fa522b5698cb702cc0a76cc50433f3d7dea9d7f06a280de0e9eb89b8fa370fdd

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Size 2.4MB
Sample260807-bcr4jsvcqa
SHA256 fa522b5698cb702cc0a76cc50433f3d7dea9d7f06a280de0e9eb89b8fa370fdd
MD5 263f4b726acdb04145ccecb018b63a98
SHA1 9dbf31a6603baa182a004eb56e7c5fbd7a5bc0c6
SHA512 c2e75aac0de90457ad9af1040f7fc236ecbe71af3dd79b9f3e1f253a11741b8c04e9d1beef5d76ab8a373e82f6c164272641e010eb8a6f0ccab892afa135b84c
SSDEEP 24576:clq+TZtG00f3GQgYHhDZRkPKIHJ4uyFteQdiOcIyTBlf0nQ/tbw/2Mkjy6Fr7g0o:cNTZ0VDVRkP3p0diOcpTvf0Q/lFTjN4
TLSH
T113B58D91B6E4D2B2CC41097050EAEE1D4B259E686737C0E3E1C93FDD8E378E1957628B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3028	elevation_service.exe
6112	elevation_service.exe
2448	maintenanceservice.exe
4288	OSE.EXE
6132	PerceptionSimulationService.exe
2756	perfhost.exe
828	ReFsDedupSvc.exe
3720	SensorDataService.exe
4600	ssh-agent.exe
6092	AgentService.exe
784	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d5ea72c6e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea92482b0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000971ba92d0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad1f8d6d0826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001242c52d0826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f485316dd3a32ebb04cbbd7dfa0abb5acca0000	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Pictures"	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
3028	elevation_service.exe
3028	elevation_service.exe
3028	elevation_service.exe
3028	elevation_service.exe
3028	elevation_service.exe
3028	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeAssignPrimaryTokenPrivilege	6092	AgentService.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: SeBackupPrivilege	828	ReFsDedupSvc.exe
Token: SeRestorePrivilege	828	ReFsDedupSvc.exe
Token: 33	784	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	784	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	784	SearchIndexer.exe
Token: SeDebugPrivilege	4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
Token: SeDebugPrivilege	3028	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4972	2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 4172	784	SearchIndexer.exe	100
PID 784 wrote to memory of 3244	784	SearchIndexer.exe	101
PID 784 wrote to memory of 5672	784	SearchIndexer.exe	102
PID 784 wrote to memory of 556	784	SearchIndexer.exe	103
PID 784 wrote to memory of 2012	784	SearchIndexer.exe	107
PID 784 wrote to memory of 4472	784	SearchIndexer.exe	108
PID 784 wrote to memory of 2144	784	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_263f4b726acdb04145ccecb018b63a98_elex_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:6112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2448

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6132

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2756

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:828

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3720

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:556
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2816 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 37b939a52ae53df10628a618c017e3170009866772c4e04969ae7c675f2c3fd9
MD5 991359390f8cbca0b9bbdb7d20725485
SHA1 efda48ac88cc8a13afed88e1f757a318e9fa7181
SHA512 925f693c678b5c6e48e606187f2e18ddecb2e15d5c12c90e5195e27d8c1ab9c9f2e8c2cb94319b81bf40d62b670373a26adaac1052b056f9a9794b324d5715bf
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnXQ/lFTjN4:Z3q6HjBjLm
TLSH
T1A9D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 db171c32753b280fe6c016bbb46b676915c0138d4e885c50f10fc88e61452768
MD5 c096e1874fbd15ca31909e9b02f891bc
SHA1 525e51afe56fa33ae5e9a28f124bee149160d8da
SHA512 3ed64e90172957a291acd1abfe6d3a0367bd016139e3ee4975ca3f279d95de04834a1666a9c099d8926c3c6b451777ce33c84b7e5d797b8b25d22f4e11eecb76
SSDEEP 12288:b1XLsswWkxy2lRq2czA8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hXYfDtczA8nQ/tbw/2Mkjy6Fr7g0o
TLSH
T18D75F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 67086ae2a68df7a7e3e085cfd68c58961ef1fd873fb8334aa53f7a8d66e6ff85
MD5 0faa6b1a87bdebe3d44bc67d47479454
SHA1 7337d5a31d9591ee8bbf2347e077de391439c03d
SHA512 dd71e28e56c8c749b28846aa6ef9e32ef17142eda802be3734a972d41f6d45eae36b019ce1a347a3b8808d93aa92fac28d9f6eb954790eda77074f8461812496
SSDEEP 24576:q0Le5ji0hmxmrM/nQ/tbw/2Mkjy6Fr7g0o:qPji0AoiQ/lFTjN4
TLSH
T162959E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 13852bd5fec4802a20b32b27b65e327561a4ced93a4c0184c5bb09e10b1e8cfa
MD5 79cbe544eaf7a7a6e8975ba9e00aa673
SHA1 c44a2361e30525753e9d562ef1fc6ab93570109e
SHA512 9b1f6bd9764db86b02da547a71d9ef0f34045d2151ef353f47ad9e1d47fe35064a380512f65710d70325355bf8b2faa772c18c44cb496d88c1540992e3bf1448
SSDEEP 24576:Ha7/ezSC6vUyD/aqgrvWE6q8wyupnQ/tbw/2Mkjy6Fr7g0o:K/ezSC6vUzPvxHjyeQ/lFTjN4
TLSH
T150755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2ed0f0286d96ca82dfe1c279c42ddb616c8d841dbf3fe718c872f4fd5f85d38a
MD5 a66c6306939ae9bc29964c948e0c3a71
SHA1 d50523caf47c90b2c8246025d9e332268710ad1d
SHA512 ea8b963fba6f9982dd3cb2d3592cde24641a3076a2ee9c046d2a2ca9e5ad2e6156e3b904d4d93a2c51410d2b9c88d2aad7ee48246929a5983fa1f53faaeed1b5
SSDEEP 24576:WVbqPb88hv/l+6gnQ/tbw/2Mkjy6Fr7g0o:WVO88hXl+LQ/lFTjN4
TLSH
T1D8559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 5f914664457748472010eff81a56cb533bef0da68e61f99a7340f869b9906fe9
MD5 c9bf2a967fd4e68dd8fdd0f075362b4e
SHA1 bb738a3c6fea079ba749334108b53924b2102d2c
SHA512 2b1beb91b76e88f3dbc78daa52413486a65cb7b3e024fc1e8a2d5e4e3ae13ca9354d8a468de8c77675d305a01b985f06ee799e8145cf0428fe50dfb064cdf182
SSDEEP 12288:s9TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:s9DnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A25523696A24F887FF2B06B15CD38582AB7B0DC1AFD0A74E6B44322DD53C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 257ee282b0accd0f266bca61368813449fa6f39951709b18d78a6249e2f84ff7
MD5 7942ca8dadee86fbd4a9a37e713ad650
SHA1 70fe681619f78c8b1b93ba31c9c02c7b5cb7ffed
SHA512 eda5c3df8bb243e36b8c71c3fef37b75771f86be44d00fd5ca89cc16877b012bcb0a9bf02c0acb18f8ccf99b3708efa8c29803d50054df0823e2fccb66283ac3
SSDEEP 12288:meBNUbTVO86UIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:mJIUInQ/tbw/2Mkjy6Fr7g0o
TLSH
T11F75CF3BAE28FCD2C27E4DB85A918640E77278704F51A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 579424feabac581d48ef4f1a3c18697fbefc248b1a5cf69ca9733d7bc113894d
MD5 056186f17a145056127a9b554490055c
SHA1 cc99e74f201b03a33db2c57ffe3503474174c8ee
SHA512 ddabee4d6e2ba54bc9deb54d13b9d5d49d50fbd415c365460b10c938d78e8e27c600cf8949b80116cd0d8d2214dc7f58fbb1d8317db8b647ffa55fe3464edac1
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THm:1QvGAdlCEL8c/yRNw5CuLm
TLSH
T1D1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 cb14441c3f5b7553515258511f33ec1e5bde812568fae8e36edc2cf332351159
MD5 afe8d3e480391891284e14be82af812a
SHA1 371157e3477ff1b91348859e13bc68728b3c90bf
SHA512 681fda74dad6e17737ac63f7b1bb0e793ad6ace2e6ad5d4a8c310db5de26e84a8bf669239cad9843c4ec2aab6e410b06fe1903f249bf54fb9c1c9390321d8e24
SSDEEP 12288:FAwSfxL/2Dc3kDLLmt0LDQewsAjyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgR:m5ewsAjynQ/tbw/2Mkjy6Fr7g0o
TLSH
T17D85E031FE74E436C77F0DB21B26C706683D69604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 14d68602c10c65c8818d08fca948ba35345f163353622cbedc2bcbaf99c0059f
MD5 88d1e57c8a6f0a39c599c2d83a8c6264
SHA1 b422cce53177846f2778122c9e20f00ff7be7748
SHA512 8327b73550ac99af25f474b618ace4fba24ce26ab36342e788b9e74fca1bea5ad749fd9eb06c131548fdc5bffd9015b306c021407730074efe58d16a62a200b7
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHlL:bUEtQevvqc2W1cpV2EI32
TLSH
T1CC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 69d0a9503ba9b55e83adad8a08785277ea38599252ecbc96db5a9ddb7fccbad5
MD5 91b70fc3955b7a482622f9e054c804c4
SHA1 5aca31cf1c3794f4e89499d05fb7ebb659c0d571
SHA512 5587c5755d41d66bf714820def9c634140e9bd04aaac547b121685dc348d08ba334a7f9e647f5dac06ba5822f35ea2ff3048faec141cfae661148aa722f323c0
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zSQ/lFTjN4:yoqtVjnmaLm
TLSH
T144D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 22bdb391eba3fe927b16231564a6266513022973324d3a758797929b433f5650
MD5 6c558d243c00e2d2e50b591870943b24
SHA1 4f30034f1d2a1eb456553b9c0cfbe9f367dbbb22
SHA512 4238e5ed8ebdc5fef0686cf1b46e59d2b91fe617b016a3fc339b750e3d1c38ba554e9b3231041b91cc5ecf0fc13354949f01c0e3e28ad9a73a050199a0d31626
SSDEEP 24576:tAhGLJIFoiwtA5l7S53VnQ/tbw/2Mkjy6Fr7g0o:tAMyFoiq5FQ/lFTjN4
TLSH
T1B135AD80E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c3f22ea304193a2ffe2f4ecaf045425adcf3e2541476b8206e754694055722be
MD5 f6123c31a879f4a2cd8537bcad2fcb69
SHA1 3b1e18e84147f925f91c701ac6684d98b7dd22de
SHA512 db27397a380dd3e31624abded657b58b9937343fcae1e8fb1819e5fce13e60c8c4b383f131e03be7d4fe3775b5985e77385d3b27c87b3213f77d6ac57c19d770
SSDEEP 12288:Fmw5HEjsChNZBFgl0WDm+C5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:gwu0OW+nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C375F14936A41CFAEA6742398993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 172d7d62cd8eabe812ca363b325638cc9b76a32f63eca0d1fb4122408945408e
MD5 619bb1555254232c9d3afe4cb84578de
SHA1 8ad9593e401e75b71b83552117679fc31a15d430
SHA512 d378fee8c26b431a449e63b59260284a75628d0b9eeb5d8be9a21a7e276dd137a674732ec4c9517fb73c39fbe240a66dcbb28a5d05302c29e4475299e4dfaad9
SSDEEP 12288:51Z1IyCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:TZunnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E365126933A470FAE6674278CCE28646E77338826BB193CF275442695F3B7C11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 51e0c6231c8cef0bb63e5467139bb37b4e95d96de44710e873d81fdd72d6f8b0
MD5 c9fe1771c214ca4353bf2a9057a37518
SHA1 4161b9eb8addb6e3d56de7cc87bc81b9f446f754
SHA512 23db8785ed9850f3a8fa7597f3f2d7f91b424d8e6ac90ef0ad16918c77342e964c1c000081333ffa269e3bb35e5f6439e8137ddb72d618d8d699b985b4ec1d9d
SSDEEP 49152:2j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:lQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T1E9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0c75b8a9fe18483d5e58e0a17b15d6a48354239c20b39075f6f43de8fd058560
MD5 de6324d2cf2bf67f6b48564f19540d4f
SHA1 f6075358cf4667620debd6c9a5c48a6acff38e5a
SHA512 217b6bb1a18ff0583984279b32b047a3fe1d3a11ab80f9b04b4bb6ed1f05da6897b0b224364dc7a2401fa1fb3aa8dc2ebdeedc78e972a6e05748d8cd7983ee42
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:TQRQyi36YOcPQLvw2gAf+PN3XLm
TLSH
T12A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d5dfbad7096da4d5944a85d0d9766fa41e61008d01398ace2226221561372521
MD5 df3c9258d6e2834092a1119736337c6c
SHA1 5244bfdcbc0bd5dffa59b4aa3109b5fe334bb79a
SHA512 5810d907bcf09f08106db18863f80ebcfc7ee0b73db20ae888b83390a845d5dbfd4182871c6672d09d8a5a03aebaa937c342f6049a0f2c34c601c8f89bf8e503
SSDEEP 24576:PwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0XnQ/tbw/2Mkjy6C:X68Qg55nhheWu7PNU3/iQ/lFTjN4
TLSH
T138B55A33B2F60099C44DE1769F46872196E27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ecb1c2d78180ec5900eb05fbdb1e54098bfe897083cf107856721ca34c1a14bb
MD5 4982b52732bf2f79d941350fc0859b3e
SHA1 91f4c59791ca24501fb7030142052ba6f6fa934e
SHA512 843f3198d3d3081606459bdb6dffd59a25459e307d2e35002c500030788d562ce535b0046be44250df8ac20789f2a744c482bb0e0ccb660f7765aa9477a2d15f
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Cy5112gYy5azzVvL69nLKnhZoLm
TLSH
T1C7167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 593742c43ee2f705a5286f4c8938a82ad4ba742eb0e7076d72e63097aa41af90
MD5 e349a3da90f05192dd6f179a418ad6d6
SHA1 7911678bc062981973f0d5dca836c095407646a9
SHA512 3645751136bc550e7234b27700be06cea939b3806f96b7eb6fb8f7f35116700d838d08ed1f17c3536650f8cf31fa104bf64f218e48ce22073720221cba2fe390
SSDEEP 49152:yB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glsQ/lFTjN4:Au6JmVxd2dPLm
TLSH
T1D4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1f6068293b20773562b7ea2b2f1ea259a54b61563559360b6bf658249cd71440
MD5 17eb78e3102807951087883a87dd9237
SHA1 fcfa1511ac2ebc0a6654da8abb516e1ee4f89ddf
SHA512 28bfe7421f45e4e1a32dcb82efefd863587247ad83de74ed77e939575871bf3b3919c232cd877626394d44f73a2df63123d7c1ad09f4ba1233809eed45af1935
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xoQ/lFTjN4:MmifPbRaLm
TLSH
T18EB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 dee5a97a889382b0a5010959327779056dec5324120a441f6fa2f3b244652f53
MD5 83736e0db8d493fa11b9e427fd02f284
SHA1 fb11c0eb02b0bfa9658b629b0cea9b5eb4dca177
SHA512 5b2787dbf0bbc0964f804323cc98ed61e9beb29bf42b51cea6c6b672f0981eb106ca077646cbcd0ed4abd9584afc9828c4386c008c4dbc3709147bae4d72ae1b
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHqnQ/lFTjN4:d5dKTi61MLm
TLSH
T1F0C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c2fc3f055fb602a6176abfdb8f50e431bfb0accc9ef8d0b1317e323790e2047
MD5 53ceeadce0feab18882777d9903a061e
SHA1 ba7e7ec12c694558f23587ed18ac486959daf0a2
SHA512 f90f32357700e2851daacec99d81b2e29559e56a27217225eaebe089a81414fcefc4884c4315bfb15d6a76c23f5f3049fe821e72b1fbfe8f6aecbc6fafc9d6bd
SSDEEP 49152:fhtSn8EApI0figngiDn0AP5w8Q/lFTjN4:OX2iyphWLm
TLSH
T11395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 066a91f65aee9d23eb8c96fe45e22d27601066617002654f65cbb79e3fb7e8ea
MD5 b9d84844d8b7a2a677f6c42a78952253
SHA1 33da18766cabe0060cd79479f07a6137c5cd8156
SHA512 a15d3c12c156617f8a6a2ca3c06281aa3e269eb72185036da0b53f85f6b01253897361e9ad0bd69e23b9f7360d2c629b0df0cccfdddd85bcff313cbf9c04b3df
SSDEEP 12288:IbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:ILnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E05523686965F98BFB1706F188838182BB7B0DC6BFD1A38E77482129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2f377fa1d8c87af92f3e7569408797646540f51e952ea18d078093cd782b28e3
MD5 ce402f1d6e53219a9e8b812807931632
SHA1 e1cd644159eae0da5a21bec1b279b6b272466cc3
SHA512 a0e0a19779b3f792ace3980bfb8e1f1fca83a8d46bc8aa3ba03f0768e067dc2a096df69fdc9317d1652aac26a7b74d6236381b46d9f7ad46c3db65dfac43da9d
SSDEEP 12288:s2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:sWnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1665523687965F98BFB1706F148838182AB7B0DC6BFD1A38E77482129967C39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 67ef0e414e92bf9c0b4f5cfc39acd0d15adc502cd6a0fa2f354d723b57fe8acb
MD5 e09165a80da02166a17de6b455a1bd7f
SHA1 63669339ecb490ea689c9c4146f1e603bcb2aee9
SHA512 8b7a1161fccc37862b632c04dd46d02977960784af09aafe1bb21a1d181cc74fb2df9aa5852f02c1c1f454707aedd320c07d1fdfbb10bf47bbfc32ec42a7df82
SSDEEP 12288:8wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:8QnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1885523687965F98BFA1706F148838182AB7B0DC6BFD1A38E77482129D67D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c0bb3795f81c63ed100262154028d3a89ac944f8acfe61863f1ac31d283cf375
MD5 e883ea23575816084368d2962e21327c
SHA1 cc935340718fa2326d3a50e4c892af87ab4b22cc
SHA512 1762044a86f73dcbdda0cf5aa3107384ccb82b90df4a8c197265120792899471294d67fc04ccbba588f66b516a1c1abe15de0617e99c4bd40436fa53e1fdd907
SSDEEP 12288:QVVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:onQ/tbw/2Mkjy6Fr7g0o
TLSH
T19A5523693669B4C7F92742F4CC938142F7BB3DC5BBA1A3CF6B0411194E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 a5b73576532a7e88751450608e2cb64cdd6043ffa1305e19b79eea8911637b05
MD5 1a913a177fb032e2f6d9e96e2f375512
SHA1 04d404eea476ea94c190cfa7a2ddf90e65dab1b7
SHA512 984bb72171d8ec21528c96dd83eefcefe2de1445cde358e3a878e14c4051eae0656e3d1fffa4f5293cde2980c74df9779e2e725cd7a0f75b16234fda7bfae731
SSDEEP 12288:1tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:1NnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1485523687565F98BFA1706F188838182AB7B0DC6BFD1A38E77482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 8f4cc44441870e01af790bc5601fff35c3f04c04f3988269ab79958deb120c62
MD5 0fb1792babb30bb3b82885cb15bd2cc8
SHA1 281f335682b9974da4a2b645c8354b0ad589454b
SHA512 80fac361b10610f0166b6553c20fd236194afea3b769d687f35411f9d809a142a2e401a2211b074c174e3891f4283591153a065f39f894c53a901a31a30cadf5
SSDEEP 12288:f6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:f6nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1855523687965F98BFA1706F18C838182A77B0DC6BFD1A38E77482129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 f46ad62fb5841e45bf06595350813d7bce7979d38848760147db26f94e1f895f
MD5 bf6ad98c71c356d7f5ed664db2fbe81e
SHA1 c12a5605b0b82d8e7ed58a2056103bcb60fe82d6
SHA512 cce842600605e7d6a5c28641a905766c82a178ef5e092c7cbb7a056846966f344efc3210ec31f766567c6a9ba1503028fde65deba0467729ec208b7bad9defc8
SSDEEP 12288:/uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:/unQ/tbw/2Mkjy6Fr7g0o
TLSH
T1675523687925F98BFB1706F188838182AB7B0DC6BFD1A38E7B481129967D39415CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 1dcf0b147dc163ac946209f9d3b2550abf65d24c8b8c73820d3cea639f39c647
MD5 ea7f9c8a460c47f559e4d33a0c08bb96
SHA1 341b6fec0923fc2acef1f7222e4e7888d568b051
SHA512 b5fc8090d274c66f607d9b06be43094eb67763b683baf1a12967580d89402b655048d3abb1eec71109d58132882fc908334623616137190a52fcf010fbc0620a
SSDEEP 12288:5iZwb2zzFEoS2cPvyWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:8ZM2zFVSO2nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1597501A4B3505CF9EC67827ECC528906D6B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 93bfa86a92c306600658728c8ea6f9744f27e3732874645a863115f30eb4703d
MD5 d8585219b4749f18279d6d0c41fa2c25
SHA1 9a090d05256aa44177f0c7c6aa18848238a301ea
SHA512 0cb57e85006c4e227c036d9b74b9c484b5708367b6fc751e442662e7244f170203c31422d355f4a523151707127cebb1eff54a8ebf0f1d064c15708e3d0d5e1b
SSDEEP 12288:ZXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:Z3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1395523687565F98BFB1706F188838182AB7B0DC6BFD1A38E7B481129967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 89b24930ef202468cbee4e5dd7da1095d87676777ba06998849d521eefb8fa4e
MD5 5da638c0cc2d3ac67cf4a2b9e9673f85
SHA1 6fbf28025b25af8eeee165b27f5b578b6e2f6491
SHA512 06e4860ea9df26b47de0f6f7d80a936d9fd91a15b3cc777d4947564320cab87b0559d8e006f110c67b5a08112517a38256aadd0b469e6c1d541c6a5fd989e776
SSDEEP 12288:hjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:hTnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1075523687565F98BFB1706F148838182AB7E0EC6BFD1A38E7B481129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 c19f1d6fe8afeca5c3d04f6592133d181bd6b316f67415f5cf009e5daebfe0a9
MD5 b85f0459f30d14ef155ea66f34917291
SHA1 db1bf007995b1ab624fa132de9a8da01e1f049a6
SHA512 8e92de68f865b65da734ce6a1dbe5a7317ec8d4323f88d85bc8845c2f4b7325ada20838c233793f16c9c12501aab08ddfee75d721a328eaad3c2d4a92cd7e04e
SSDEEP 12288:uyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:zzyCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1CE65021772A530FAE537427888920A02F77678725B609B9F2754037A6F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 4b5bf1243aae485b340e41eecd43052651afbb6f251ac0e30a532929ab6418fe
MD5 113cc9f2b37aaae2d610e012784d9ad2
SHA1 eb515b10cb6c6a94d4b1dfeb3316f71e7b5f12ff
SHA512 50354522b9c02391a4b723ccad50d0d9bfea7fbf6089a5e4c766c3893a2de7f12b2ea4c7695a9a188a130f06b209f407df591e00f752186f01a4b142b34828a4
SSDEEP 12288:XXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:X3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1915523687565F98BFB1706F188838182AB7E0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 e41f1897542fa8880e4d8ca3e31b01d6eb09e59454f6116bc703f1b779456922
MD5 a17a1cc9ec38533ea957321603fd6388
SHA1 4067ec5d6b6b3f8b62498b63c11e3e1f7be4314b
SHA512 e9aee8ac75aaae6043d24bd7a5b4945ab3889145d95739d7518a21838c9196ebf25454b7ec0d5f5eed2e6b6fd429b64b768aab7a7c881565fba70fd9b52eb83e
SSDEEP 12288:HXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:H3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T11B5523687565F98BFB1706F588838182AB7E0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 81fd582224af9fc93adace61c56e68adfee56250d5c64a4e567efbd816594870
MD5 0d9c9e5f0b7481f03c9061ba8b38f9e4
SHA1 fd496f4bd790078b79956908dcadfa070bd669b6
SHA512 0611fa127c795c5d7ae00b27ec39389e78ef40ea7548c96811178ff54144416167145a1981cfd6ed7429b913f57e3907f87c73ac6ca66a6dbe3f22c7138e91c4
SSDEEP 12288:RyPz5L8CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:AzyCnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11365021772A530FAE537427888920A02F77678725B609B9F2794037A5F3B3D05E7EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 9111190b1b6af92d7c668c6686b58db3ec98aa8c276a4edfd0d8dc4c68e29e11
MD5 c56d0549c756a249ab383a84bba65abe
SHA1 5c574b05869b9c24ac79687578bb637b793e43a1
SHA512 fb8b24284166ec7df59b9621a41dbc3e920b5f7f9271138ea4952f94d5d07644ab3280d12d82484068d785ea76208753d45e4ae563e92443f933062007f5d1dc
SSDEEP 12288:QCd9CWYoaLHF3z0z04PDvhgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:JTDaLl3z0zDAnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1E57501A4B3505CF9ED67427ECC528906D6B27C5A0BB0C75F13A8322A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c025a37437aabfef45df5b57699e087cdb62755e21c61a51bfe61beccecc9478
MD5 1059e47f0197db9d2730a7f94e4069f0
SHA1 ab5310c41b5857f910263f5193c481efd48e37bf
SHA512 aed906b847887f098e89c4fc324fa732b14523fcd918cda6680d9b5e4f93b1f4dcfe5cc48d49c19f0a13928309fe5edc8af9c1f07255387c9e266602dbeaade4
SSDEEP 24576:53Hd9CHKy7GZEnQ/tbw/2Mkjy6Fr7g0o:JHd9CHKyaKQ/lFTjN4
TLSH
T16A85CF90F3E414E9F1B78A358D724512DAB67C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 7d274c2a581b24e2f961d716e4b948e0909019673c0fb6b8b44369f3b1f3cd6c
MD5 7b4775c58700c0edd361d2986c15cde1
SHA1 bd29748acab010e50d1fbfdd6b55b548c8e17318
SHA512 0eb47a203c5f21147b3966168a4b54b2926f8ba206c3602b43197df7dbd683c444a85b8bbe54228f9684ad206e211bbe6d6f9e3bfdbceb7d8b6e7260fdbd6d2c
SSDEEP 12288:VQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:VwnQ/tbw/2Mkjy6Fr7g0o
TLSH
T11B5523687925F98BFB1706F188838182AB7B0DC6BFD1A38E77481129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 dde34dbcfe7d9df3ef972bb98cf165134f76bd681e6a2d435cca3e0616f87751
MD5 c1d247d1b27c04e9b534d99cde81bf3c
SHA1 b20bcca86ec46030a94597c16ff8d597d650e976
SHA512 c28960fce51a219337b8279ff04105b36684f6e088afec88223b4a8274765f733aed54659d6e56772dd60f8b0452c2543a1dfec0fd90de6a3d51d45996387ddb
SSDEEP 12288:ziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:zinQ/tbw/2Mkjy6Fr7g0o
TLSH
T1D35523687964F99BFA2B06F148838182BB7B0DC6BFD1A38E77481129967D39405CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 90d81943635468335e6f3128509a84282513cd88e939ba840af6f9da4ebaf21b
MD5 b952443301c2c7242a1ac7a78941907c
SHA1 31ffebda91942f09000b9d3fec3a86209de146ba
SHA512 bb8f2da0fc198706023c1c82f5300d9835aaca31b4db0f4febd160ae51b0554c922d850511395892b60a62132d85148283621a161232055a576b7981672d3d82
SSDEEP 12288:ixGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:iBnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12C5523687965F98BFB1706F188838182AB7B0DC6BFD1A38E77481128967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 5eb73f2a5ff4f7591b26c0f6e3ec2ba9a3f8239c5a1823eace51d74da0c78e23
MD5 42b5faecaf757f6899689d78f0ba0132
SHA1 be65bc33826378e1d64d44a52aac47f8bb4f2333
SHA512 f4a6257e4cb31a72b85619f01790742bf0170b49b7ced92ed777014b48ed036c6136fa4b19260f646a633e543916c8d114dcc96914d23bb1fbac45f4e127459e
SSDEEP 12288:kXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:k3nQ/tbw/2Mkjy6Fr7g0o
TLSH
T1C15523687565F98BFB1706F188838182AB7B0DC6BFD1A38E7B481128967D39406CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 0ae2144ff31d3528073aa3e23560fd61c8252b64a94296848c611c0e238047b9
MD5 24d79c57c66b5cd73ece36c2c0787b61
SHA1 9a98b295800f337336c5adc6e0db3c49ec349551
SHA512 2faeb180d4a26d7aa1d70434c262b6fe1638e8c281b43d390f5e3537cd2b1f69a165bb17c6bdd89c3b541df330f7367fa828c4405411f820def5f21cf1292073
SSDEEP 12288:2QGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:2wnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1145523687525F98BFA1706F188838182AB7B0DC6BFD1A38E77482129967D39416CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 5ea3b937062e32e1a6dbdba2c9d0470ba0858b4b83de5ac3f8b81990154e320c
MD5 c90fce2e3753eb33d11e34444b7e0e09
SHA1 78f8dbb49c718157f07912bdbc4aae6e05e654db
SHA512 8844ea5742e5e9646e1399d6d626ff85092cc27d3ce788d36aadd311af1fe7add059c8c23c9068aa2f022e3dfc868c0eda20fa7df9005d93629aa77158c2aee4
SSDEEP 12288:EPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:EvnQ/tbw/2Mkjy6Fr7g0o
TLSH
T12D5523687965F98BFB1706F18C838182AB7E0DC6BFD1A38E7B481129967D39405CF784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 063ce601d352e5727b7b3af5782ae86feda5758aeda13c1a47dc0a137587eae0
MD5 a18e4b910ed333f76bcd0199e20ed2dd
SHA1 01511e5a38eca4de8fedbb21dfe3b819e45fdce4
SHA512 b51db55adba495385f0745bbeef8cee722f04c609cf425e9498d2254f602950bf8d6cff0f60ed966e260038a8debae90a84970b8a82f15091a0c51feac3e6070
SSDEEP 12288:ltGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:lNnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1415523687955F98BFA1706F188838182BB7B0DC6BFD1A38E77482129967D39405CF7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 1e91d43e6579582a29aa067a8c96199619ac8658990543a04a3ed36481e7f7aa
MD5 82c24b698f359ea55fd19b39c2c053e9
SHA1 4cdc19e9f401e9bfc63f0a77ace9cb0b21d4f546
SHA512 8888bdad9713de4562a05c1641c666e3416ccc0289a74ec327c0f9cf547d521ebd8d0ac1264f4e6853ae47a5b397bd7bf4e4e1fa6f1fddb9d74c98416419c89e
SSDEEP 24576:yfwvZk9RX6wkyAIjnQ/tbw/2Mkjy6Fr7g0o:PMnYIjQ/lFTjN4
TLSH
T14E85DF29EBDC48E6E177923C89A3460AF6B178591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8cd6d49b9bff15b508da1f274debb7a62c3c5b2b563a07666c2d6c490c6e301b
MD5 372afb3c0cf4bbac7074bc5c8b0f150d
SHA1 66988bb90ad428713fcd42dcb2ca9c80d90ee3bb
SHA512 39a687ae3f5fb871b60d72f2a559c651f5e854f9be08832ef03f0a348f95ad338857e2aa460cc3a44d885df179a3a2bf252bf73ae3ddd71c558b447ce369031f
SSDEEP 49152:UYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0cQ/lFTjN4:aySzP3Lm
TLSH
T12A066C96A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4e81d43a1b8202a1bc1b26f9bd46eee5bae67cafab83b2674fed498dd17feb34
MD5 1ecf7a355eebff20a8654a3c5f5b7c80
SHA1 558d38e4db682f24f01052177693783115e66464
SHA512 2da55bda94f42c7b9bc153a0bcba76059eacdec6c55d68beec10b3a72762cc431317277c8db9cc4f9a651f293bdda46444d7dd04bbc621e0ac153383c553c2e2
SSDEEP 24576:347Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYGnQ/tbw/2Mkjy6Fr7g0o:347JUQj1irIhCnDHUPfF/sQ/lFTjN4
TLSH
T1E265AE1DA3EC01E5E1BA827885158A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 1d788084d31391e8f558f7e840d1e47c00675ff6717a440e29ece8a1b7c174bc
MD5 c42e57b718c20b1c7dc91dfcd7bc6cb1
SHA1 2b42bbb6c1eed5697ce57ca13d083a5b8516370a
SHA512 ba848b18a4dcfd760b1ed729beb82017a5eeca7bb96fff544f1fc8f11f50797d1c39e8759dd9523709cf8649819e9e476efb55b6fa1c4fb1250b5c7edf354792
SSDEEP 12288:vRsfHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:YnnQ/tbw/2Mkjy6Fr7g0o
TLSH
T18F65F119D29852E9D12E5275CB828641B3373C9597E1D3CB67C0F13E1F3A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 c2b3e0701eba2af58828b872d0e2fe55947fa20277bbdac4cba843177b2000d5
MD5 bbe26bfb1d50bbaed38db6c97673fdec
SHA1 6e3577a4934f4dbac7b80e80fe4e3656caf53a24
SHA512 9bb02f8f8e403be7c1ad889bf1c0321a6a46cd9a0d132dc915a0d24a5bb0a61d7a3a0d633af558404b9b94273e24c834b655544e01d9c01bebfedca8e238678c
SSDEEP 12288:fcfdNU3fH565oMncnWbMamSA36OMBG5xGKmoxKARDh+:fcfvUPH2ncnX36VBG5xfmoxKARk
TLSH
T187451641762AC78FC6A940325E36D6CCAB707D41EE056F1773C8873F9476668B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 a7526dd2c583e92a60c64ee2c16c303d0270c271dbd78eff94028302999d7642
MD5 08c84bc12d01eaf034779d246e5e4f94
SHA1 b566c17fbae0011aef955cd324098399d5f265df
SHA512 c8bf3efd362ac0c4cbf3a469a7f29ee151c8f2e478523e8188b7c77b9d48b04c9009d21f9a7b22d0202cbf9cc0cb61255ba8e0955ca2ea204201d691d102346e
SSDEEP 12288:bjkXXYvpxdgc3rRN7C8enalfoPvoKowqFFInn6OGETOvz92:bjUXgLmcN9HVoPvgFven67l792
TLSH
T117653C01A5ABE35FC8FE50375632C68DAB746C02FB452B1533848A3C986757EB5F2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 e1a1a32d8c908c5858f7f9a2837c1aa98c01bdc841ca092202f746382dab217e
MD5 b121ce1ef3a523be436f953df5fdaec1
SHA1 eca7d992b72aca27277fae8fa3be5d3313603908
SHA512 9d14616474d1adcd8e5c4656513edd74e91f492fabdb616778e17a824989811510f21981dd21984bd0a92ab056fcadcbee44db99c4bfbd79e1b57889b911a19f
SSDEEP 12288:+o7/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:vfnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1A65523696668F94BFA3B06F048938111773F1DC5AF90E3CBBB042269953D3C41EBA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3987f74387a90aebb77a6bad5944dd932e8f554b214a4160d163be1cd7eca75
MD5 8af6c98fefcb86f6d747b9b424f4a119
SHA1 059ea6d6c4f9aa08b5577760a275146607aa6dfc
SHA512 691537183c3eada70883377df0ffdff004f5d0383eea93a8ac67e9af6b0d120e4fa6759351ab2b3b2f9b14ad0c7166789ca9eb9b1245048bd162aa1dd471950b
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bYpnQ/tbw/2Mkjy6Fr7g0o:wgb4mBIBhGFGQ/lFTjN4
TLSH
T13A65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4924c7c45a21d33a9225318b128374145a3528f155789cb900b6568ac5bfb75e
MD5 830467e88d81a4626a6bba9c28d9f01c
SHA1 8b008e88417e6bbb3bb5046b3c759c4653a85ea1
SHA512 9e37abde32b7e9c1ca019f5a532a17faed642356fec6f45fbed2447722a618d04d826c9926609e5a3d0f84bce0e4a69a2fa3f044a65567232f9d35cc0c18be94
SSDEEP 24576:YG88u8FpJqH1Hzria7/m2nQ/tbw/2Mkjy6Fr7g0o:b7ZFPqVaa7/hQ/lFTjN4
TLSH
T1B895F06576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 6a313a2457c7c1844d3b472ff4655fd20a9a9605f67401f51c2b7bae0bba18d3
MD5 84bcdcc64f9f2f6fbe9f5672f7d85a39
SHA1 1b73e8d1055aa1bce347a7a6d8ac2bedc4107f0c
SHA512 fe6d22cc9f5d25fa09f57b519172825def02651a5a20d09a3931bec7486ac20e777a1cdfa7ed861ef1caa83ffec1792ed195bb058f981e94fd97914693de6340
SSDEEP 12288:7HvUrBFrEjwaQKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW:7PUr+NQKnQ/tbw/2Mkjy6Fr7g0o
TLSH
T1DB75E12E26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 747f7144ed3382350004120051e0d37b62875cebff08c74288562c1e76451905
MD5 2527b9043c589b72941664a4f58183f8
SHA1 dc364ff3373b40990dccc08a98b2fd6d6dc61adc
SHA512 fdb215271f739e831f924a9dd8ee37519147a0e984d7e4e5074b9c5124d0f8923b0143516fff12c7453f3978b2f089280c46053e6c490abd249ffe4475bed1fe
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6Q/lFTjN4:lG05lO43bQLm
TLSH
T1C8D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3800f05a9e7defdfdae1458bd880dfa22ce5efea0127eef8a3c1a9f651dc2f1c
MD5 6ebd7f34b4a754645858910f14c03f4f
SHA1 3e9435f3ada72b129d34c63d26d14e83e32805b9
SHA512 c48b0a17f86264a8b4418a7dd2cd8e9f0095a5245be02a95b238b12729ad97848d9339ce01f785904d3574d8e0ec3da6bbda73da82f0119be6fcf3dc52d303dc
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncnQ/tbw/2Mkjy6Fr7g0o:Ca5POZ3+Jt2pasx2+miQ/lFTjN4
TLSH
T16A65AE5EA6F801D5E579D17DC583860AF5B1342253329BCB122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fb95e28f7bb58b38d9801b91bd40b6c89d1599b191225755e26c2a88258a7255
MD5 529ce83da4963eaa2ddcca96194750ab
SHA1 aec531d7cd98d672ed482a13369c5f52e71bb165
SHA512 065424b46c7bb2f5a0a4789354030b317191671a70fb9fc8ad649a2202caf0acfdb875ac6f7a5ec8828c3bcc465aeb3e1022bc0f02d1561b0aac7259a89ab266
SSDEEP 24576:iNcwHdjbyQ4nLC18lb/EOjowL7FkenQ/tbw/2Mkjy6Fr7g0o:iNc/zEOVHFBQ/lFTjN4
TLSH
T1B1858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 15ca7d8cd0a6d7528d6d73fa209940546ff6e1608477f1d0106e866706eaddb9
MD5 ef66caa5495dfdf43a6bd3390bc820d2
SHA1 f225840415b53e3a9e894a10a089377f2909d31a
SHA512 ed67dd34110c2de25826fa74b6d5b13e04b0247450e2aef3843b5efaf61261998942e88474287e7519f5602c38b1a9e021675350458f2d918b2b1352584c6b09
SSDEEP 24576:08kNvNnaFeYhJNtmZBmYnQ/tbw/2Mkjy6Fr7g0o:08MwBtOmYQ/lFTjN4
TLSH
T16955AF2EBAB846E4E1FEC6B4CD238512E6727451173293CB5390C13E4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 7696d6b450738060e90f868323b7f4be5804607a496fa03107221189a199d04d
MD5 95aba520d694579bea39aca9a830ea34
SHA1 ddc53b076b402f73aff840f88e548ecaadd5e2de
SHA512 0342db5e7f9bbe62a14976c2355b13a7505a458da48fad1a75d7f9dcbcaed5926c46c80790a08f23e7b260b41e2a436f472c23cb725dc7a9683d60b47c18284d
SSDEEP 24576:AD3FHshBIYQgArnQ/tbw/2Mkjy6Fr7g0o:ADVHeBIAArQ/lFTjN4
TLSH
T19485E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-395-0x0000026364E20000-0x00000263654A0000-memory.dmp

Download

memory/556-326-0x0000026364E20000-0x00000263654A0000-memory.dmp

Download

memory/784-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/784-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/784-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/784-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/828-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-327-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/828-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/828-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/828-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2448-44-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2448-38-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2448-48-0x0000000002310000-0x0000000002370000-memory.dmp

Download

memory/2448-37-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2448-50-0x0000000140000000-0x0000000140196000-memory.dmp

Download

memory/2756-81-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/2756-76-0x0000000000980000-0x00000000009E6000-memory.dmp

Download

memory/2756-308-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/2756-75-0x0000000000400000-0x0000000000558000-memory.dmp

Download

memory/3028-19-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3028-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3028-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3028-20-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3028-13-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/3720-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3720-99-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-105-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3720-312-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3720-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4288-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4288-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4288-276-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4288-58-0x0000000140000000-0x0000000140191000-memory.dmp

Download

memory/4600-311-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4600-119-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/4600-111-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4972-85-0x0000000000400000-0x0000000000677000-memory.dmp

Download

memory/4972-0-0x0000000000400000-0x0000000000677000-memory.dmp

Download

memory/4972-1-0x00000000025C0000-0x0000000002626000-memory.dmp

Download

memory/4972-6-0x00000000025C0000-0x0000000002626000-memory.dmp

Download

memory/6092-124-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6092-136-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6092-130-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/6092-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6092-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6112-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6112-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6112-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6112-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6112-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6132-63-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/6132-293-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/6132-71-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/6132-65-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download