floxif | 329aa4b71b39b71b38c2b5140af2f7436242f1c1eddd80a419325e2bf7ee5665

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
Size 1.9MB
Sample260828-brd58sscpd
SHA256 329aa4b71b39b71b38c2b5140af2f7436242f1c1eddd80a419325e2bf7ee5665
MD5 f61a075b833ee293ae1a2adf8eaefbba
SHA1 80a46a1f240b8e89f0dcba80c3b397f559f54faf
SHA512 0e5ec13abe75366e388bd3930eeaf970f9e704cd30a306e5250f5cb4e1605ffb15e53b66076a63e3516ea842049f03602b9942bb7e5b7a540d107d4a6e799172
SSDEEP 24576:6b0BIanQ/tbw/2Mkjy6Fr7g0onUGYagKLTNY5sIpA93/55XnQ/tbw/2Mkjy6Fr7/:6kIaQ/lFTjN41bPNI6P55XQ/lFTjN4w
TLSH
T1CF95120373E447EDF8B31A703CB167116ABE7CBD99A5CB6D2780425CAF3D2504981B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000a000000019caa-2.dat	floxif

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000a000000019caa-2.dat	UPX
behavioral2/memory/4640-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4640-80-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/4640-148-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000a000000019caa-2.dat	acprotect

Executes dropped EXE 27 IoCs

pid	Process
5472	elevation_service.exe
724	elevation_service.exe
2632	maintenanceservice.exe
6044	OSE.EXE
4576	PerceptionSimulationService.exe
3380	perfhost.exe
5236	alg.exe
2680	ReFsDedupSvc.exe
6064	GameInputSvc.exe
4212	SensorDataService.exe
536	GameInputSvc.exe
5412	ssh-agent.exe
3340	AgentService.exe
4920	SearchIndexer.exe
4120	maintenanceservice.exe
1368	msdtc.exe
2720	locator.exe
4868	snmptrap.exe
2132	TieringEngineService.exe
4972	AgentService.exe
2172	vds.exe
4528	vssvc.exe
3520	wbengine.exe
5320	WmiApSrv.exe
6068	wmpnetwk.exe
1172	ReFsDedupSvc.exe
1312	SensorDataService.exe

Loads dropped DLL 1 IoCs

pid	Process
4640	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	alg.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\AgentService.exe	GameInputSvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	alg.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\95655cb58f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\wbengine.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	alg.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	alg.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000019caa-2.dat	upx
behavioral2/memory/4640-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4640-80-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/4640-148-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	GameInputSvc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb2130fa8b36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005dcb3dcf8b36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000843a39d08b36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df97c7cf8b36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6c2b0cf8b36dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000799f1ce8b36dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000674839cf8b36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008f48c2cf8b36dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4640	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
4640	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
536	GameInputSvc.exe
536	GameInputSvc.exe
5472	elevation_service.exe
5472	elevation_service.exe
5472	elevation_service.exe
5472	elevation_service.exe
5472	elevation_service.exe
5472	elevation_service.exe
5472	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe
724	elevation_service.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
Token: SeTakeOwnershipPrivilege	4640	2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
Token: SeTakeOwnershipPrivilege	5472	elevation_service.exe
Token: SeTcbPrivilege	6064	GameInputSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3340	AgentService.exe
Token: 33	4920	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4920	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4920	SearchIndexer.exe
Token: SeRestorePrivilege	2132	TieringEngineService.exe
Token: SeManageVolumePrivilege	2132	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4972	AgentService.exe
Token: SeBackupPrivilege	4528	vssvc.exe
Token: SeRestorePrivilege	4528	vssvc.exe
Token: SeAuditPrivilege	4528	vssvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2680	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2680	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3520	wbengine.exe
Token: SeRestorePrivilege	3520	wbengine.exe
Token: SeSecurityPrivilege	3520	wbengine.exe
Token: 33	6068	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	6068	wmpnetwk.exe
Token: SeDebugPrivilege	5472	elevation_service.exe
Token: SeDebugPrivilege	5236	alg.exe
Token: SeDebugPrivilege	5236	alg.exe
Token: SeDebugPrivilege	724	elevation_service.exe
Token: SeBackupPrivilege	1172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1172	ReFsDedupSvc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 536	6064	GameInputSvc.exe	99
PID 4920 wrote to memory of 4956	4920	SearchIndexer.exe	106
PID 4920 wrote to memory of 1232	4920	SearchIndexer.exe	109
PID 4920 wrote to memory of 2420	4920	SearchIndexer.exe	118
PID 4920 wrote to memory of 4672	4920	SearchIndexer.exe	119
PID 4920 wrote to memory of 4308	4920	SearchIndexer.exe	120
PID 4920 wrote to memory of 5024	4920	SearchIndexer.exe	121
PID 4920 wrote to memory of 3544	4920	SearchIndexer.exe	122

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f61a075b833ee293ae1a2adf8eaefbba_elex_floxif_play.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:724

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2632

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6044

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3380

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2680

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:536

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4212

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 2732 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4672
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1896 2732 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2756 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1368

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2720

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4972

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5320

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 614c73a8b7b4ccb0aeac7f0b63b0a39a8fd03048d480f771ef8870c44ac36b63
MD5 fa7facfe336a9ee8f0954416634585a4
SHA1 d86fb2cb4d42c38632c2daa27b281b7154b5ee81
SHA512 f5820917c897474782ca87ecc19a1a908c92ccbd35a08b5d703d4c84f5a86ed59bdbc15f5e0f683e6136b78a6f236d4270fb4cd2da2ffad558c0f71622cc3364
SSDEEP 49152:Sb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKQ/lFTjN4:03q6HjBGLm
TLSH
T1DFD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.log

Path C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log
Size 3KB
SHA256 5608445de2633573c6ceb54ea7946132b822006e4979572bcaff895dde733b53
MD5 5df08b742cf4acdfbd50e1ddecb33778
SHA1 92e96b9a4fa504076fade3e6cb96572f69ef4f4f
SHA512 d56732f777fd003cc8339f4ebcdc4d979f7a72d286b2755b14573f0343de55c401f09c8051ca5ec67b5b4f1563afd87542924a0839151712eab3134c6eb4a020
TLSH
T10E51956651B93925090BEF88EDE8BD65FA4DB00D54FD10F5A25AAEBC09F8088D9C7F10
MD5 SHA1 SHA512 TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d6c638bac8f0676da23a0845a0b00e209c8416fe7102897dd562125c28325f1a
MD5 68eaa07c2759f1b6f6a867f490147ad6
SHA1 3ec21da565d2a852d5532f972d450a36ca021f21
SHA512 f19bb3eccbe0f52c64094416261af8a79de27c310173306b1d447957b8277e98aae7ad9255bf8fa2784d3e2c74f1de012dfc21dc17ec615f3650cbb35aeda4eb
SSDEEP 24576:PXYKDtczAlnQ/tbw/2Mkjy6Fr7g0oYsGYagKLTNY5sIpA93/55:VtckQ/lFTjN4GbPNI6P55
TLSH
T11365122867D448F9FD674178CCA29512EB37788947A0E78B03A4D625AF373D81D3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.9MB
SHA256 05a6414d47e81269fc95797199c26b9cd19a0ec502020c25347ead7a8d65c99d
MD5 a20c62a7fb36eac15f8bda2140170e95
SHA1 fb6480f38f10ceb5e56c41f2948c478ebe9b34dc
SHA512 99517f2af27747f1145ddf779b02af38af582cd8a178f7a9ad9a74cdeab38214833b91c10a40b2767ecafb506a530706132c3061129905244f548489b59b9426
SSDEEP 49152:GtckQ/lFTjN4GbPNI6P55+ixO3hHE8MEXWI4bMQN:G+LmKdho3tzfG9btN
TLSH
T13295122977D444FAED570278C8A29615EB377C894760EBCB03A4D625AE373D81D3EB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 cbf8a17ac510fa7330b410937d5c6320d5e812af5f2de5d1c87cfb1c790b5f68
MD5 d2c7cc0562382b49f568cf890d9c9ff6
SHA1 4575053f56b38cb2379b5d156f0aea2eeda64063
SHA512 793bd91588a16a2d4a86619bddbdf2464e89dcfee59dba5d59921019603c06b5d02295bd7b3510d3c9bbb056a749aaf789254e56aa43385f3e2a6a2ce5d3fe3d
SSDEEP 12288:O1XLsswWkxy2lRq2czAFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:8XYfDtczAlnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1A705F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 58ea104b21be018956d54e6e6a893ded281da021dd7a544995757d3729e8e32e
MD5 d4426b48fbd90aac727b0ca5ed24b9b9
SHA1 5f27065f128fbf68e2006bf8bd29f0622ab377a8
SHA512 8bf643b65494d2fc2afa5177b171b80e8943f29bdbf79ad44a14840f52d9c974617ddf07ae9adfc0e33329a54951d3086fec07d4288fa118744ae286a4dcc08f
SSDEEP 24576:t0Le5ji0hmxirM0nQ/tbw/2Mkjy6Fr7g0oVAsGYagKLTNY5sIpA93/55:tPji0AcNQ/lFTjN4WbPNI6P55
TLSH
T1BA85D026F6748731D073C0B9C5D2A69AEE3130865B308ACB4286D77C7E6B7E68536731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.1MB
SHA256 e715bee397b81a23a9b8151c615f6efbec57805ac18b65fd4e4577c63b96e210
MD5 b8e827a8d9bc64c7a24e777711411356
SHA1 528d67c7576c6ac1b7abb0c54f497302b3f392d9
SHA512 34942203e323809f349cddddea66357fed324adbd26b17b77109bb09bcf1dd88f3939eacae643330334a52a248f6447ecb654e4c24936063972d26a5940d703a
SSDEEP 49152:S/ezSC6vUzPvxHjyZQ/lFTjN4ObPNI6P55:WezSC6v2XxHfLmCd
TLSH
T114A59E25F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.8MB
SHA256 b6f71d13c2ea0452f9f405bcb92efc75ec5062d62f8a5a0f237070c990c3f1a6
MD5 89d09f20fed8e560ce0ab2173c293ed6
SHA1 7dda00627341e535d129ae83d2c83e5355fd07ff
SHA512 9399936ca64f9f5a6cee6378f6fa31f8dee28a539a8f3d7d4fc67379a3f3c5e604ed943a1fff199c06bbb644e93d65c5ffa48078c162a689bc909111628b8faf
SSDEEP 24576:7VbqPb88hv/l+6PnQ/tbw/2Mkjy6Fr7g0of9GYagKLTNY5sIpA93/55:7VO88hXl+gQ/lFTjN4cbPNI6P55
TLSH
T1FA95C066F6748331E073C0BAC4D2AA9AEE3234465B318ACB1246D72C3E677D5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.1MB
SHA256 a26f96493e1f3e1359cca45f3037877da0a69299e222c6aa996e2239e7476258
MD5 4b7003daf630f37f6f54724d32ad4fbd
SHA1 250167315e541d61497befe5fddbfe44c5cb84b3
SHA512 9370621735e66fa6bd70960cf0338b2b4d56743adfab712272b0263e75940e0666276961938e2169fd7c297eac76310f22adb3cfbc002638874c523eeaac8f2d
SSDEEP 24576:WRInQ/tbw/2Mkjy6Fr7g0o0jGYagKLTNY5sIpA93/55:JQ/lFTjN4BbPNI6P55
TLSH
T1CD45332D5BD8E4A7FF5305B02DC1B6562F1D0D8EAA94CE942A48E318F97C39874D23C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 07c45b6b5d01d3416b33a0527308df2bec4a62c0cc5e6c9bf72f13f7f4b18de6
MD5 cabf4a723a1152cf17c2699074db9c3c
SHA1 d85773bc86c1e95538e0da0186900f25a4c21b80
SHA512 91922bf4f9d4d6a60a5440d1c0f328c555af60e4c055d988a424927eaaa2105709973095ab7ded16fb1fdf6ae8f5c4627490397e4a025761c411325fa0d21539
SSDEEP 12288:XeBNUbTVO86UHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:XJIUnnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1EF05CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a929c4849a56bb5eb0d54822352953e6c0657be592625bcfbbbd3a5bdc8d1ae1
MD5 dd09b5a71cb2c11ef20ecedf52ad5b2b
SHA1 6176737d98cabe1d7ee094c14c68f2e003d6036f
SHA512 2117b75efb7a14d75259681ca9b7824908ed2e95ef1ce9b851a9505d9a4f01786f37684faa4affffb08c0f15f507555362be21bdd4e904f0cb0c4b7740d82e7f
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH3:8QvGAdlCEL8c/yRNw5CdLm
TLSH
T143267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 74e02206e1446f52dea86e62c21a05868664cd754b0f3d50fa314e313f1b7668
MD5 7374ed9ebd3a130b213228cc5f18e8cf
SHA1 480959c07089e1a0dc577def02f85bb1aaf7f943
SHA512 a798f55f1d19ff4b49d5e8e28472420b08a6ce45844aca3ef731e2dabb17871c78199afb6db87e0a5470ee5a2433f99e3a0052c0d6732a144a12c0d06b9b01df
SSDEEP 12288:PAwSfxL/2Dc34DLLmt0LDQewsAj9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgy:YdewsAjdnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T19A15E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A88A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f4aa2470bd566c85335e369e53a584a488e739d68bde9427717dcb03bc76339f
MD5 1566071e87b828fa9812ce0b57dfa4ec
SHA1 d3a366076f4cac2cbc82b36eb6a768687b7b58b1
SHA512 9c72e3f062786131d6378444db40c7b86121c61668e98eda77348fc04af646f72d17170b601688750a9053415623f52b2bd136d14a35efb86600244cdda18bc4
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:EUEtQevvqc2W1cpV2EI32
TLSH
T191474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5c2a61bbf6ceba10cb4b87b5cbb77fd1aa47e8fbd0aac0458d22f41c1a66cd5e
MD5 cf7f8605bfb28d0a744d99523734bb49
SHA1 bf7b52edfdabc89ed604c7f8fb2aecb4e257c5e2
SHA512 589ec2d12d260a0ad51a88c966f7ede94c3a8129c399c97c57ec89046a5dd9d41c556711669df66ce8524934776a54b5efcc0d8eabcae4159c86c64183147920
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/z9Q/lFTjN4:9oqtVjnmpLm
TLSH
T133D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 43dad1240db569717afb53f1025fdf22400dfa81e7f7b88e86899c591cfc4520
MD5 8fba3ed55b1d097f8282c30dac69ff95
SHA1 4f17a4575e71932647d71f4405a2a96a5c004a31
SHA512 fa4bb33842d96a1be81cb0f6966ce8ed35093f0bb55b7f0f90f5fc4f78de8e536649ffe65afe71152b4b4ef42f26f1028e15393c877ad82263bc01d2916f1cff
SSDEEP 24576:hAhGLJIFoiwtA5l7S53unQ/tbw/2Mkjy6Fr7g0o1:hAMyFoiq5eQ/lFTjN4
TLSH
T1CB35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b8794884afbc0333d3eda7b2e6ab03b674d557c878766273999d68d505d9f077
MD5 743a4f8ebd4fc36129cd5cb17d1ea3fd
SHA1 2d57e822b12f749cfaf5f2c78aa97f8f59d2bd36
SHA512 14941489df1f34127cf0f701420490fbd23a9c1c5624360302f06593e1f3298743936c74b3f3ac35b82c6059439e792dd99cbaf2176ef3bfabfece2c1e0dff5c
SSDEEP 12288:5mw5HEjsChNVBFgl0WDm+C0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMw:UwuoOWfnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T14D05F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 dc7e7fed62df2d04825528224ea92c1f521bca205a51e462e0d76fc441e21f3f
MD5 aa032ce2808c3516a370637941b9ca8c
SHA1 457695bd2a99a936c061d92799c07cf201f8e26b
SHA512 d4e7d7a14df227bb1dd018acc9688c4c3512a7c801369228a814bcb0374c9bbcf284c61dc8c1c2b1f4dcaa72984a1cee767befc91de4a461c9d70c10dacb28fa
SSDEEP 12288:ZBZ1IyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:3ZusnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1D9E4126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 11aeecc71ca6e6e6421dcffef6624823752bb4730036ae65d493374753f1d458
MD5 c32bc461c20b54fed41559636b0a7ec2
SHA1 d707e7cf3594df5b89e73982a78593e0035f219d
SHA512 4a10fb5193e5ee2ee42bd2d86753e8a4e569a14b814ffba878eb273a5e0d6b77670dd5616b3aa686642d7622b27ce63c7c06142ad769012697119e8913761528
SSDEEP 49152:Ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:vQRQyi36YOcPQLvw2gAf+PN3YLm
TLSH
T1F2666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c5fa34c0f4ce34b4ac514489598719051faa4f02a950b0dbe74e1d3c5bcea943
MD5 fea21d0e4a5ec3db51b6ee649459ec66
SHA1 08e50e7d12470e6dec096c0a4aaab5ba6706dd8d
SHA512 b84e8c0f11a7b0e3ae2268fe04ef86eedab4cb9972811f6367eb01387fe5f0c622fc2f804ffa3563a941721c9f2e2c7dcd04c9d651fb2bb55c01b2dd69c8bf41
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uz:JQRQyi36YOcPQLvw2gAf+PN3YLm
TLSH
T120666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5cbc41dd4eefa344fcf074a1af7c0911a1f93e8c22fd67c8e574df869208599d
MD5 cfeed136f0ea7c627de59eb5544f8655
SHA1 4b6df312e4fb4db9a104934a55cd358b789733fe
SHA512 a1f313393188bebe7cf9dbd74ef440bd1b94e9ba3cc5dfc29f643b02882fcb62e06dfe7e5d6bbf5a85b5d90b46929c0bf4025d0fb0e4ba0860ebca36c3662317
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0cnQ/tbw/2Mkjy6o:s68Qg55nhheWu7PNU3/NQ/lFTjN4
TLSH
T15AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2b1cf2306411f822d400aa0d37742abfc4ff95257b6ebb1ec9149da950c593ec
MD5 61003203a78f2cb3c1dd72df1832408a
SHA1 0d270c755721a548c360690c1174fc1f32f037eb
SHA512 4f2205ade8c9c2e37165570b2818572442c74a665ac27bdc36c445b93442e8128d59e137b4cf3777dc335b14fdf920de24c691ff429cf1853c8e887c18ccb3c3
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:Dy5112gYy5azzVvL69nLKnhZrLm
TLSH
T1F3167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 683f1c5514b4fd4b7a5c9a99a01aa6a2177aae7c3917a227b5bfa1b77164eef6
MD5 26d38cfa73ec0730bfbc8a9baba74ddf
SHA1 7612b0a3e3552bdaa80079788fd88c5bb4d2c1af
SHA512 4452e5ffb036e2bd89df366bab489e0752d086e43151813dc6b66bb550afd30b6dd16671bb55db2df759ae5fc9082a6803384af3a2962475cb4705ac83b36900
SSDEEP 49152:8B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glVQ/lFTjN4:Wu6JmVxd2d6Lm
TLSH
T195D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a6f1dc5b8f4a3cb302fb99b6e2d095d8214e2d0bace4439712e599d316c21e5d
MD5 ef28d8c22104298501bb5a8661a756da
SHA1 0e48590e3022a532eeec40488df309882604665a
SHA512 dc7b8712865ff0b24ba362421c0849a2a177a8f0a7c84611573fe549e05cd988bf1464fcc4a2d619e79d8ba1a4babe13ce10a2658608f1f25668fcc54bf7b5bf
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xHQ/lFTjN4:kmifPbRpLm
TLSH
T1CCB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ef96bb60ff56b4b3f7e61b6e70ce6ef139125bc246f406e3f2bdaa4f36726b0a
MD5 be3f157381e6933f13fc24e34f557d12
SHA1 e82e81a50b4bdec7293f11dfc00790e591009979
SHA512 72ea66c20f7ecb1642503e5943bb2d044794c42ef356a09b9243d2d847882c56a0b295d768ad10825fa478332d585bbf45cc520e12b427affbef8dd2506db345
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqsQ/lFTjN4:L5dKTi61PLm
TLSH
T1B9C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6048d0fa3a120589fc69d3c12bc0a4e52e75a027d7205cfc3786bfe725360647
MD5 18d19f2a02b1312558c582b250b012fd
SHA1 4221082079570971365945fd8a23dfdc7325b239
SHA512 b347f3aa653da9d670ff1b1c0dba761088a434d3770f517cdfadfb02f81e8bdee1e8c37908c785b8f2a3c6c80ac8b334d64fb43af2d8a67713bdd176da11c457
SSDEEP 49152:/htSn8EApI0figngiDn0AP5wbQ/lFTjN4:uX2iyphVLm
TLSH
T12F95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 d28efb38e6e5100f7849ac64ed38772e184e2c1bacfc3e3b6fe5a4216ded8cd7
MD5 7ded30b38176824378dcadd5ae803f58
SHA1 b6af2a76ff42df412aba0563160de8cacbf51d15
SHA512 f15a33993fc4807fe5592dbffbf44c22c33433792c65b23322a8e359f77b149c52a006c3a3a6321d7c519d87e63b955f9299749211c1aab050547fd615b9f49c
SSDEEP 12288:OAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:OgnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1A8C423697964F98BFB1706F14C828186A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 f413be91f87d8b846e474a68162d358f54f32c6781f256d2f651ac3b7a74ffab
MD5 cc3280cc92cb39531f3a42acbe87a734
SHA1 812369cc91a67a020ffc4e55a69f6522b5c2e226
SHA512 dd38e0033a0ff9dff6a799187f3b7283eed2dc033230db43199e33900958da32d94c02abfc67a1a0d2c303bc16d140992809beca9fe4a6cae5f65d4e960db800
SSDEEP 12288:yRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:yhnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1E2C423697964F98BFA1706F14C828186973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 7bc791a84eb91c2c55254361023dcf864a718521d4ba692406dc6c4b4fa9187d
MD5 7dd852874d1781ccb394c553ac1f18aa
SHA1 3478f6426658e14f0bd875c7aa767d8eec3c2318
SHA512 94b5103c4af78017262fc280ae2b9c3f7bf6827992a36e2e0588e06d465adc6196b20f84095199658c5b812b9b8b8d2096c276d4e10dfa550126e710451a13de
SSDEEP 12288:DfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:D/nQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T179C423697965F98BFB1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 30c5087b754ce559f1e4bd7f2af82cfe67fa892af4c36fb25da1e8af58c9868f
MD5 bc2210fe5165b884c06157be10c751fd
SHA1 133fecedf6ac17fe6ff9e5949c9f181d0b4b3be1
SHA512 59bf5e037e5f1216319c478f6cacbf7796882aa81b58c5aa9a6dd132c36a0100c8ab7e7470752c567366bbc90647c65d2e093f8ebe9531c67e20f7eab88621d8
SSDEEP 12288:SVOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:ZnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T17AD423693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 3c5233c077a2245ad8c74fb1dad3717e3461c8dacb1523175c168aabc5a24275
MD5 8e78d30b17a8b1d34c9532c2712e79de
SHA1 3cc708b1082c66758be5a0e1719ca13b86c826d8
SHA512 4944f0ad5bc12f1312901af8518407b580a6c0c30ab4184f5d56c63d6ffe63bfb888aac33d0579490ef51351ff8a2f55f749ccab21105940836ee74e090e4394
SSDEEP 12288:1WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:12nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17BC423697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 11afdb9fcc16795a1f6b08c8a7b6eb9386f77cfe088ebc636ff56910b070cbf3
MD5 cfc1a7c964fbd8f5d686c13829fba5fd
SHA1 18f89e61768368f0bfec4de860307e1cbfb1c180
SHA512 4e0d6e41c0151cb41d6f1e97ed25653e21a88d1c4baa82adc31cf6b0bf303e5545ab46971d194b3cd92d16c97b9e87094518579f2f7cd919b2650e1e37b3552c
SSDEEP 24576:Ufwv8k9RX6wkyAIonQ/tbw/2Mkjy6Fr7g0oDAGYagKLTNY5sIpA93/55:QMnYIoQ/lFTjN4FbPNI6P55
TLSH
T19675F029EBD844E2E1B392388DA3460AF6B1785D1B31C6CF0299936D5E37FD46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.1MB
SHA256 06a5304edc07a822839a54439b73d96400961ec28c91d1fecd2b7a1a6449858b
MD5 411b1b0e08944bedf274dcfef18aba24
SHA1 b94e268d6fe5ee52ffacfb694c7156afa7cd9d60
SHA512 8e7f929a46d637efe77742adf675a10cd3d3990b5182cdeff9934440f3affb1f077f26cbc2ea0d9f95ee51b14cdfcd48f7ca9e5ac88f6cce806c12ad8ab7cb80
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07Q/lFTjN43bPl:XySzP4Lmjd
TLSH
T10F168D56A1A841D5C1B9C1B98F07CC1BFB7134090335ABEB02E556936F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ae5542480548aa11f2c40753d126b2d7b123b7fde753a4babca321799383cd18
MD5 7db2ff538fa44b0e675b147373ed8af8
SHA1 1b1de3a62de230c82c748d7615694e39e3239d84
SHA512 17c42308e797550eb2ce49e7d86b971f5fa07a7ce01de14b3df675723584854a1757809eed1d335fa769f44ef75531560fb9c5808b0774dd2e861e10c908c289
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYRnQ/tbw/2Mkjy6Fr7g0o3:l47JUQj1irIhCnDHUPfF/LQ/lFTjN4
TLSH
T11365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.0MB
SHA256 df6ba8f56da8e946600f7447f399190cf6191eca4885235555529ba30821a847
MD5 87170ae4cde5a564e99a82501ac14693
SHA1 a7ab01df1beaeb6dd672777b079148afa7d1ea74
SHA512 17bd7a72d74cdbc5d5975b1068ecefe87cd20389dd97b89333ad8093bd177db4754b24e27c850acbb4e62694e074ab5187c394e6a64f6a758dc6fea232d62e41
SSDEEP 49152:kW7JUQj7irIhCnDHUPfF/LQ/lFTjN4mbPNI6P55:VJ5glD0PuLmqd
TLSH
T1BAA5DF1DA3EC01E5E1BA827889155A1AEA71782E1F31CACF1270837D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 ff2e96ca3add5ef93e51b59a0844b8c04a6ad921b17053a53ce055de4c8f5393
MD5 bd8fef386b0e6fc43cdd1e0ce763a0f2
SHA1 d9fb3217cf3c982e6b0dfe6846a62cae514f184c
SHA512 2b6b79936a12e065bbe5853769d8dc0471e0bfd424ad484b66bae7e81cc01110cbd7b29f0fc350082a84826c70c8934fb469ecb95af6d36b6fee3e3552bf5bd9
SSDEEP 12288:tNsfsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:CsnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T11CE4F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 924KB
SHA256 5240fb5bd6279ebe5c404cf587a01bb64359ad4e1e5aaa405bdbe7d8e67598d5
MD5 9c2d1c8db366367cddd0b33401703494
SHA1 505951ef72d2d47b5b2f7bceaf5eadef1e273e8b
SHA512 e0947c7de26b14c55f8a283105be77db95836c8ea5a2850bdd81965b59e2d5a7b7c9946d8623b1e883871f9fe64675471e8783ad2699f581f9d0b489ee127660
SSDEEP 12288:XX0gbU3fp4UrbpQwUYviufRIMGTuFY3DtQjdRMPeV:XXvUP9rbpQwUY1qMkuG3DtEdRMPm
TLSH
T1521508017666C74FC6A940321E36D1CCABB07D11EE456F0373C88B3FD576A58BAE6682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 385fff392e6c98929cf09e4d6e7a2324f8ace76da211393900297d8f5bc519fa
MD5 e169ea0402147950603e8bebc5fb3b7c
SHA1 850df5d917ac5be4b999dfce2cd4715e86ef6029
SHA512 87f367d9b86f2c1a29f6c624363d7d4561e1f4bff8b93ce2e7a89690232b3891bc86a962d70740e82eb25cbed5d60176d07aa5f7eb339edf72a8c472e751af89
SSDEEP 6144:K0nA7riYDgk2SxMj86lMZqFZkEg6B625TaXMX9pMDoPzSqtMxcLJEFxSuadFhIMo:y3O15Ip2mIOd/CQXOXS
TLSH
T1CF75D9416437938FD1BB6032472A5B4CBBA4DC16B7092F27B3C8453AD86AA05B0F97D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c7d907eb9083f3dba98de5186986780e8208733a6e36655ca88c7113c462c424
MD5 f20db211d9f59b3effd7dfbef3cabc97
SHA1 c143d6167c1a67ad8c17d06893d30f387ed6a6d0
SHA512 fd8b640a36edbe671e30100f563f59599d7535ff154c1abc1d1d444ccc56241ed9462ea20c82534717c3efcc055207f12855eafe893abe695c48d83b4ada0261
SSDEEP 12288:8M7CGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA3:dCnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T197D423756668F94BFA3B06B448828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.0MB
SHA256 972ae78bffb214b1e503a5468492aada70ec38b92c45cb50b86580cb41f6591e
MD5 469001141ad0e1d9f39b958f0e292c1a
SHA1 6a7c30264b5eb4c2dcdebba0b22f06fb0cf82fa2
SHA512 a6ee64f7bc4dbc458b64b4c9704ebfc74d254cd749e3e80756127808f61a9770b00684348efd6eb6f98cc6a7e94d3bb946b39fc47eb776e3f556ab065cd14244
SSDEEP 24576:hgb6bmBIi49WNNFpg1rSvFv7bYCnQ/tbw/2Mkjy6Fr7g0o+6iGYagKLTNY5sIpAF:hgb4mBIBhGFRQ/lFTjN4PbPNI6P55
TLSH
T1A8A5D01E22EC02F5E0F6D2B89DA64417D6B278161731D2DF1251823D2F3BEE89D3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 e473f6169dab51f84197c80feee7aa979dbb21f7311849aaa6eec988e35008cc
MD5 dd86266ac01597f9c293edfa4e37529a
SHA1 e121dcceff0533182460dee7c6809ea4717b06b1
SHA512 576344768754b0ecfaf4c9cf96a6e5fea013647fab80615c6a056bf592faca431354029f867bcb28f256666f6acba0cc27d50e2c76c6ab336449f943b27b5f75
SSDEEP 12288:mNGU3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:SGUGYagKLTNY5sIpA93/55
TLSH
T127E4222E57E910E5FDB242705AA17267392C346D571488FF08E4D238FF28BE47536E98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 9a9233c85cd94035edeaff5caab9b0a58528ca917bd8421c068f6ebcb83ac48c
MD5 f9197db56ab51da0f2d107313540a5f5
SHA1 a15ceeeb32ca5fe0c002e29d942ee56135d0d6fa
SHA512 3a7491757547362b0337e2d33f82fe158ce86219982366503e012c0e669d8eefa3d8a3ee81e363b3fe416a920e118def668b633beed25f9b225341eda5373db9
SSDEEP 12288:lJ3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:lJGYagKLTNY5sIpA93/55
TLSH
T1CAD4231987D844B2FEC215B02E9277662E0C592E9758CCE319A8D304FE5CBE978726DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 9f29edc795cff5f9df4c868a605d6ef64825acfcf30ebcf9f69c6d2ebb49af54
MD5 afb176b15d9ab55d6914fb237baf6220
SHA1 3dbf6db5888163d3f36792b5139b18cebb84c14c
SHA512 f38951afe4f327bdb1fa4979a9993ac8e9ec9394597a555741e433c07cae1fc548fce9fb6c1f6ca446da87b0857246b9f7bd616968e8ad608fd5c0e0c24649d9
SSDEEP 24576:IG88u8FpJqH1bzria7/mBnQ/tbw/2Mkjy6Fr7g0oY:r7ZFPqVea7/KQ/lFTjN4
TLSH
T15735F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d72cdff2888b72ea9331d3a9b9e061fd0388e8586a32d9aecce1e13ea4390d0f
MD5 b0a0ad08679210c3f86a0a5d634f954b
SHA1 48f546a9d3e3c812b759c331b9b5c24bf072b6cf
SHA512 4fbf73be72507ff15bd3a0756811f87a645780c235d32ec23627a9aa82490593e211ca86a02e794591086c71a333ca287923c42c16e8be5a767ad145348160d3
SSDEEP 12288:nHvUrBFrEjwaQTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:nPUr+NQDnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1F505E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f702e2978e574da5a4f4bfbda2a13232d9d4133b37ee3e92b252fc7c3c5743f2
MD5 4c09cedf1e0f1c41d786cd38d4cf946a
SHA1 0caefb2ee2b4f1e2dc5a41b5c93ba3452bb654bf
SHA512 ce58363ec726f80981b6b69acb91ecd033ade4a3eea1bd90bab4c575fa08d9c65412b79d154cc6d72e9e9b8645424e763d4da34dfa0220a2676bc80791f805b3
SSDEEP 49152:+BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzQ/lFTjN4:BG05lO43bBLm
TLSH
T179D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 54dcbbc3b04fec1c0113b4255c66bd149058d401e3ebfa8ff75c451fe8b94c6a
MD5 2e2e8b782bb4b074c7e16148019de1c0
SHA1 2c34458dd7bc65f98f2bdd8b3c5d67112068da32
SHA512 35f90111e2b68fce489845e52e2201ab4ed60c0413454560413fe905da0af3f822e20876b7be1adf9f039023bb85468875868cd9793541cf1f2ca765d88de61b
SSDEEP 24576:Qfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn7nQ/tbw/2Mkjy6Fr7g0oF:oa5POZ3+Jt2pasx2+mNQ/lFTjN4
TLSH
T10465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 29df4e5a69d34cdc4f076e58ca6395f4b36549e0adf59e95934d6e7e0c0e78fe
MD5 debbadb51bdaa593e6c200d13cca9a85
SHA1 8fb883eb889a1faaec703796fc542cbb486ec2aa
SHA512 ad68e1490fbb53beb5d99191b89a7aa091d6a4f34f5c8b7ad7ad69682da429aaa17418fd2120a8f829c5536ff8f1dc6477247f3802fbc2675ec7f09a2fec33a5
SSDEEP 24576:cNcwHdjbyQ4nLC18lb/EOjowL7FkZnQ/tbw/2Mkjy6Fr7g0om:cNc/zEOVHFqQ/lFTjN4
TLSH
T193858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 4b9f118cc105d75b595f1d8121459145e41e8bce410b521ff6446b96641784d4
MD5 47cd57c2acb13b1ec0cadcb2544a4f3a
SHA1 fe00d1312daa179944079b4b984d70326e3e97f4
SHA512 4ac7098f590a7729114ddd6a6e6fdec36a9a1a149a24a10d8340b4fb4cff6684b9924496fbf59095b40efedd48e8519730cbd77a86556f9b44a624302aae08c6
SSDEEP 12288:DUHPJnJP6szeCs6Rl28dH3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:aJnJPbzB4SHGYagKLTNY5sIpA93/55
TLSH
T18315D03DD2A810E8E4B3C2B4815A275ABF31387D2B2569C719B4D5347F12FE0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8198b9f4214d725f2362c2a8d5f612a766c1ffd35e3b1cde0dc9e60c68c06f5c
MD5 47e9bbf1d9addb933fa30a943d6283d3
SHA1 4251713847272465446bca5fecf586a4b5c999e6
SHA512 c4255b5fa4f55ad5da8e4bd9a2ad338d66223a49208393b7ef085af34309f96c471a0207a68ed410867c4c78963bebd5d5fa765055e3f79ac17690eb34baf09b
SSDEEP 24576:/CLHGL0MoeVtFumTijCmlKQWDkPGYagKLTNY5sIpA93/55:/CLHGeeV5ijCmlDWDkybPNI6P55
TLSH
T1E6A56C05A7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80C96A2E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 04d5934218902c4b91aaa8d8bda76e8cc5e37f0f4fe0a281d79ce1badf5173f7
MD5 b65c48400ec4c52b7cf60c1520bd3fc1
SHA1 94048857eb53d57b2875d227e2297fe918eb34f6
SHA512 ab07a9ea19dcb3c7703a2bd87a0ebd2a36c2b164898fcaba802bcc1537eb805ae684337836b347f979f926dbbf83a3eb08efa2693526002932c726720cb7f253
SSDEEP 12288:N1Hck6j5ZI7u3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:N6DIaGYagKLTNY5sIpA93/55
TLSH
T112F4011D23BA00F5E1A7903986831112E679B47D871159DF0AD8C679EFA3FDCB839E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 68d668b36983da22b435ed9db7f7e29ba3215ebbb3745e0647d755c8e6962c72
MD5 e93ec3f51eb82e0f54d228f9bb7a3617
SHA1 220a6fff4989a0d9ee7879210cc259637c7a2862
SHA512 d5f18b8a5aaabbc6d14d273f08737fa2fbc6691b9f309e79dc6b5c842f48182a552d4b61060bfff135a33cc21217774c25770119b0f0c1baadf8fb54fd2d9e91
SSDEEP 12288:iG6kyo3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:LtyoGYagKLTNY5sIpA93/55
TLSH
T199F4120953D810E5FEA201749EA2A2655E3C7C2D9B208ADF15E0E32DFF35BD47831B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 57d4c7ffa1e20aa84439ccb8c70f62b8365bfee0246aeaf5ee4fc48042f7aa87
MD5 5e18c4079fd18bf5bfd062cea17ddea1
SHA1 5080beec3cbbc8e906bbdf6f75e29870084ccdac
SHA512 7e6893f4096e584a1efb01251d6604473f453b517ea092fa873d55e68573c5ceef664adb055bfca295b9b7398247b2edfbb186f12d79a1d38765f6a0e6578288
SSDEEP 12288:Pqu3WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:SuGYagKLTNY5sIpA93/55
TLSH
T1B1D4231D87D804B2FD8215B02E9577662A1C743E5B148CEB19E8D334FF28BD47872AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 aec5511bff3765c9614590ee6a1e06f4fc67d8e668679c3c5eeebcc3707a88d8
MD5 440357b9361f38127f6151d864b67df8
SHA1 586c21c8d4b651f343f75f8aaf35291395dd796f
SHA512 cbfb5088d6ba1e6ce88ac8ab851b02135d3b319490b3bc8347fdb8fe9abc5e1888deb748c47b9c19238de6c2a1d9f6edcb487fe6d642ef53837850f19439850e
SSDEEP 24576:zggILoTfaidZOGYagKLTNY5sIpA93/55:8gHTrZzbPNI6P55
TLSH
T1F9559D1DA3EA05CAE2B2D275D9721493D633B4355771C6CF2448C03A8DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 270fd135fc2eb702afbc2cf3c2790961396aba311c4939c2690eba95e0ec2643
MD5 a66a5d8426ace92d60e9515e5eb0fbd2
SHA1 c898a5e861f2cc4bf09a2b3ccf5bd3a9d447c582
SHA512 8d5119a0de4f4177e00e10ceb374c8722c93aa2dd0bbba5711eff74489684205dee3d397b457add05cfc829b4ce33852f518c2950d9186e0b379e953cc1b85e7
SSDEEP 12288:mpJcm8CN73WVWaRrU1dKNLAV4JNY5sIxfA9TL/55ovT:mrcmR7GYagKLTNY5sIpA93/55
TLSH
T16705F00EB3AE00E6E1B3813C8D825216F6777039631196DF06A0C77DAE27AE97D35B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 2d92c7d0026aad3db4526c2161d6a7b1b3eecbd1c279d69eccaeb4e22beccf87
MD5 61870e460feaef68742b5b3f2571dbaf
SHA1 4f5d12a8dead18948a6986a1aed3d940e7cbcd9c
SHA512 b7ab5c31372c1abe7bb10ee49f06a67380739dc745ee7076257f60a85ccea7bff66e999350e696a7bd4e4f5635f9b8e11af34b1d3ce83c045561a31468b3018b
SSDEEP 49152:hDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3KbPNI6P55:S3Upow8sBhd
TLSH
T1ABA58C3DA2E800A8D9AAC379C54213A6EA71742D3F3055DB0174C178BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.4MB
SHA256 003235ee193bcc446e44cf95fb7b964667f7e7bc9fac98811e01582b58919cf4
MD5 8dc0e736e16b29ccc3de2ed5773dac36
SHA1 e3cc3dd677d42d007f47da57732edefc75c25b3f
SHA512 ab35caa995e2f821b83bb90c682287d70059a0b6eac8ef9f973b2db5e7cf4c623462735afa4bf8a2cdb6cdbfa81d6ca3c031dffa488a59ae9efbdfac7f56d5a6
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYCnQ/tbw/2Mkjy6Fr7g0o+:Agb4mBIBhGFRQ/lFTjN4
TLSH
T1AE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 902b8477dd0f471abcb5a9e1f0da7b479fde861dc9db6efffba4cbaa9a3742f3
MD5 dd8533214e155683185487f5abf77408
SHA1 b631d683fd1c7d177c930a8b58e39dac9ff2ba43
SHA512 19cc14871636c3684e0502cfa30593965035b8205d2d98bb792257868d72d159eba48875cfc62c617643df453d516469fa49192d59d977231d177135ecec4c66
SSDEEP 24576:a8kNvNnaFeYhJNtmZBmZnQ/tbw/2Mkjy6Fr7g0on:a8MwBtOmZQ/lFTjN4
TLSH
T1DE55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.5MB
SHA256 7777595bb59367a0b72ff9ae423012c489cadab5993e2f7516ff18f7bf19bdf4
MD5 219b3f76d467fd0dbe9afd2a176518d0
SHA1 cabdec5470e9e94f7760916e4f729dfc5ebbe8f0
SHA512 9f86afab32bcaebaf1c6fb74900dd5895f40c5f3071c915b7e2bc03df7b7d225ae2220f31ce895c0707042390997aeb0be989cb9da82a81536a68550e2fe7d31
SSDEEP 24576:rD3FHshBIYQgAAnQ/tbw/2Mkjy6Fr7g0oxYGYagKLTNY5sIpA93/55:rDVHeBIAAAQ/lFTjN4XbPNI6P55
TLSH
T11D75023DE79C04E5E977C1B89A939606E77138AD032156CB0694C179AF2BFE43D3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95655cb58f8562d1.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\95655cb58f8562d1.bin
Size 12KB
SHA256 89f72ccab42007789fa577245ae0bdce6d8266139b3116fa57e92915f8818ad2
MD5 14db411c66f8cb068271dff7f9a81125
SHA1 4aa119cb258becd63bc47f4df5a2c190d5ccf567
SHA512 300d9a9c4ab0b10b4cbce7ec84e84b0702fc531e11f5b53cb6ce02ae658a24de71bb260d0541d39714b036d660b4a27a75d9a6e3c07e82df11c5e3e03223abc2
SSDEEP 384:OfJVQIUiUvbQG/AEF4aSDbqLYZmOUOjYQob8eDak:OfnQTi/z26qc/UOjJgPDR
TLSH
T14142BF8D2F6ED410C304544AE1D54AFD2082DEEEC48A878D2FAAD17F6E09E55C1E2E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/536-173-0x00007FF637540000-0x00007FF637608000-memory.dmp

Download

memory/536-175-0x0000026495D70000-0x0000026495DD6000-memory.dmp

Download

memory/536-432-0x00007FF637540000-0x00007FF637608000-memory.dmp

Download

memory/536-174-0x0000026495D70000-0x0000026495DD6000-memory.dmp

Download

memory/724-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/724-156-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/724-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/724-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1172-835-0x0000000140000000-0x00000001408EE000-memory.dmp

Download

memory/1172-810-0x0000000140000000-0x00000001408EE000-memory.dmp

Download

memory/1312-840-0x0000000140000000-0x00000001405C1000-memory.dmp

Download

memory/1312-822-0x0000000140000000-0x00000001405C1000-memory.dmp

Download

memory/1368-261-0x00007FF610E50000-0x00007FF610F69000-memory.dmp

Download

memory/1368-263-0x000002743B000000-0x000002743B066000-memory.dmp

Download

memory/1368-507-0x00007FF610E50000-0x00007FF610F69000-memory.dmp

Download

memory/1368-262-0x000002743B000000-0x000002743B066000-memory.dmp

Download

memory/2132-404-0x00000236F5740000-0x00000236F57A6000-memory.dmp

Download

memory/2132-550-0x00007FF67C0B0000-0x00007FF67C244000-memory.dmp

Download

memory/2132-400-0x00007FF67C0B0000-0x00007FF67C244000-memory.dmp

Download

memory/2132-403-0x00000236F5740000-0x00000236F57A6000-memory.dmp

Download

memory/2172-468-0x0000021F67070000-0x0000021F670D6000-memory.dmp

Download

memory/2172-467-0x00007FF6A23B0000-0x00007FF6A263A000-memory.dmp

Download

memory/2172-469-0x0000021F67070000-0x0000021F670D6000-memory.dmp

Download

memory/2172-559-0x00007FF6A23B0000-0x00007FF6A263A000-memory.dmp

Download

memory/2632-68-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2632-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2632-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2632-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/2632-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2680-144-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2680-122-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-130-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/2680-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2680-701-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2720-276-0x000001DD2CE20000-0x000001DD2CE86000-memory.dmp

Download

memory/2720-510-0x00007FF79B640000-0x00007FF79B6ED000-memory.dmp

Download

memory/2720-275-0x000001DD2CE20000-0x000001DD2CE86000-memory.dmp

Download

memory/2720-274-0x00007FF79B640000-0x00007FF79B6ED000-memory.dmp

Download

memory/3340-195-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-202-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3340-206-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3340-196-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3340-204-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3380-103-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/3380-109-0x00000000008A0000-0x0000000000906000-memory.dmp

Download

memory/3380-100-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3380-260-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3520-498-0x0000017E6B2D0000-0x0000017E6B336000-memory.dmp

Download

memory/3520-499-0x00007FF7DBC00000-0x00007FF7DC106000-memory.dmp

Download

memory/3520-500-0x0000017E6B2D0000-0x0000017E6B336000-memory.dmp

Download

memory/3520-561-0x00007FF7DBC00000-0x00007FF7DC106000-memory.dmp

Download

memory/4120-235-0x0000000140000000-0x0000000140311000-memory.dmp

Download

memory/4120-418-0x0000000140000000-0x0000000140311000-memory.dmp

Download

memory/4120-249-0x00000000030D0000-0x0000000003130000-memory.dmp

Download

memory/4120-256-0x00000000030D0000-0x0000000003130000-memory.dmp

Download

memory/4120-255-0x0000000001BB0000-0x0000000001C16000-memory.dmp

Download

memory/4120-243-0x00000000030D0000-0x0000000003130000-memory.dmp

Download

memory/4120-242-0x0000000001BB0000-0x0000000001C16000-memory.dmp

Download

memory/4120-236-0x0000000001BB0000-0x0000000001C16000-memory.dmp

Download

memory/4212-399-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-501-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-155-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4212-165-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4212-496-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4528-560-0x00007FF612400000-0x00007FF6128D0000-memory.dmp

Download

memory/4528-488-0x0000023EEEC10000-0x0000023EEEC76000-memory.dmp

Download

memory/4528-489-0x0000023EEEC10000-0x0000023EEEC76000-memory.dmp

Download

memory/4528-490-0x00007FF612400000-0x00007FF6128D0000-memory.dmp

Download

memory/4576-88-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4576-95-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4576-234-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4576-89-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/4640-128-0x0000000004B40000-0x0000000004BA6000-memory.dmp

Download

memory/4640-14-0x0000000003250000-0x00000000032B9000-memory.dmp

Download

memory/4640-148-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4640-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4640-1-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/4640-6-0x0000000000B80000-0x0000000000BE6000-memory.dmp

Download

memory/4640-20-0x0000000003250000-0x00000000032B9000-memory.dmp

Download

memory/4640-19-0x0000000000B80000-0x0000000000BE6000-memory.dmp

Download

memory/4640-150-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/4640-80-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4640-123-0x0000000004B40000-0x0000000004BA6000-memory.dmp

Download

memory/4640-70-0x0000000000400000-0x00000000005D9000-memory.dmp

Download

memory/4868-310-0x00007FF7CC7E0000-0x00007FF7CC893000-memory.dmp

Download

memory/4868-520-0x00007FF7CC7E0000-0x00007FF7CC893000-memory.dmp

Download

memory/4868-313-0x0000023C93D60000-0x0000023C93DC6000-memory.dmp

Download

memory/4868-312-0x0000023C93D60000-0x0000023C93DC6000-memory.dmp

Download

memory/4920-487-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4920-211-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4920-218-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4920-212-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4972-451-0x0000000140000000-0x00000001404CB000-memory.dmp

Download

memory/4972-447-0x00000000012C0000-0x0000000001326000-memory.dmp

Download

memory/4972-455-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4972-453-0x00000000012C0000-0x0000000001326000-memory.dmp

Download

memory/4972-441-0x00000000012C0000-0x0000000001326000-memory.dmp

Download

memory/4972-457-0x0000000140000000-0x00000001404CB000-memory.dmp

Download

memory/4972-439-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4972-433-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5236-108-0x00007FF727540000-0x00007FF727662000-memory.dmp

Download

memory/5236-273-0x00007FF727540000-0x00007FF727662000-memory.dmp

Download

memory/5236-111-0x0000018B87E50000-0x0000018B87EB6000-memory.dmp

Download

memory/5236-113-0x0000018B87E50000-0x0000018B87EB6000-memory.dmp

Download

memory/5320-513-0x0000022622A20000-0x0000022622A86000-memory.dmp

Download

memory/5320-512-0x0000022622A20000-0x0000022622A86000-memory.dmp

Download

memory/5320-562-0x00007FF74EE70000-0x00007FF74EF9E000-memory.dmp

Download

memory/5320-511-0x00007FF74EE70000-0x00007FF74EF9E000-memory.dmp

Download

memory/5412-183-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5412-461-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5412-184-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5412-190-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/5472-26-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5472-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5472-32-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5472-35-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/6044-78-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6044-72-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6044-71-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6044-194-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6064-154-0x00007FF637540000-0x00007FF637608000-memory.dmp

Download

memory/6064-398-0x00007FF637540000-0x00007FF637608000-memory.dmp

Download

memory/6064-157-0x000002093F6E0000-0x000002093F746000-memory.dmp

Download

memory/6064-164-0x000002093F6E0000-0x000002093F746000-memory.dmp

Download

memory/6068-528-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6068-530-0x0000000001340000-0x00000000013A6000-memory.dmp

Download

memory/6068-522-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/6068-521-0x0000000140000000-0x00000001404E6000-memory.dmp

Download

memory/6068-565-0x0000000140000000-0x00000001404E6000-memory.dmp

Download