0dc17fe81823652c38b170b8b49748b5e31d0cc6e980d54d9de7b9c379c629ff

Analysis

max time kernel
149s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
Size 872KB
Sample260913-ptcl3sbc46
SHA256 0dc17fe81823652c38b170b8b49748b5e31d0cc6e980d54d9de7b9c379c629ff
MD5 8ffd000a5c8d9c47c71a4735523c0bec
SHA1 95adce167b294d8fe14fc20344c49fd0125c2fc6
SHA512 85097dc2b0b88cc0bd3df7734692790df7f9db6e1d2543cdae1c1d2a7f9ab3014db67e80f996b456ca1e163656afb372b0b82f017f9bf713e6100f2912c8d0b7
SSDEEP 24576:lvfHb10S7U1XZZdPVTdBdf6efpGHa/9u:hfHb/w1p7tTdvySga/9
TLSH
T12015F02073E49071F27719329E3A9B714D7FBC369872848E63D97A1D5E32BC1C528B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1848	alg.exe
2132	GameInputSvc.exe
4884	GameInputSvc.exe
4888	elevation_service.exe
5376	elevation_service.exe
4276	maintenanceservice.exe
940	msdtc.exe
5560	OSE.EXE
5648	PerceptionSimulationService.exe
2488	perfhost.exe
1708	ReFsDedupSvc.exe
5936	locator.exe
5784	SensorDataService.exe
2380	snmptrap.exe
1224	ssh-agent.exe
3296	TieringEngineService.exe
4928	AgentService.exe
6080	vds.exe
1832	vssvc.exe
5772	wbengine.exe
3260	WmiApSrv.exe
6032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\de44b24b227843b8.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	alg.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058d3b8ad7c43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009e4d8aae7c43dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bef61bb17c43dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4fdefae7c43dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4884	GameInputSvc.exe
4884	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2804	2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
Token: SeTcbPrivilege	2132	GameInputSvc.exe
Token: SeBackupPrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3296	TieringEngineService.exe
Token: SeManageVolumePrivilege	3296	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4928	AgentService.exe
Token: SeBackupPrivilege	1832	vssvc.exe
Token: SeRestorePrivilege	1832	vssvc.exe
Token: SeAuditPrivilege	1832	vssvc.exe
Token: SeBackupPrivilege	5772	wbengine.exe
Token: SeRestorePrivilege	5772	wbengine.exe
Token: SeSecurityPrivilege	5772	wbengine.exe
Token: 33	6032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6032	SearchIndexer.exe
Token: SeDebugPrivilege	1848	alg.exe
Token: SeDebugPrivilege	1848	alg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4884	2132	GameInputSvc.exe	89
PID 6032 wrote to memory of 4428	6032	SearchIndexer.exe	111
PID 6032 wrote to memory of 6000	6032	SearchIndexer.exe	112
PID 6032 wrote to memory of 6084	6032	SearchIndexer.exe	113
PID 6032 wrote to memory of 4612	6032	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_8ffd000a5c8d9c47c71a4735523c0bec_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:940

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5784

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1224

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6080

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4428
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2676 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2904 2856 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3506356a5bf2dc780a1ab7abdaf6bcaf84c11876311b685e750317a6adfc2566
MD5 9a90114dfd77ab207122732e3fedf3b0
SHA1 2ec375f806e4095bbe41c51c6dcb51ba02f72a6f
SHA512 6442669c2195f69b196a4821774fbc41970c085de5c001f77ebfae99ce26ff7850c4efc9727316a4d4655e94dd55b08c0f4266dc0578ba79890ea4e63127df5d
SSDEEP 49152:tb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnc1p7tTdvySga/9:z3q6gjB/fdvyS5V
TLSH
T12ED59D03F29900E8E06AD178D7469133EAA2BC890B34B6DF0794B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 d797bab4591fcfa88e9e53f5fac1ad805a3d1613471f797c65021935a6519ed1
MD5 cbb9af1ca0077c9b40e54e0e032432ee
SHA1 fa19015062a0798d16ebd76da0018316d47051c4
SHA512 84a6ef4b02dc78995088f9edce3fa333cc2aea9a4462a152310953fc9d048b20e793323c096903126dc8ddb3bbb2d5f58f93d2ed3456ed774233e5161a0c0bae
SSDEEP 24576:0XYMGtczAy1XZZdPVTdBdf6efpGHa/9u:TtcF1p7tTdvySga/9
TLSH
T1E105012473D548FDED67813DCDA28611EB33B85587A0E79B03B88A651F232C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 496dd1dfe04b9531988371b2e006a104de4872f1f0ccee694cd994ffd8db02cf
MD5 a2430df02f884b656a0f1f338037ef61
SHA1 168b5be1191ba44ad539ca6b6629a69b1aa71043
SHA512 2bbc47e517e917f19c71b1a522be1470dab9c7991e1a6888122908e33d93406ade8af8eee0321437a6470e4c34136543ff38c78a09d03191356d5505716dc9ad
SSDEEP 24576:g0Ne/RP0fPxOrM/1XZZdPVTdBdf6efpGHa/9u:gPRP0HoM1p7tTdvySga/9
TLSH
T1DA35AE15F6748335D073C0BAC5D2A69AEE72308257308ACB4296C77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 825a1f367ef66b1c44bea0c88d0a323f415a0400df6dd90afd983d52362d4d0e
MD5 26edde66ceb14553eddfdf0ebea2f23a
SHA1 be1f9d2f620dd16b8fe64f8f1856828afb2d54bf
SHA512 140d2b71e769dbe6d2e00f8063ee4f5611613071e32ceb236e44993ed7ccbb8c3eef701a08b6ea205187b802ddbf068237f0828261ad50c05bcfd4c7ada52f29
SSDEEP 24576:v6S/ezSC6vUyD/aqgrvW/6q8wyun1XZZdPVTdBdf6efpGHa/9u:f/ezSC6vUzPvuHjym1p7tTdvySga/9
TLSH
T181756C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ada7ec29f851de2413c4e9e0a21f0c59f92c29aa76043ef6be73ee45accb6781
MD5 d0e4d1f0b08d3fd182b3ca43595dbb9c
SHA1 d49dda996065e706fca6f0f518fda46daa1b993a
SHA512 2251835224cd97ebd0c547549774a2547563e44fb34f4c0fca193d6b811c7adc8722b90f28361766390f72ac891edb9b89215a1f5081f29e7c149126c276a3b8
SSDEEP 24576:BabGPu/Tjv/l+dZ1XZZdPVTdBdf6efpGHa/9u:Baz/TjXl+31p7tTdvySga/9
TLSH
T158559E65F574C331D073C0BAC5D2AA9AEE3234425B318ACB024AD76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 5b8ebdc92da6bc68de5f61e6261e16e067877811150783f6f9b35dda2761fc5d
MD5 5221b19aef6a107f4ea454e14a886278
SHA1 1f51552d891b7342eb9a4517f68d7f91a9396772
SHA512 7bab3aac75400940358f06d4dd65259ac4607dd027ac11e4359a3f91bd9d480b47588ec7e57f17c2ebb03d4e57648ad27340654b1b8c45ac01baaf221ad74f53
SSDEEP 12288:QP1f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3Wni5:QPN1XZZdPVTdBdf6efpGHa/9u
TLSH
T179D423A1B30AF9ECF7285037DD662FE15B23AF16D5E04EAA063EDB945324082C11F725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 d42976796f24c74042772578f048a35404c0ad8007c6c2531b8470c1fac6c436
MD5 84322a7b8e633e2890b802a20ae05bd5
SHA1 507179d91d10d13980636c1a3466a4a18e8eeb93
SHA512 0cdc68d627058e99714067845a0efb849562c92cd2b34eb40723f8dd478c8d76bfe9c5e000366f58a9dacaee2e08485f3806fa457412462d3f8d9f5c848c77ab
SSDEEP 12288:neBNUbTVO86U5rf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwQ:nJIUh1XZZdPVTdBdf6efpGHa/9u
TLSH
T1AA15CF3BEE28FCE2C27A8C795A918740977274314B61A3CBD179830EDE235D15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 9ad1ed00cd7887b68c492ebb7a7b1e7885365546821e2416728c600ec3c90f77
MD5 f6d5997eeef3daf2664b971a95d97363
SHA1 91ca69d57e0dc0f620582af5f6f234ae10386599
SHA512 faad39bd401c2a458e9bde09b6b3d9ecb27e45079224029c33de9169a9bd07d22085be98f940aa06958de5015c20539c039950b3b05beef96498c02a2b4b3e92
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ69DN5JxNRV3THH:XQvGAdlCEL8c/6RN15CyfdvyS5V
TLSH
T1E5367D656BF880F5E1A7E134C97A86B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 628d89c3a87df42dd9c3ec995f4fb0ec08e175cd73c4f76f1690ae4741a5c7be
MD5 545a73e5017cad96d254cd28cc59df18
SHA1 cad44218b04702bfa880ff79fa48158fc7bb20f0
SHA512 d71df7facba4caf0280bc3a8c171b433c02a493c2cb7bde240c01017d4f3cd308fd849fa2bfd0f7a21fc1dbdac0fb982898bca2b44ec0e46cb3519ddcd351277
SSDEEP 12288:1wwSfxL/2Dc3bDLLmt0LDQewsAjJf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0H:KmewsAjR1XZZdPVTdBdf6efpGHa/9u
TLSH
T1CD15E031FA75E436C77B0CB61B36D716143DBA204BA11AC3E3AC8E9D56301D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cc04442fb600b0ff3543b49309ed678fad3687252cd87a92106aa178e1c289cc
MD5 7cb2f712c0747cbea96e400c92b0f045
SHA1 6b8ef33bb887fa8d1709342bd14a4012915a8aa4
SHA512 813867779fd57d82e0a107e2407619ee08fccf27cd1b9ec9f10dc9be406793d379e76526c0ac566b8840dc1be1cdf014abe6a8a58437f561d3c0d2924449d9ef
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrLdPlbuJHllvtf:xUEtQevvqc2W1cpV2Xr52f
TLSH
T1F0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b3b4d32d920b913a7c2da8dd2fbb49ce18f13911f89b0e177a50e1e7011bf2c1
MD5 061b0f0ac783ec6b6e13400f4d522ac5
SHA1 8f3e2ca62d91be55b2a3dc7b8be6c34b90af1093
SHA512 d458799db5429f0bbde43581fd54353d3b9e4cf5bd7e81337da138a2cb1904e84fa769e373b0047074b0b46510138b1361f1710b9762f947edb29fb8b6bc719c
SSDEEP 49152:bRbRquA/m2yL5zMfFiV+XenmE3/zX1p7tTdvySga/9:Voq1VjnmKfdvyS5V
TLSH
T139D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7331093b1e0e3d5468fd3eb214bba6c903eb996015135ede5c3c4d378d047942
MD5 c8f6def6f8da9cc83febb889f1b35f3f
SHA1 8dd54e22011c4cba1315d78cbdc186f62b8fda13
SHA512 a0c80aa2ff62ddcdd752cdd27a6e5e9cf13a2ddf9d0e2fc2a98a7d3d44a51bb45a5237549f18de1d57034a5a7ebabe53ae3f06af09e5b7b920d250f7a22a529e
SSDEEP 24576:BAhGLvmFoiwtA5l7S53L1XZZdPVTdBdf6efpGHa/9u:BAM6Foiq571p7tTdvySga/9
TLSH
T15145AD80E7F955D4F5B3AA789DB69570EA76BCA65E31C20F2164C21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 8c7972373b73dede95028854996e67f01d1dc051b1d0ee3f4982e2a5a929ee21
MD5 e1c613846f3a702c5e0de45ee756e4b7
SHA1 03f15a31e0ed93c5c770ea0294865a738e4817df
SHA512 6608597a85b810863ff4bb49713f3d1149b1b18a37676d581647c48e873e404d5b95cc33cb012c2643495a1172bce8cbba3895812aa73d69cbc0c60f43aa3525
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+Cvf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezN1:Owu+OWW1XZZdPVTdBdf6efpGHa/9u
TLSH
T1F405F14573A55CFDEA66813AC9578636F7B3B8022A21CB1F0364C75B5F33251AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 f0a736d12762dbcf571affa0a4b669e470d0bacdaca35f3af82584ceba4ae986
MD5 65233ef793dcde797856c40f8962ae57
SHA1 5a2d17d6c74cfdcffa15c190baeb4b7cab1000bb
SHA512 70a4062e3aea2ef476719d066363af69c99aab169f90e2939fd45a57cdae2371b723c974594dd8b2626c6d27d76439f22f9d3e37f513aeb84da1582d63ae14f4
SSDEEP 12288:Nw/1Ie1f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+D:2/uC1XZZdPVTdBdf6efpGHa/9u
TLSH
T155E412953398B0F9E266513ECDA11B85D772B523A37143CF062E87A52F226C29D3E731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e0932a013f24576519041f368a1bd0cb03af78e04a809b4f3dc177368a168775
MD5 91e5e23dc41ecb274c33b2b107739ca4
SHA1 c66c5ad5122906fd8da3e4d004446f37a9ab0924
SHA512 eaecb3cffefa4b43175b0a0d39689d1491360e961ecf3e400fd95b2680556da4dddd1ed909c870e68b25ed6cf702d9180082aa6dba3750d4d7033f9a8dcb9337
SSDEEP 98304:XQRQyi36YOcP8Lvw2gAf+PN3t3fdvyS5V:GQyiKa+X+PNRlvtf
TLSH
T1CF667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7c7b9198546a740b39936ae126d3606c8b10c1f824710a70522b929d043067de
MD5 158a4b40f7fed8927537a5114f3c704a
SHA1 50a19c862018605f217a57766b73d02c95a1032e
SHA512 9f54485514fdbb6dc1c3b9fba5a6d8f64bec8bb18d74b43848c8f1c1ead3a82c9c1d12a966cb3618538c93e33cf187cb698b1f60f34aae86a919b752e6b777e7
SSDEEP 98304:XQRQyi36YOcP8Lvw2gAf+PN3Z5fdvyS5V:GQyiKa+X+PN7lvtf
TLSH
T135667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9b92f886ba38ead871091eaddb4cdd07f2fc1bd31389933f5ee6e467f1bd73f9
MD5 012f3f33f38235b934601edb9c59a7c8
SHA1 2ca9363f96407c28f686f4a8d189bec7e9d5bdb7
SHA512 bda0522dfe21f827f47eed78c7534d651c46d4777b9c8e3fb2876e0a7c3ae8a8e99145982017b603cd80b6aa00f2f8cbbe1e63a2974030a07499799be63b2d6d
SSDEEP 49152:168Qg55nhMeWu7PNU3/SX1p7tTdvySga/9:DthbRc/SFfdvyS5V
TLSH
T1E5B55933B2F600A9C44DE1769F4A872196D27C75CFE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 915d4adff00ca54f48cecf30d8558033453e150d64995c1ac829835954d2069c
MD5 d08554ca525034c45fd61da731c72fd4
SHA1 3f9d20d031293ad715e870cf496b5d896f062457
SHA512 f2039033c969a5ec677e0adfa433cc1ecdd149c9d2ce0ff6d795fa15349b1057cf1b791a779881c04438022a4bbb7a4cbaa893bc7e5a3f9ba70f7ce7d4a02ff3
SSDEEP 98304:Gy5112gYy5azzVv569nLKnhZNwfdvyS5V:3LIHAWh8lvtf
TLSH
T1D6168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f023d8825acacf8767cdf67bfb6a9ef9d7275c452d6735ad1120d0f0894682ed
MD5 f2666acbef0efd824e20cf7ceb12356b
SHA1 bcadc4697c61c4e31e23d2d9c8379bda6f46ab42
SHA512 83070912940e8cec44bde1d5b5518e72cf98ac33774286df936195c074f42bda6bdc7e47fcbc80b1ddc8157265b7692cf3bd34c84a60f5e9d1b8cd0147781b98
SSDEEP 49152:XB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glw1p7tTdvySga/9:5u6JmTxd2dwfdvyS5V
TLSH
T19BD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.8MB
SHA256 78b9387d1e81b61240b418d39ffd62ef5e7f54fdf6ac4671cb739115b97171a6
MD5 c6e118512998c13c5d1372de3ba4c8ed
SHA1 6fecdb6aa35fcfdbb9c557c4e9efcf904d56a4c6
SHA512 af64d0e6b5807fe5b36af49b9b97ccc02b0caa97bfc201b2986f419bc19f034fd249b1a7c3853131b73f6ccdc68c9b1dafd3df95fb6a8c2749af795a2568189c
SSDEEP 49152:k1hpsNoJpF1A6yU44CwH7R4xx1p7tTdvySga/9:kmifPVR2fdvyS5V
TLSH
T1E6D5BE13F2D900E8D06DD17987569632EA62BC460B30B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c36264755b76d1573795b34b8f23f6365ecc149166956c9f208c41ad33cf80ab
MD5 06879dff26337b3be58960209ca3896e
SHA1 7a5bb0f117252191e706013fd15560837d8e6d72
SHA512 673901b1a1e87305537145ebb0437e8e9abfb7eadea97218ea323e465783a1b18142a119353f4ca00658f366a4af7eb9757f6e80c4a51a4a70b69b70e64faa58
SSDEEP 24576:Gbwvtk9RX6wkyAIR1XZZdPVTdBdf6efpGHa/9u:nMnYIR1p7tTdvySga/9
TLSH
T1E335DF29EBDC44E5E177913D89B3460AF6B178295B31C6CF029A53AD0E33ED49D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 064637fffc10c8c20ee2cf77d7c6ef75d150eefc879dfdaac8b104f92336c499
MD5 46ebe9fc990251440312cfb7e25e45df
SHA1 a810f595fc18714bd493bf6a6a76d6cc0d3c9963
SHA512 066d30388b38e617b12ef37f17f149c92725b97b7a338e0811258cc548bf92dedda61869faca204c7037e224d6903c68af1dca7881c9ca740a3a7c46ec7c77a2
SSDEEP 49152:KYbKNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK031p7tTdvySgaV:qySzPdfdvyS5V
TLSH
T169066C96A16841D9C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 c42fec1a82ef3044fa66bee6694a714fb70413b421dbcb1f9f1076751d7dba82
MD5 15966886eaab068cf5e3c77a58fe9924
SHA1 910918719dca30dd29e0701bf3adcd941f962130
SHA512 89b2bc480c57868e09b2b1fc0c12767969a5a12eae102912927955fa3b97d5aaea0a7ccc4b9f331bffef51b624657f5f39950beeebb576085e718271d6fd673b
SSDEEP 24576:6eS7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYo1XZZdPVTdBdf6efpGHa/9u:lS7JUQjXirIhCnDHUPfF/m1p7tTdvySf
TLSH
T1CF65AE1DA3EC01E5E1BA927885154A5AEA71742E5F31CACF1270837D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 43498e508b2f23af028480742b48c8802fb3f0c42509ec42cdeb69ec831cb568
MD5 6eeb8a18a683ad54dcefb6a0ebb97e5d
SHA1 dcd9e2fae3dbd25e28fb1542501d6a9007fce334
SHA512 74b763e4a18aaa4aa4ee2885b5a27fb191df2b99dee997c99887ac56e42e1c9430c4fe7745667ad2f5240205b901dfd4b75eaaab5b8d8a6511ff41518adcbf4c
SSDEEP 12288:Visfaf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WQ:7S1XZZdPVTdBdf6efpGHa/9u
TLSH
T12AF4F115E25852E8D16E617ACB521A80B7337D2683E1D3CB12D9F63E1F352809DEEB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 de8d73b5445dbb59231c75cfd6a6ed559528aeb5016dbd1307ed8b803ce01e77
MD5 7ae1b4563a3ad6c7f5d37421e66018df
SHA1 70dfe34e9bf740f3a43af633dddbe6281ba7e7e6
SHA512 46021f92df00630b05d1c89956506a4e67f0b97a6fc97d186387cbbd8fcdb20db53211277b4effbf11479363c11e733bb6dd0f47d6b99b296e0e3df2af72656c
SSDEEP 12288:cv7/f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:a31XZZdPVTdBdf6efpGHa/9u
TLSH
T171D42371B30EF9DDF7385037CD661B606B2BB727DBA085EB561E879463201C1892EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 60c07c47d7ae880c8c6b3488e5e5c01d21d052f6491bc847892fd6d4ba2d271d
MD5 a5a978de2339365bd5d60975c4fdafff
SHA1 20f3451262253f008cdf3f037a08558aa4562771
SHA512 3375940e4a1bb2b4b528cbb7ced35c160a8c5980de02b02fb4718d1bb8858e21233b70d1ea5fcc7822516216bf464b4011c2706e7aa2df1bf358b9d99e5ea8d6
SSDEEP 24576:FXgb6bmBIi49WNNFpg1rSvFv7bYX1XZZdPVTdBdf6efpGHa/9u:dgb4mBIBhGFe1p7tTdvySga/9
TLSH
T1EC65AE1E22EC02F5E1F9E2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 a9b5909f30d345cf0f1076322a122b1cd88b3e9c381c6789215b676b70a4defc
MD5 e6409b44f3b1b37c563900bd34cc2072
SHA1 a7da427ff124b26d0f496ef559f4be568f407460
SHA512 14a211d0b885ca6e36977b7dc9967162e9d7148ffc831f8b802eb8a5f51e72863f257248267c5fe50085338223f04943b2ad90b75625aad00b9aa8b86c727589
SSDEEP 12288:RkGbf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:CGT1XZZdPVTdBdf6efpGHa/9u
TLSH
T157E4227432AAF4ECD739813BCC611BA27A727322976016FF05AEC67597141D0A23EE24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 f0ac28822ae64fad0f1c5ce3e477c43bf2a5834eec4f05a13e1ec91e4a3abb95
MD5 07f297b243ce55f289f4e42f184db8eb
SHA1 c0445e06d2db4415a820bc3d0fa698a3ab3bf3d8
SHA512 747690f355bac06bef3827061eb4999bfe302b7c504a3ac8f562ac9c2227203331e8f6a8220f30e1a2aadc9e2651288edbb078ed9839013b56a131b1607f5ef1
SSDEEP 12288:06f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WniPh:0y1XZZdPVTdBdf6efpGHa/9u
TLSH
T15CD423A0B20AF9EDF724503BCD622FA05B23A723D7B11AEB466F875153541C2913FB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 5180555d1c1a0671a2e22fc774a86c15f0d03f2626acde27ac4203120ff2c2f2
MD5 833a2ba26884be713d79b90b58aa8ede
SHA1 740268051a06c3fcf37daa744151889cab3aaede
SHA512 ac27d98eddb821c83f063b4f73ca14c3026b406b17156c67886d434b845afb685610393d54e854d54787099c67b356fd8ca18c610ebc01948591435bad63d401
SSDEEP 24576:XDbA8u8FpJqH1Wzria7/mw1XZZdPVTdBdf6efpGHa/9u:TbZFPqVha7/J1p7tTdvySga/9
TLSH
T18935F16576E101F4D47BD139CA824AA3F6B2B4260364EBDF07AC8B511F236D54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 1e163f85cb258117d1aa231f25b37340ec04baf6132a3fb1baac29817c5e909c
MD5 53c7706cc840578d02cf658021c9c938
SHA1 d7510e374de7e64017d05fd2c2ac51f36714acdb
SHA512 4b80f62acbde02a0b1ea8cbfd72d7363fffca712b167470a487cc8bdf1054f3ad9b19025de0ef42a2dacbf37467147f689aa1485557c908ba0775f9c4385cf60
SSDEEP 12288:MHvUrBFrEjwaQff1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwQ:MPUr+NQX1XZZdPVTdBdf6efpGHa/9u
TLSH
T1DE05F12F329D18E9F676E17DC9424719F772B462031192DF02A5817E4B639D8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 8193b7ca3929d90ee4c8031e945ef9b200e95a68223cb2f6029d001b991094bf
MD5 2d841d75626f0e626574cdd029e739df
SHA1 9868a86d2bc6adaa40fd43e8dc339307badb9e7a
SHA512 4bb4c33107834232e61620952eac04bd5283bb7540a645e7693a1bb56386ef5e6bbffb7b52aa507b224d5a6ab0613992f649554c90e67dd93ac175001fbf0c07
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjn1p7tTdvySga/9:RG05lO43b4fdvyS5V
TLSH
T145D5CF6A62EC11F9D1BBD07CDAC64A0BEBB23425033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 07cd6aee6af85542c489a00c500dac09dab19aeaa2d181a26fd821725597943a
MD5 ffebc532ae513bfbae456024cb4602e7
SHA1 a1925b7db1b912788de79f61b606018786da2111
SHA512 888f5246f92cc1127ce42475ef97986cea45c1ed24eb832b170878f613706b2b2e73b06fa7b04df3f8700d550d69b770e6ccaaae5349d30378bfc6f2bdf12582
SSDEEP 24576:jC3a5POZ3dpbWVM50JicR2hG0lasx2+47eidnDU1XZZdPVTdBdf6efpGHa/9u:2a5POZ3wJt2pasx2+mC1p7tTdvySga/9
TLSH
T12C65BF5EA6FC01D5E579D17DC5834A1AE5B1342253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8d425c99b40925afafb9f05782c3dfac489645b9dadf8086a4585bd60bbd5150
MD5 a235e23c6d1d08656b214baa4a0a571b
SHA1 a59f32e3c8681e3ed58d5824cd94a5a430394862
SHA512 231b7839d827dea8b69e16e808e017f573a1019beaea8ffc55510e3d3aaa9d5ebe50fb48bd319b44b92eda26312d22797e3751b144dc44a45fae8c97394d9d25
SSDEEP 24576:kNcwHdjbyQ4nLC18lb/EOjowL7FkM1XZZdPVTdBdf6efpGHa/9u:kNc/zEOVHF51p7tTdvySga/9
TLSH
T171858C2623E901E4F1BBE1BE89779646FA71786553308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 0f8a6e9327e3a04cdebcf031ea25515447da063cbd70790f570d6a56eed009b1
MD5 e301054efbe746fd963a5cffe07aa9d0
SHA1 2393268a345922a52cf5cb6e6c1cbc8213c0356c
SHA512 615fe665c8bc3ac4576edb25329ab41d3089026bf8ad1528eea355c000345eca37cfa33893e9007ed3d627f5a27736683295f4d3df17bf1448459088f376d996
SSDEEP 24576:BNJnJPbzB4ST1XZZdPVTdBdf6efpGHa/9u:zJnJv6ST1p7tTdvySga/9
TLSH
T12A15D03DD2A810E8E4B7C2B5815A1B59FF31387D2B2169DB19B8D5343F12ED0A939F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 2773858c202f11ff484f15fb08f76c8df6c33de449e793a81134b0fb4fc5f9c3
MD5 3d7cf3fcc0c638065851848dc2d67bce
SHA1 8030d4c8bcf80f3cfa945242c4bdb0499d5201f7
SHA512 c5bb8e68a7cd17893bbfef03628cc6dc4f3f45c7464fdcf30c97714e85dea4dd2f7a74238bbd90698306e5e6789e68dea6a38fc0529517fb3e4d470ea1e10202
SSDEEP 49152:jCLHGeeV5ijCmlDWDkP1p7tTdvySga/9:+HfdvyS5V
TLSH
T124A56C05B7EB5184F8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 5494bf3a44435ce97b5e912865863538b4ee7c391fe67dada8f3b435634a6bad
MD5 33be1ce1becfeb195ec86bc2650488ca
SHA1 41997d46bfabd5d8350453a5e5be800036ccf2f4
SHA512 8f3015b70eba2389aba0a92fd91c75fb5d6667ffcd471b291b37f4b9a5264daf53ff70858e04d515bbaeed5ff9da1c4a7ee22b48cb3fb339cd4112808c173055
SSDEEP 12288:H+1Hck6j5ZI7+f1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIp:HS6DIC1XZZdPVTdBdf6efpGHa/9u
TLSH
T1BAF4015C337A60F9E16BD03EC5830651D2B2B171C7621ADF06A8C5B95BA3EC8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 979d3ded0d58c62c4c09864a9f51183373e1629284b9622392d8851b31ece7c8
MD5 958b6e33fdf6329958a9d8bf1676d2ce
SHA1 767b79d1d748513896043d4eaeeb00dd5545d5e3
SHA512 1a7ee62ec62f88f31ab3af9a5ffa3a6c88e2bcd8947b469c2a15ed24297b5c8ea260b078607ad88381a3158bc093d054b075f33ed153e86ff62b6ba163bdc63c
SSDEEP 12288:eG6kyMf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3z:3tyM1XZZdPVTdBdf6efpGHa/9u
TLSH
T144F412107398B4D8F779413ACE6207A09F32BD219B6157EF02A9D73E2B357C0A939B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 129202e99be701d3f57e18dbc1d2bacee9fe3526eaf33a25836820f19c482d3e
MD5 f1d5ca0e7f596593040359c4d48cc7bf
SHA1 f8dbcd81537069d5c134a335e123c0f6b3a01fa5
SHA512 77888efdd7d6e02563c8622dea2af44ad9fa4f793f830d2cff829b312a8e900ec17478189483a2a495f9f6887ff9c5b48cfb323e72fcd2545d6f088d7f397a0b
SSDEEP 12288:oNMLf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9/m+3WnQ:ouj1XZZdPVTdBdf6efpGHa/9u
TLSH
T197D423A4721AF9ECEB24907BC9621F915723B33697A11AFF15AECB7193141C2853EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 fb312ecd7e2b2b153bd194d951707f39040153af2b2fbbb7de21bd51acf76f3e
MD5 c2115a5e68894a81fa58833e6a9e8b05
SHA1 c57640b23a075a1c0a789349e894eefb576f8bf1
SHA512 9e893e07728ef38057a3b70046fd4875826db5961e597b8d9d272d554cbe3e8130cc6ac850b80500d1634cfc15c140a6036a65467d10f4a6e0d781f0937e410d
SSDEEP 24576:bugVLoTfaidZf1XZZdPVTdBdf6efpGHa/9u:KgaTrZf1p7tTdvySga/9
TLSH
T1F3558C1D73EA05CAE2B2D279D8721493D633B4315772D6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 442ddb50797e357da6ded78c98c8e725b8fe3af4d718d24a7b906862f401a467
MD5 27af862fce60f68769369b2c35b7b882
SHA1 7a571157daaa62851924ec3a87247bad2a19534f
SHA512 29eb12d38fb7c7e58130bf1faa2f2c0cd011cc423757e17f258c9035a377bd0cd06a5197526920ef8aa9c3a6e77ed7a2fe87daf8f5816b2c14e668d5b03baa4c
SSDEEP 12288:m+pJcm8CNGf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCwIl/9V:m+rcmR+1XZZdPVTdBdf6efpGHa/9u
TLSH
T13605F15EB26E00E9E2B7813DCC420655E7B3B031636267DF02A9C77E4A279D97D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 fccbcabe2f5ae3fcb03be5394b6880d0ca1c986b18d8a1f08235568c86586751
MD5 25f27b988aaa69d974daedfb73897071
SHA1 af7b1b17ee9cdc9173ceec4572328c07fbd5489a
SHA512 e242f24af04164cc0d9c4aff8dd545483d8336f24a9bed8583abe27e546ba9811e34d9d06284a5ae5b8f3dec1fbb96dd74ff4fa728a927e151a2a0ec50d6c227
SSDEEP 49152:eDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3g1p7tTdvySga/9:/3Upow8sB9fdvyS5V
TLSH
T16DA58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d9ece863cdf316966330ad58ad66760d6643809de27f83cc195f13469b0d94ff
MD5 fce3cf2477a2e7b67f8fade629834ea6
SHA1 0c5bbf4da62524b4ccebb7d0723715b944505f8f
SHA512 acafbc0897f3585614d988191be8d9f2ccb494a4943aa5c4157bc88982f3b47e68b26573615235d379910d2105eaab649740932285ce54818060d5e3b2830218
SSDEEP 24576:1sTkNvNnaFeYhJNtmZBmH1XZZdPVTdBdf6efpGHa/9u:GTMwBtOmH1p7tTdvySga/9
TLSH
T17555AF6EB6B846E4D1FEC6B5CD238512EA727461073293CB5394C13E0E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 dc6c07efccabadca36e6dead39b59322069473a25ce889f2a6a1cef30fd842db
MD5 d45d2158b88611cc47fedf9f1240add4
SHA1 77b00b9b5105283030dfd5b318add7b58c4ee9b6
SHA512 2309e3e6ee2f9183ddb00eddf5143c79aa7a142e3b935689d8c7076be4c16101d1ba1db89bee8ceadc6b93b7992d30aca45fddd7287d2d6234c2f4f487ce9c69
SSDEEP 24576:wYD3FHshBIYQgAb1XZZdPVTdBdf6efpGHa/9u:xDVHeBIAAb1p7tTdvySga/9
TLSH
T14225E13DE65C04E4E57AD1BDCA634A06E77238A9033266DB0294C1B51F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 59fdc6aebb248806af1c3b25857edf92d4ed6785f645f6b24c3dd588450b2fb3
MD5 232d0c95aff62d6a48be7162348a58a4
SHA1 440e25940fb5077956d639eaf11874ba781232e2
SHA512 3e987d7a8575893d290cf8b952070c34ac3272755e28f932ceac929f759b9b9dc77743f07b5406bc55b48866f8b93402e7a59129a9fb25c3547ee7de5b830041
SSDEEP 12288:0DyS6b3IkxjbBzkf1K4ZZcqHWTefdw8aIddzQYRRwKh0PcJKj0f6ezNFpMKubRCN:0R6Uqjpk1XZZdPVTdBdf6efpGHa/9u
TLSH
T1FFF412697394B4E8F2394135DD6243658672BA3253B15AFF22EDC67A8731AC0853FF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-76-0x00000273CBEB0000-0x00000273CBF16000-memory.dmp

Download

memory/940-134-0x00007FF6197D0000-0x00007FF6198E9000-memory.dmp

Download

memory/940-77-0x00000273CBEB0000-0x00000273CBF16000-memory.dmp

Download

memory/940-75-0x00007FF6197D0000-0x00007FF6198E9000-memory.dmp

Download

memory/1224-157-0x0000023783440000-0x00000237834A6000-memory.dmp

Download

memory/1224-155-0x00007FF79D530000-0x00007FF79D7D2000-memory.dmp

Download

memory/1224-212-0x00007FF79D530000-0x00007FF79D7D2000-memory.dmp

Download

memory/1224-156-0x0000023783440000-0x00000237834A6000-memory.dmp

Download

memory/1708-252-0x00000291D5BF0000-0x00000291D5C56000-memory.dmp

Download

memory/1708-117-0x00007FF631670000-0x00007FF631DB3000-memory.dmp

Download

memory/1708-118-0x00000291D5BF0000-0x00000291D5C56000-memory.dmp

Download

memory/1708-119-0x00000291D5BF0000-0x00000291D5C56000-memory.dmp

Download

memory/1708-181-0x00007FF631670000-0x00007FF631DB3000-memory.dmp

Download

memory/1708-254-0x00007FF631670000-0x00007FF631DB3000-memory.dmp

Download

memory/1832-227-0x00007FF7550C0000-0x00007FF755590000-memory.dmp

Download

memory/1832-193-0x000001FD55DB0000-0x000001FD55E16000-memory.dmp

Download

memory/1832-194-0x000001FD55DB0000-0x000001FD55E16000-memory.dmp

Download

memory/1832-198-0x00007FF7550C0000-0x00007FF755590000-memory.dmp

Download

memory/1848-17-0x0000021208270000-0x00000212082D6000-memory.dmp

Download

memory/1848-16-0x0000021208270000-0x00000212082D6000-memory.dmp

Download

memory/1848-15-0x00007FF7DA840000-0x00007FF7DA962000-memory.dmp

Download

memory/1848-18-0x0000021208270000-0x00000212082D6000-memory.dmp

Download

memory/1848-51-0x00007FF7DA840000-0x00007FF7DA962000-memory.dmp

Download

memory/2132-28-0x0000010C07000000-0x0000010C07066000-memory.dmp

Download

memory/2132-26-0x00007FF7930C0000-0x00007FF793188000-memory.dmp

Download

memory/2132-29-0x0000010C07000000-0x0000010C07066000-memory.dmp

Download

memory/2132-27-0x0000010C07000000-0x0000010C07066000-memory.dmp

Download

memory/2132-62-0x00007FF7930C0000-0x00007FF793188000-memory.dmp

Download

memory/2380-211-0x00007FF789510000-0x00007FF7895C3000-memory.dmp

Download

memory/2380-147-0x000002537B990000-0x000002537B9F6000-memory.dmp

Download

memory/2380-145-0x00007FF789510000-0x00007FF7895C3000-memory.dmp

Download

memory/2380-146-0x000002537B990000-0x000002537B9F6000-memory.dmp

Download

memory/2488-163-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2488-107-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2488-111-0x0000000000930000-0x0000000000999000-memory.dmp

Download

memory/2488-105-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/2804-1-0x0000000002D60000-0x0000000002DC9000-memory.dmp

Download

memory/2804-268-0x0000000000BB0000-0x0000000000D67000-memory.dmp

Download

memory/2804-0-0x0000000000BB0000-0x0000000000D67000-memory.dmp

Download

memory/2804-37-0x0000000000BB0000-0x0000000000D67000-memory.dmp

Download

memory/2804-8-0x0000000002D60000-0x0000000002DC9000-memory.dmp

Download

memory/2804-6-0x0000000002D60000-0x0000000002DC9000-memory.dmp

Download

memory/3260-248-0x00007FF668DE0000-0x00007FF668F0E000-memory.dmp

Download

memory/3260-219-0x00000246BAAA0000-0x00000246BAB06000-memory.dmp

Download

memory/3260-218-0x00000246BAAA0000-0x00000246BAB06000-memory.dmp

Download

memory/3260-217-0x00007FF668DE0000-0x00007FF668F0E000-memory.dmp

Download

memory/3296-166-0x0000022288B90000-0x0000022288BF6000-memory.dmp

Download

memory/3296-165-0x0000022288B90000-0x0000022288BF6000-memory.dmp

Download

memory/3296-213-0x00007FF755E20000-0x00007FF755FB4000-memory.dmp

Download

memory/3296-164-0x00007FF755E20000-0x00007FF755FB4000-memory.dmp

Download

memory/4276-70-0x000002B010D80000-0x000002B010DE6000-memory.dmp

Download

memory/4276-65-0x000002B010D80000-0x000002B010DE6000-memory.dmp

Download

memory/4276-72-0x00007FF725D00000-0x00007FF725E67000-memory.dmp

Download

memory/4276-63-0x00007FF725D00000-0x00007FF725E67000-memory.dmp

Download

memory/4276-64-0x000002B010D80000-0x000002B010DE6000-memory.dmp

Download

memory/4612-262-0x00000171BD100000-0x00000171BD2CA000-memory.dmp

Download

memory/4884-38-0x000002565F060000-0x000002565F0C6000-memory.dmp

Download

memory/4884-93-0x00007FF7930C0000-0x00007FF793188000-memory.dmp

Download

memory/4884-35-0x00007FF7930C0000-0x00007FF793188000-memory.dmp

Download

memory/4884-36-0x000002565F060000-0x000002565F0C6000-memory.dmp

Download

memory/4884-39-0x000002565F060000-0x000002565F0C6000-memory.dmp

Download

memory/4888-45-0x000002334A0E0000-0x000002334A1DE000-memory.dmp

Download

memory/4888-46-0x000002334A310000-0x000002334A376000-memory.dmp

Download

memory/4888-47-0x000002334A310000-0x000002334A376000-memory.dmp

Download

memory/4928-177-0x00007FF7B65B0000-0x00007FF7B68D0000-memory.dmp

Download

memory/4928-172-0x000002072BA30000-0x000002072BA96000-memory.dmp

Download

memory/4928-173-0x000002072BA30000-0x000002072BA96000-memory.dmp

Download

memory/4928-180-0x00007FF7B65B0000-0x00007FF7B68D0000-memory.dmp

Download

memory/4928-178-0x000002072BA30000-0x000002072BA96000-memory.dmp

Download

memory/5376-54-0x000002A1B4C00000-0x000002A1B4CFE000-memory.dmp

Download

memory/5376-55-0x000002A1B4E20000-0x000002A1B4E86000-memory.dmp

Download

memory/5376-56-0x000002A1B4E20000-0x000002A1B4E86000-memory.dmp

Download

memory/5560-87-0x000001F15F030000-0x000001F15F12E000-memory.dmp

Download

memory/5560-88-0x000001F15EF80000-0x000001F15EFE6000-memory.dmp

Download

memory/5560-90-0x000001F15EF80000-0x000001F15EFE6000-memory.dmp

Download

memory/5648-98-0x0000016E32670000-0x0000016E326D6000-memory.dmp

Download

memory/5648-99-0x0000016E32670000-0x0000016E326D6000-memory.dmp

Download

memory/5648-96-0x00007FF787670000-0x00007FF7877B9000-memory.dmp

Download

memory/5648-153-0x00007FF787670000-0x00007FF7877B9000-memory.dmp

Download

memory/5772-242-0x00007FF6BC060000-0x00007FF6BC566000-memory.dmp

Download

memory/5772-206-0x000001F82C7F0000-0x000001F82C856000-memory.dmp

Download

memory/5772-205-0x000001F82C7F0000-0x000001F82C856000-memory.dmp

Download

memory/5772-210-0x00007FF6BC060000-0x00007FF6BC566000-memory.dmp

Download

memory/5784-199-0x00007FF616EF0000-0x00007FF617306000-memory.dmp

Download

memory/5784-137-0x00007FF616EF0000-0x00007FF617306000-memory.dmp

Download

memory/5784-135-0x00000241011E0000-0x0000024101246000-memory.dmp

Download

memory/5784-136-0x00000241011E0000-0x0000024101246000-memory.dmp

Download

memory/5784-202-0x00007FF616EF0000-0x00007FF617306000-memory.dmp

Download

memory/5784-200-0x00000241011E0000-0x0000024101246000-memory.dmp

Download

memory/5936-184-0x00007FF6568D0000-0x00007FF65697D000-memory.dmp

Download

memory/5936-127-0x000001DE59490000-0x000001DE594F6000-memory.dmp

Download

memory/5936-126-0x000001DE59490000-0x000001DE594F6000-memory.dmp

Download

memory/5936-125-0x00007FF6568D0000-0x00007FF65697D000-memory.dmp

Download

memory/6032-251-0x00007FF6F2E60000-0x00007FF6F319E000-memory.dmp

Download

memory/6032-229-0x000001D35FE60000-0x000001D35FEC6000-memory.dmp

Download

memory/6032-230-0x000001D35FE60000-0x000001D35FEC6000-memory.dmp

Download

memory/6032-228-0x00007FF6F2E60000-0x00007FF6F319E000-memory.dmp

Download

memory/6080-223-0x00007FF6C5660000-0x00007FF6C58EA000-memory.dmp

Download

memory/6080-187-0x00000221834C0000-0x0000022183526000-memory.dmp

Download

memory/6080-186-0x00000221834C0000-0x0000022183526000-memory.dmp

Download

memory/6080-185-0x00007FF6C5660000-0x00007FF6C58EA000-memory.dmp

Download