4B930786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 b3e1711f44adfbebfe99f42aaf40fd26f2c609dc85cb0725043b90fd74e5e828
MD5 689b09100aa92282c708268292f099f6
SHA1 c08339a44f0e515143ee84d7f9dc691cb3540a20
SHA512 c434963ae32fe109ad4fea6318500d4704b6691c4c8dcb744b7e36377c1ab07d1337af83329350dc2357c23570d574eb4e676ca3a7787934f3614a6354a330ce
SSDEEP 12288:pSgy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:IgyRW+HcitzVYb9
TLSH
T1B8D4238F6F305A95F81569F1E4530F038764FE88DB29A4EF63E896348B530C57A319C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 34e6b05930be310e2683464c4f614e7d57b4f3151b1ec4d6b45716bcd6563ab9
MD5 312c3427a9030284f789699abf7dbd5e
SHA1 b899e91016da5d81bcd2b8a77c04a4c960eb5323
SHA512 bdd29940b8e0777a4461f62064a5fb92652356c582787581b12f9fc87559baeffac60536d7f515524aa0b7f09ddfbf66eead5ccac32713dc6fbc9873d53fffb9
SSDEEP 24576:RkgILoTfaidZauKjyQsJ7ykNU8UXls+jlco:OgHTrZFUAwkuVvlco
TLSH
T1D9559C1DA7FA09CAE2B2D675D8225493D633B4315772C6DF2448C03A4DABED8AE70F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 82346b849ff35b1749c9fdbcb2918e606cce8c53499823f7ea4e7e1acfcf0c67
MD5 479a98a790d0e9024d05181771771945
SHA1 ab86635e26539a887ddfa07a6f86a04a1725e1d8
SHA512 6d866ad564bd989d8403c2efd69712a3c523fd4c99c00637465e9e3e16071b7aa5ff30f0de6379d000a68b3af662606b121f32a8ff3fec41fab45cee33af4841
SSDEEP 12288:upJcm8CN8BMKjyQiCKZHJqZYyksE36lJ8jx5Uh5vXRdZrJs+CGqd+lcAJP:urcmR8uKjyQsJ7ykNU8UXls+jlco
TLSH
T15605F15EF67E00A5E0B7A17CC8468656F6B3B031A36257EF02A0873E5E275D9BD34B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2f42da45fd1c730596855e8794af2836535058794588cb5bef121871624a8f83
MD5 eb922cc1d16119456fc0f22c9a8195a3
SHA1 b4a66049a7056954db2b63270a42fb781ee93837
SHA512 176b45994cfb5cbb6678ba23f65d00919489538cb0a89c9756c43e6baf2e3ddf4724b70498e49e209bf86b05397e7c42487dae7f110a59390232ab80cf251d5d
SSDEEP 49152:+DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3wUAwkuVvlco:f3Upow8sBvWNR
TLSH
T137A58C3DA2E810A8D8AAC379C54213A6EA71782E3F3015DB0174C578BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fb1466216c6a9d44a258f7ce07bf8d288e8c41b47b0a16e7f7fa047540a8a887
MD5 8252f0d1914d7049760ee2a08899ca71
SHA1 5abb998ddc3e30ecf18153c2dcae78ca007d4ffc
SHA512 4e257af5b2dae5cc45ff376c3455fe9225e19ce0f043871367e4c5d2dd969254987039c57bfb3beb91982baeaf8c0d2451efb7ee1bbf0362392db7fb17f1b310
SSDEEP 24576:OTkNvNnaFeYhJNtmZBmTyRW+HcitzVYb9:OTMwBtOm+oOrzV+
TLSH
T14D55AF6EBAB846E4D1FAC6B5CD238512EA727851073293CB5390C13E0E679D89E35F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 319611a0bf9e2182dfbb76a662814e87ef21908679853d831c68b70199dab9ed
MD5 2bf01720eee67992b7cdbbad62e67f27
SHA1 d7caeb1e14b1e5f03ad0695819eb9ed0d23f3302
SHA512 fdaf121e4750e28a9db7e049287bf1b22eaa9af24e6b95beee626093b07345d804a59eb1583f632d4e22f7c845f874c1a4835f312940acdefda9bddea408f3a7
SSDEEP 12288:yHvUrBFrEjwaQTy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:yPUr+NQTyRW+HcitzVYb9
TLSH
T19705F11F66B818E5F676E17DC982470AE771B8524712D2CF02E0817E4F63AE8BD39B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 4e5c4be17891996c20cdb5f4cbacc13b03672c19715d9beb6391af2610c7a931
MD5 2dc943aa64c3fe67630109b0810e4615
SHA1 b02b7d494057083f6fd70c07a11c290d1a3033a4
SHA512 22a136290b8dce742e60d85fea5e2bc9c0e2f3ee17f89daef9923afa021bde0c95f7ced5f7f6f951cf3ec080bb05111d1d759961830062b4f4c75a3f781bf963
SSDEEP 12288:6QcMxWDXN1Dp/fshBItT1IQgAKy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:oD3FHshBIYQgAKyRW+HcitzVYb9
TLSH
T1F325E16EEB6C04E4E47AD1BCDA638A07E77138AD432165CB02D481B51F6BEE47D39B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 d6a4c16c92d516997bc3bfdcfe95dce099fd1da49a1366bf1524519dcf8b4c5d
MD5 a28b06ffabaea4f810ffcd11cd2b1dbb
SHA1 44f344c17608a9b767fe8ed96e4623c8c1ee371f
SHA512 6ac4824db7babe7be33a5193900ba9767fcaae2015406f0725e89a7537eaf857c09347ac200034049414ede97d7fc4e1e0a631853967d834ca15c34ccc05b2dc
SSDEEP 12288:Ey+6b3IkxjbBzmy2Oqi2U9y3+HqFijRXeR4JCQV/qD8PmZ8AmG93:e6UqjpmyRW+HcitzVYb9
TLSH
T12BF4124F5BB054E4F0394170E962822387B0BC669775A5EF33D896398F33AC4A93BB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-136-0x00007FF6B8920000-0x00007FF6B8D37000-memory.dmp

Download

memory/756-240-0x00007FF6B8920000-0x00007FF6B8D37000-memory.dmp

Download

memory/756-218-0x00007FF6B8920000-0x00007FF6B8D37000-memory.dmp

Download

memory/756-237-0x0000018BA1450000-0x0000018BA14B6000-memory.dmp

Download

memory/756-135-0x0000018BA1450000-0x0000018BA14B6000-memory.dmp

Download

memory/756-137-0x0000018BA1450000-0x0000018BA14B6000-memory.dmp

Download

memory/1036-62-0x00007FF6E3840000-0x00007FF6E39A8000-memory.dmp

Download

memory/1036-64-0x000001F015970000-0x000001F0159D6000-memory.dmp

Download

memory/1036-63-0x000001F015970000-0x000001F0159D6000-memory.dmp

Download

memory/1036-71-0x00007FF6E3840000-0x00007FF6E39A8000-memory.dmp

Download

memory/1036-69-0x000001F015970000-0x000001F0159D6000-memory.dmp

Download

memory/1488-54-0x0000023CB1040000-0x0000023CB119D000-memory.dmp

Download

memory/1488-56-0x0000023CB12C0000-0x0000023CB1326000-memory.dmp

Download

memory/1488-55-0x0000023CB12C0000-0x0000023CB1326000-memory.dmp

Download

memory/2212-18-0x0000018B9BAD0000-0x0000018B9BB36000-memory.dmp

Download

memory/2212-16-0x0000018B9BAD0000-0x0000018B9BB36000-memory.dmp

Download

memory/2212-17-0x0000018B9BAD0000-0x0000018B9BB36000-memory.dmp

Download

memory/2212-74-0x00007FF77ED30000-0x00007FF77EE53000-memory.dmp

Download

memory/2212-15-0x00007FF77ED30000-0x00007FF77EE53000-memory.dmp

Download

memory/2536-172-0x00007FF78F3E0000-0x00007FF78F701000-memory.dmp

Download

memory/2536-181-0x00007FF78F3E0000-0x00007FF78F701000-memory.dmp

Download

memory/2536-178-0x0000028CCF1A0000-0x0000028CCF206000-memory.dmp

Download

memory/2536-173-0x0000028CCF1A0000-0x0000028CCF206000-memory.dmp

Download

memory/2536-174-0x0000028CCF1A0000-0x0000028CCF206000-memory.dmp

Download

memory/2568-118-0x000001D6CF950000-0x000001D6CF9B6000-memory.dmp

Download

memory/2568-200-0x00007FF6DB480000-0x00007FF6DBBC4000-memory.dmp

Download

memory/2568-120-0x000001D6CF950000-0x000001D6CF9B6000-memory.dmp

Download

memory/2568-119-0x00007FF6DB480000-0x00007FF6DBBC4000-memory.dmp

Download

memory/2568-279-0x00007FF6DB480000-0x00007FF6DBBC4000-memory.dmp

Download

memory/2568-277-0x000001D6CF950000-0x000001D6CF9B6000-memory.dmp

Download

memory/2580-96-0x0000020CAB770000-0x0000020CAB7D6000-memory.dmp

Download

memory/2580-97-0x0000020CAB770000-0x0000020CAB7D6000-memory.dmp

Download

memory/2580-171-0x00007FF71A790000-0x00007FF71A8DA000-memory.dmp

Download

memory/2580-98-0x00007FF71A790000-0x00007FF71A8DA000-memory.dmp

Download

memory/2652-202-0x000001F76DAE0000-0x000001F76DB46000-memory.dmp

Download

memory/2652-203-0x00007FF7A7E20000-0x00007FF7A8327000-memory.dmp

Download

memory/2652-246-0x00007FF7A7E20000-0x00007FF7A8327000-memory.dmp

Download

memory/2652-201-0x000001F76DAE0000-0x000001F76DB46000-memory.dmp

Download

memory/2736-89-0x00000280E3E40000-0x00000280E3EA6000-memory.dmp

Download

memory/2736-88-0x00000280E3E40000-0x00000280E3EA6000-memory.dmp

Download

memory/2736-87-0x00000280E3B90000-0x00000280E3CED000-memory.dmp

Download

memory/2796-193-0x00007FF71AA70000-0x00007FF71AF41000-memory.dmp

Download

memory/2796-192-0x0000023B82810000-0x0000023B82876000-memory.dmp

Download

memory/2796-194-0x0000023B82810000-0x0000023B82876000-memory.dmp

Download

memory/2796-245-0x00007FF71AA70000-0x00007FF71AF41000-memory.dmp

Download

memory/2832-153-0x00007FF67BB30000-0x00007FF67BDD3000-memory.dmp

Download

memory/2832-156-0x000001ED3F4F0000-0x000001ED3F556000-memory.dmp

Download

memory/2832-155-0x000001ED3F4F0000-0x000001ED3F556000-memory.dmp

Download

memory/2832-234-0x00007FF67BB30000-0x00007FF67BDD3000-memory.dmp

Download

memory/2908-145-0x00007FF602CA0000-0x00007FF602D54000-memory.dmp

Download

memory/2908-146-0x000002323B4F0000-0x000002323B556000-memory.dmp

Download

memory/2908-221-0x00007FF602CA0000-0x00007FF602D54000-memory.dmp

Download

memory/2908-147-0x000002323B4F0000-0x000002323B556000-memory.dmp

Download

memory/2924-185-0x000001C631910000-0x000001C631976000-memory.dmp

Download

memory/2924-184-0x00007FF6AEE80000-0x00007FF6AF10B000-memory.dmp

Download

memory/2924-186-0x000001C631910000-0x000001C631976000-memory.dmp

Download

memory/2924-244-0x00007FF6AEE80000-0x00007FF6AF10B000-memory.dmp

Download

memory/4128-1-0x0000000002C10000-0x0000000002C79000-memory.dmp

Download

memory/4128-0-0x0000000000790000-0x0000000000A3D000-memory.dmp

Download

memory/4128-255-0x0000000000790000-0x0000000000A3D000-memory.dmp

Download

memory/4128-42-0x0000000000790000-0x0000000000A3D000-memory.dmp

Download

memory/4128-43-0x0000000000884000-0x0000000000885000-memory.dmp

Download

memory/4128-7-0x0000000002C10000-0x0000000002C79000-memory.dmp

Download

memory/4144-28-0x000001FC5C7D0000-0x000001FC5C836000-memory.dmp

Download

memory/4144-29-0x000001FC5C7D0000-0x000001FC5C836000-memory.dmp

Download

memory/4144-104-0x00007FF7D2EF0000-0x00007FF7D2FB9000-memory.dmp

Download

memory/4144-27-0x000001FC5C7D0000-0x000001FC5C836000-memory.dmp

Download

memory/4144-26-0x00007FF7D2EF0000-0x00007FF7D2FB9000-memory.dmp

Download

memory/4180-236-0x00007FF6AB8A0000-0x00007FF6ABA35000-memory.dmp

Download

memory/4180-163-0x00007FF6AB8A0000-0x00007FF6ABA35000-memory.dmp

Download

memory/4180-165-0x0000024994CC0000-0x0000024994D26000-memory.dmp

Download

memory/4180-164-0x0000024994CC0000-0x0000024994D26000-memory.dmp

Download

memory/4452-222-0x00007FF792270000-0x00007FF7925AF000-memory.dmp

Download

memory/4452-250-0x00007FF792270000-0x00007FF7925AF000-memory.dmp

Download

memory/4452-223-0x0000020B1FB50000-0x0000020B1FBB6000-memory.dmp

Download

memory/4452-224-0x0000020B1FB50000-0x0000020B1FBB6000-memory.dmp

Download

memory/4468-46-0x000001AF35BA0000-0x000001AF35CFD000-memory.dmp

Download

memory/4468-48-0x000001AF35D00000-0x000001AF35D66000-memory.dmp

Download

memory/4468-47-0x000001AF35D00000-0x000001AF35D66000-memory.dmp

Download

memory/4716-36-0x000002523D010000-0x000002523D076000-memory.dmp

Download

memory/4716-38-0x000002523D010000-0x000002523D076000-memory.dmp

Download

memory/4716-35-0x00007FF7D2EF0000-0x00007FF7D2FB9000-memory.dmp

Download

memory/4716-117-0x00007FF7D2EF0000-0x00007FF7D2FB9000-memory.dmp

Download

memory/4960-249-0x00007FF693940000-0x00007FF693A6F000-memory.dmp

Download

memory/4960-211-0x00007FF693940000-0x00007FF693A6F000-memory.dmp

Download

memory/4960-212-0x0000015CDFC50000-0x0000015CDFCB6000-memory.dmp

Download

memory/4960-213-0x0000015CDFC50000-0x0000015CDFCB6000-memory.dmp

Download

memory/5168-106-0x0000000000710000-0x0000000000779000-memory.dmp

Download

memory/5168-183-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5168-111-0x0000000000710000-0x0000000000779000-memory.dmp

Download

memory/5168-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5588-126-0x00007FF7BB610000-0x00007FF7BB6BE000-memory.dmp

Download

memory/5588-128-0x0000018E39E70000-0x0000018E39ED6000-memory.dmp

Download

memory/5588-127-0x0000018E39E70000-0x0000018E39ED6000-memory.dmp

Download

memory/5588-207-0x00007FF7BB610000-0x00007FF7BB6BE000-memory.dmp

Download

memory/5924-75-0x00007FF7599E0000-0x00007FF759AFA000-memory.dmp

Download

memory/5924-77-0x000002C728A40000-0x000002C728AA6000-memory.dmp

Download

memory/5924-76-0x000002C728A40000-0x000002C728AA6000-memory.dmp

Download

memory/5924-162-0x00007FF7599E0000-0x00007FF759AFA000-memory.dmp

Download