6f5d135c4a1478771854ab3efa3ebc67234f45b817520c41e08450b3f2416cc8

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Size 829KB
Sample260922-ksrbmacb34
SHA256 6f5d135c4a1478771854ab3efa3ebc67234f45b817520c41e08450b3f2416cc8
MD5 fd1a6a489d6d097031634ae0e9538fc4
SHA1 50efce749798560410d1c79b61b9115fbe5d2b33
SHA512 d7a9b72112d62e7183332d1934ea361e768b7da94d8eae10e3e9a6063e04489f4cb82e7ee45f5e10c0d899f17cbb9be7183af2eaa68d724ca062b657873e546a
SSDEEP 12288:oqwv3djptbaT32CzaY10JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:o7Vjptg3Fzay8dCN/j2GLl3iFSE33b9
TLSH
T11405F1203BA3C036E55702768E79CB6A6529FF204F6741C7B3D42A7E9EB46D24A35307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3212	alg.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
3440	elevation_service.exe
1032	elevation_service.exe
3852	maintenanceservice.exe
3008	OSE.EXE
1200	fxssvc.exe
4204	msdtc.exe
2312	PerceptionSimulationService.exe
672	perfhost.exe
1624	locator.exe
116	SensorDataService.exe
4836	snmptrap.exe
1272	spectrum.exe
4084	ssh-agent.exe
2364	TieringEngineService.exe
1560	AgentService.exe
1448	vds.exe
5044	vssvc.exe
5064	wbengine.exe
4372	WmiApSrv.exe
3280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\79f42eff250d612b.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106062\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000183ba2e36f4add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e5b400e56f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e3d83e36f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001ad9bee36f4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000937be6e46f4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004c04a7e36f4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe\""	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
5056	DiagnosticsHub.StandardCollector.Service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe
3440	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3308	2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
Token: SeDebugPrivilege	5056	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	3440	elevation_service.exe
Token: SeAuditPrivilege	1200	fxssvc.exe
Token: SeRestorePrivilege	2364	TieringEngineService.exe
Token: SeManageVolumePrivilege	2364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1560	AgentService.exe
Token: SeBackupPrivilege	5044	vssvc.exe
Token: SeRestorePrivilege	5044	vssvc.exe
Token: SeAuditPrivilege	5044	vssvc.exe
Token: SeBackupPrivilege	5064	wbengine.exe
Token: SeRestorePrivilege	5064	wbengine.exe
Token: SeSecurityPrivilege	5064	wbengine.exe
Token: 33	3280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3280	SearchIndexer.exe
Token: SeDebugPrivilege	3440	elevation_service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 1572	3280	SearchIndexer.exe	132
PID 3280 wrote to memory of 4420	3280	SearchIndexer.exe	133

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_fd1a6a489d6d097031634ae0e9538fc4_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3212

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1032

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4500

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4204

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:672

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1624

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:116

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4836

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2852

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1448

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1572
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ab66e341aa29040faf4073b15c309f6bcab5071b8546691c740ae52ff7839cc
MD5 bdc15c1910b61b8428e1957a883f5166
SHA1 2345e7cafcd65b07714bbbbc6a4d0d12e3512275
SHA512 1f965fc61d29710241d9b2eae262bbf80c760e3d74eb7951eb01e9eb1774d4c86390ae0593545ad64e9b555865151925d09fc3fdf1a568fee819ee825203e2ed
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6N/j2U4FH:A3q6HjBjj2jF
TLSH
T105D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 a90061a4b5d1c7051ffd522a44ae4f4eb484cf0c3aeb1c0103b67e2e965e56d0
MD5 ad4abd9a2d8b67a09995fe5d69bb5b4e
SHA1 57fc468ef23052e744d0257d9eb74f9c05d35f52
SHA512 981f0df9ac4433f293d7ab0fb376b32234cff33ecd35a08a74dbac4f8930c8a1b2afca73b118d36cd3bcfb41147dff595781e0e3a2984e5c48ddf2af4f16eaab
SSDEEP 12288:u1XLsswWkxy2lRq2czAKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cXYfDtczA2dCN/j2GLl3iFSE33b9
TLSH
T196050228B7E049F9EC67827CC9A1C511E632B8948760E7CB03E499661F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 5a89dbf2880fb27e6e517a2b6042dfdbcca04afe16580247ae73d949483f85b3
MD5 a898f4af6465a54a695a0197d0bf4967
SHA1 15786eaead53c01e890d05d1fa141cb1b053ef53
SHA512 b67f0371cd64822a43269ba5db6b36f623b3a68e713ab960791de1cacb14361976f9e1d2a367ad843eabe5cd57b19cb124336751022ae2fc04c9aef0fea01902
SSDEEP 24576:90Le5ji0hmxirM9dCN/j2GLl3iFSE33b9:9Pji0AcrN/j2U4FH
TLSH
T1CB359E26F6748335D073C0B9C5D2A69AEA7130855B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 faffc5f0f85d4292391d6cf13d78bc67dcdd0f84c3ed776cb94913c04629dd5a
MD5 1b4dbd06f8ee2f05c490f68bbee9adc0
SHA1 d1b747eaa6a44d44caf59865afe70066f5f73217
SHA512 4171bb99e8822afc6446d6205fd9827900450ce0f7d963224e2ee36ac5ee16751533ee577d4faea0552c9cdf49c5d5dc37ffe1fd3360050117da3b475a054c7e
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuzdCN/j2GLl3iFSE33b9:t/ezSC6vUzPvxHjyXN/j2U4FH
TLSH
T12A755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e15acfb1f321374d94c1b571c728bee90d782e81e1e734359aaa920474508f2
MD5 18a36b2f6dadf99fce5bec52d8d691e3
SHA1 25504dcf3dbbd61ff914de5e9db191c859578664
SHA512 cf21a3855838d136530700c1e7609787f1181cdcd964827590696dbf705210531442df8b0f390b64070d5e28d101a40b436a5ce5363c40fa479d056aa186bc02
SSDEEP 24576:1VbqPb88hv/l+66dCN/j2GLl3iFSE33b9:1VO88hXl+uN/j2U4FH
TLSH
T1C6559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 d1a6bb3ee9b027dcbcc211f72e43928672ac44a9d5bdc24bc9549c56a8218987
MD5 ede5fee5f1771f59c284dae1d51d110b
SHA1 9231be023899edf759b1021c4f655717523d7ca8
SHA512 bcbd079c974319fb150d9f29b72ecc2e0d60dcecd4fa1f78ab1acf17adce5fb297b83d4d23297c410dc5a59baeb0ba4c769f61e71ed792cf8e2bdf8e5b79b79c
SSDEEP 12288:4RFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4RBdCN/j2GLl3iFSE33b9
TLSH
T115C42360DAE5F565F26F837903ADAE656200FEE8E525884785817BEF517CFE8C032063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ebcc5b750106fbe66e5ed566a2d4a45507527ea775d5bdd9e79bd88b9a8ac7cd
MD5 937b36880dd3b651abea7bd8d6b94d20
SHA1 b7bc64a1b48b88414aac9f689b14f6884c2cc7f0
SHA512 670085a94df48ca1bbf017575905f94918de24d959962bb5490f57393fe229ce5eb5f2009aa57cf433037ea83576ebec4e435bcd66f2df9001a118f56fb2afe7
SSDEEP 12288:5eBNUbTVO86U+JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5JIUydCN/j2GLl3iFSE33b9
TLSH
T1C105CF3BEE28FCE2C27E8DB85791C600976278708B6293CBD165834EDE235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb700750943bfd757005336e00958ed58cf965c642bff2f946a82ce9c160b2d0
MD5 a384b94cc653509bb7868714568d7788
SHA1 8d947964df019fe9ac8e3e26eb548802b346001c
SHA512 13bd2e98a433330b263d1e2bae11ff54d750f4190c47dc688058dc59f44bc3455456323a64eb54f50cb8e582504ba0520787a337eb103fc35575357d7d3a480d
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THU:wQvGAdlCEL8c/yRNw5C8j2jF
TLSH
T186267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 e855a865b6140840d610531da07bebf3c047985f11dadfc57fd77f15afc11b7a
MD5 738f70d8ebbc69ab2b1b30f9c0988e7b
SHA1 3ed5c5ff959258764fc5d7ce8af08f160cbec9e8
SHA512 c9c1cd09ab9c45ff471c4485c2c6665d9c7184628137fbd3ae613dd3f3d75decf50a918ba01a01c024d6c7662d8b244e735325cf17e3acf88b7d2ae008c2c53d
SSDEEP 12288:UAwSfxL/2Dc34DLLmt0LDQewsAjAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9c:pdewsAjwdCN/j2GLl3iFSE33b9
TLSH
T13415E031FE74E036C2BF0DB61B36D716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 da2627bb548001f8f96835ffc5550c5f0698ef8d389dd35cf91af850f5b243af
MD5 e37b1ecb78b78d6abf08ad6040c03cbd
SHA1 e5b5130a967cdc75b69160dbfb99f666080ea94c
SHA512 7f7aec89fbbeda6e40566ef9982d86b2cab72e250e15ff2407908b9cedaaf3e9263208ad6d955ff339b269a7f3b258c52f284a251cab51f67ad13dec7f19cd83
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHN8F:WUEtQevvqc2W1cpV2EI32N
TLSH
T141474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 41a9af981549f7f4bf014203a643829ab51c5849210ec71d8999ff34e8ea9ecf
MD5 3ead51f91a6e85c716eedb816a89b401
SHA1 7a2eda879a5fcecaf66e05551b872ac84ade69ab
SHA512 b12784901a02166226707821227b76c6a85176950ab86f7c1809b074a89cdba5b2d29b695d9a1d5aa1143fb50d41b40e002b2184caa5d3ff8d61ce59151333d7
SSDEEP 49152:eCbRquA/m2yL5zQfFiV+XenmE3/zbN/j2U4FH:ToqtVjnmQj2jF
TLSH
T1AAD58D1976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac14dc636bfd48478d2cb753d5c438b4604053c4fce943cabd11aac393fa8b0f
MD5 3cd2339c3f33a1f1f3f34d3621deab56
SHA1 341d3f227f2a703da957d13a7e5ede6d99b721e7
SHA512 33c2e574ee079b592fdaae74c5386fc6f5a84541df9d48d5afdc733e6e0d66fc31547125e6eb039949c2f711d03d3033ecf5d7e8d347a7e49478a345009b2ce7
SSDEEP 24576:7AhGLJIFoiwtA5l7S53vdCN/j2GLl3iFSE33b9:7AMyFoiq5sN/j2U4FH
TLSH
T1A735AD80EBF955D4F5B3AAB899B69571EA72BCA95E31C20F1150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 701b600f411b42f930bb8d6707bcdd2e3bf39f13f61cbc977a042e1a209b84af
MD5 407e04886e41756f78921dc794f413b0
SHA1 39bbb572bbf4365fc7fa0bcd755555e25d38b131
SHA512 54ad87c92e15b9747ace09b7c149d50cc9442fdc0badb2aea6b3ceba568edccd2e72cfd9cdab33947215a475ab2907338d622f5e2d5dc167861b968fdac7dce4
SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+CLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:QwuoOWMdCN/j2GLl3iFSE33b9
TLSH
T10D05F14577E41CF9E56782388697C536F7B2BC512A21CB0F07A0C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7d55ac7be4dee2c3c2f7c4d8a5b88b961d4c847aec0d7909c07f851870b3d112
MD5 15add76af2ac1353eeee9fed418005bd
SHA1 8813fb564362c3055567ed242e39941dbfb84fdc
SHA512 590d4b195f033dff50423fd480699eb7a7baedff662a943b4ec580fa8832a7705826cc7196cfb440b6774bed1ecce2fcbe18e1ec5a08f7033a8845d77a005eab
SSDEEP 12288:cBZ1IywJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:qZuVdCN/j2GLl3iFSE33b9
TLSH
T189E4125937E471F9E1A7823C8AE59A05E321B8A5A73243CF025047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb1d4bb7a3da9261d3f31c7d86c69952c055d53b2bde176893ea896b2b88a1c6
MD5 9c51d73753bc97d838766dd0c30b9e3d
SHA1 b38d6726ebcc613eebb0e6d960c798c936e3f193
SHA512 8f6b5c74b586768470d5c4a74ed20b241a3b4296e5e44a90ffa31657f09339face3f08a5d5831d6f990c37119339aac8f335c8a74286f819e5a931cb99c53a90
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:sQRQyi36YOcPQLvw2gAf+PN3/j2jF
TLSH
T1C9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 74f54658c4e230b185a706294e3aa4591f0168d04e9e4cd1bca9824571802100
MD5 75a4487507896885f415974709e973fd
SHA1 ed93edd3aca22db48a79352d0fb37710a38709bd
SHA512 97ad17c513ba5d81f99d21d1c4802c2800fe49c6a2e3131d917662b2a3c3984e28a26fcdfbd7d75b4f2a722677881a7faa1dc8522552399f239938b3a8afdb73
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ug:FQRQyi36YOcPQLvw2gAf+PN3/j2jF
TLSH
T154667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 141cfae51dafc745ac077938754dd16d949417f9b95db28b1fb6a056c22d00c1
MD5 75c97c021f28edbf71b69367408c8a47
SHA1 82e07784095b2c59d4bc6be89f222952d847fd80
SHA512 36ddec5d220971c7243bcc127b0885f6d14e8e479660dc65aec335fe6085806690f0aa90586c61a661606d913e383577106788ab3d520de58a973a2ba3837335
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0FdCN/j2GLl3iFS+:V68Qg55nhheWu7PNU3/rN/j2U4FH
TLSH
T104B54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8541725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 edfaf6369d615e65508eac0ef263a4d07ef57655458b7f86a1308c8c2677cd7e
MD5 2ec0ccbf95c60e68bf7d87f266b92bd7
SHA1 14258595f60caef4d7e910371bc41fa1ad5e8752
SHA512 99aceda91cc23adec54c062d5f1db51136466a5a10e98dffce6c5344577b02b1e62ee26990ca9d69ff968e17ec6322894ac030ad3dd7519ddb490639e9a4dde0
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:Vy5112gYy5azzVvL69nLKnhZOj2jF
TLSH
T1B1168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 12e3fd5e17562378c24c8c379561fe449d54863cf5a3ddc4e2da73d89201d9f3
MD5 e356ff8130bfc1cf187d63af1014647f
SHA1 f7fcd1ece38e68806601a9d58215a6819e15485e
SHA512 a520c51d7b1ae89d5fde15ea8b9bf947b932ba5e1062911de9dc0ea1bc7c4394dfcc0420a90d1eed4f56aa53cbd3dd4c1fd9a3c009b5340a88e11517a88f5296
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glpN/j2U4FH:Cu6JmVxd2dnj2jF
TLSH
T14BD59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 df893ea6e6129b21a1d84de19e9c668122ebc7729fc3face8963fcfe9bdd2ddd
MD5 0f2dffdb5e7945041e221576dffff1ed
SHA1 e62b1ce295f00e76517351cdbf52a33fff247a3a
SHA512 943873a7b5ec8b1a9889d1e28eb68b9a95ff3e69dd7c35baf1fcabaed31b1eb22ebef94ff8619572b7f3d998864d4a12eabd20674d529dcb8e915c07945f5561
SSDEEP 49152:j1hpsNoJpF1A6UU44CwH7R4xVN/j2U4FH:jmifPbRQj2jF
TLSH
T1B1B5BD13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0ddb9b1a9c9470ad5fde0e4f8152a87308860b4ac9e5149ee700438007848eff
MD5 c6c77f88b564d4d3a54d8aba8a459a84
SHA1 f5155316830fc1a6fae8d917823165224739aac3
SHA512 02b5e40bdede0a748c8c7b5944df80798e91d25b58515f595f47ed6a04c41dc757f586b9f48a19f9a89a47dfc31fd4c7d01a95db307622a573261a223ae12cb9
SSDEEP 49152:KSuZQIY0Be2KRRVtOnks6NMHqKN/j2U4FH:U5dKTi61qj2jF
TLSH
T13BC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7b89bb78b914ab2bb52bb4e1b4a27de37c30f895b7a4bbaf96cd9be113f65623
MD5 6b381d648b790ce294db1a2c48872748
SHA1 2705301cff5376a9553405f7324b578d5a5b4428
SHA512 9c7a2de5529d07a8c0dd3e5b0d644a818ee24671b1b7de13ac28d49423de3cc2fc50c0e0a9030a669de627ea24b685613385f0c437017bd7aed5cf9f6e1d73d6
SSDEEP 49152:dhtSn8EApI0figngiDn0AP5w5N/j2U4FH:MX2iyphUj2jF
TLSH
T1B695BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 00fadb2b228b58837004e8f58cdd6ba98000a3b9072043c44bba784930f91c42
MD5 a07f36a6c9559cff7e3a9b3769f78bbd
SHA1 a91d208aefcdd85f4494bbded4567c0e67f1a1ce
SHA512 9c885dc973afb0f23925877c607176dc20b671d001da5a33fba2b2e298bcf97d145d23ec5782d5422dfb0d022ebfcb8406662599af2961657d660a97c9df7512
SSDEEP 12288:7NJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:7ZdCN/j2GLl3iFSE33b9
TLSH
T1DEC42364E9E6F669F15BC37D43A99B555200FEFCF6264447828116EB637CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1b297c3515546d6fa2b418a88e76da8d7c32956a08581b90af3b0e57b939d2ee
MD5 7a158bb2ab00932c5ff7edd8403e6aba
SHA1 c300ef980b18327d892035b899b5ba0f721d6922
SHA512 0d2c20547999349f134cdce6ffad6880de4544a7e6fcb5ec646a1655d6fd0e6f26969fce078507b12d450b6ffea27949a5930398ac330a62c4e4a9c239d6f59c
SSDEEP 12288:WcJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WUdCN/j2GLl3iFSE33b9
TLSH
T1C1C42364E9E5F669F11AC37D43A99B555200FEFCF6224487868116EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 02a3ed00c86323c7bd5869a0bd2917991e4c8752214d10edc3dcaa0c98225347
MD5 0636b6e0f29daf6b7f1a75f7a9a285e0
SHA1 48cc5864d25fd0d354f3ec68ba105743db722ad4
SHA512 7a63bf14bf910cdda5ecbaf42d580ee889331bec91815be156eadf79012566506e4bc7b6f2fbfc1d6d77746ce55bc4a6fd8d7f9c9523814dd1928303398f6d91
SSDEEP 12288:OGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OqdCN/j2GLl3iFSE33b9
TLSH
T108C42364E9E6F659F15AC37D43A99B555200FEFCF626448786C116EB237CFEC80320A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3b7db4a7ce715935bfb1dc47d3f42b7603f0b56f54ef2401742283222e487dd0
MD5 8e6e6287391b272877035a680eec639c
SHA1 b67ab290a176e75d27dfbc7eacffb732c711710d
SHA512 c541e0288562d9e9c4a82c84d90c06ea4321aebaf4bcec9aeeb0ff686e67f0cabfcd05a2b98e1dd5cf947771ffd65618e3ff5e3586e96f5ba4c0fe33e03b0d29
SSDEEP 12288:UVfJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:udCN/j2GLl3iFSE33b9
TLSH
T123D42360ABE5A1D5E06BC37D83B59A11E320FDE8F73285CF86401AEF1B74BD89431562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 5bbd5a886fc4748858c9d3d384137f355d5c2ddcb9276c6019a5731ef886dea0
MD5 7c26857c89ad72552a2f04e8d577cb3d
SHA1 ae8913ab206416401c61568f62a23fb28ccdd23c
SHA512 d5b6679415fe6e764d78961a6e1efcad7be0bcbdcea6aacd45dd9847b5fd4d418224250d3901f5ff0f8806d1829c767257095285f4ea52f1412c11bf363ed575
SSDEEP 12288:KXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:K3dCN/j2GLl3iFSE33b9
TLSH
T1B1C42364E9E6F659F15AC37D43A99B555200FEFCF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 120d14ca13e3d89ea0ac0060ae344c48d083891ac59e95d62c889a5da454e73d
MD5 37f7630bffe8cbfd263289ffcec2b9e1
SHA1 95d13fb935bffd6b8906097009f052a3cbb97bc4
SHA512 7365c52228adbf2c8861afaaf3319f6c093a3afe7f3de01aaa884ac55aec1ea94f97aaac6cf06abecb0166d23c3fa16e960dbb576f42a477b39bda400531e0d2
SSDEEP 12288:HIJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:HodCN/j2GLl3iFSE33b9
TLSH
T100C42364E9E5F669F11BC37943A99B555200FEFCF6224487868116EB637CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b76cb0799d9517a220e97a461ede0f97ec0d94ae06931a5955cfb9c5eb896894
MD5 d063e5a8b5fd7ad6e5ae8af3060d7602
SHA1 7280998a29ae251f53e8b65d20a8aad477490a39
SHA512 c653db8b32c55feef6812b268f0c554993fbed551338c7a9beaf756cc62a3a3ec9655c0d2b020702a59ce4159d8ea97be631b5c273475dcdad6d9556869d1d10
SSDEEP 12288:50JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:58dCN/j2GLl3iFSE33b9
TLSH
T13BC42364E9E6F659F11BC37D43A89B655200FEECF6264447868156EB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 876222ddaabb02296dc9f623a52affadb7c43a83849af25a91a1fefe1582bb4e
MD5 cc660a4d14e69812834dcb3030982ac4
SHA1 394bac074a2b56a0732f4512e0e5a73833fd4312
SHA512 8cb862e1b0af9aabb5850388e9c24d39d6a818399dbec469ca76ce12aefb44702d045763f662329d9ae982305eace66dcc57f00e34c7be95d6373b966e3bd7a1
SSDEEP 12288:qiZwb6zzFEoS2cPvy8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NZMSzFVSO0dCN/j2GLl3iFSE33b9
TLSH
T1CF0502A4B39018F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c018e85ba3a626665bed60beb10f798c75abeabe7752ac98a7bdf21185fed1c7
MD5 ca7d2934651199edbb50dc809140a162
SHA1 ee6cebaa4079e6f1d8458ea5f29792c4ed6f1375
SHA512 acbc8ea85959383cbd75c5d794ed94d31cb44f6a6fba19b336920b4272cf275abed6fc574820a0dd2cca3eaa50f7ea61b3d81e23438b726eec66ee3c2f514292
SSDEEP 12288:xRJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xldCN/j2GLl3iFSE33b9
TLSH
T1BEC42364E9E5F659F15AC37D43A99B555200FEFCF622448786851AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b24825e576484bbfbc8bc15a3e2e509cd530ba69703b44926975a4ce37e20204
MD5 ccdd2a0aee16f4064e64a1895db918a6
SHA1 ca4da99594062919693154e5d9df66d3ed3046cf
SHA512 fc3ff6ab989d6859e1b848efccb1ad78ab0b25333244d484c7413751c5bff6b79488a5f5238bfafc31c4281e8618f3a905030d4a8de09106f5c0d0a0aaaac434
SSDEEP 12288:M1JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MRdCN/j2GLl3iFSE33b9
TLSH
T1C5C42364E9E5F659F11AC37D43A99B555200FEECF622448786815AEB237CFEC80324B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d3c166036ad45960abc4295e63497f160858c100242fe153f617bf3087b0aa6c
MD5 98d1f80a5b564747e07dc6a9aade5f52
SHA1 dce369896ee35c489bbc19a79af299712e3eb81f
SHA512 6597e7e818227223ee7b8a79bab76e116935469f680bb00ed9c8f282a1cd91d8c8872f2521b92be510ea56bed2619173a76d38c408ba5350547069f4fe78eb99
SSDEEP 12288:UyPz5L8wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:NzyAdCN/j2GLl3iFSE33b9
TLSH
T100F40257B7A130F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0b5924f268db75276ad81bd9b84bb467d72dc60d3a68022593eb6ee82f0c553b
MD5 5c42a7357370c7764be4c0a9c7ce092a
SHA1 ff5d05912722d412da94bb23f54d2e01ee8169d0
SHA512 f7a2a4072573cb2ceca63490eb84850661559e6769c1e91da81fedb4193a4b283ffcbf81cb355a31c2fbead62f1d90b3d52065e4372cd86a645d3142c170d525
SSDEEP 12288:2RJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2ldCN/j2GLl3iFSE33b9
TLSH
T182C42364E9E5F659F15AC37D43A99B555200FEFCF622448786811AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 cf82a4a9272ed4c9f0bcca4e7a7827037ddb2153bb10e75b33a75620a12e485f
MD5 20a7f39c4cdf13c37b6aa60248a59ccb
SHA1 f8bbf16ac90d1adf4fa2547e3b045fd00b8d19a0
SHA512 e61e5f52015c5daf47003a66f9a8f97842b130849ed15b8d36273b2aa8b07884ac53dcea0f8f024a7ee3b39f9a3f925300fa506c4d861c8b486fe87f2eb32ce1
SSDEEP 12288:2RJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2ldCN/j2GLl3iFSE33b9
TLSH
T180C42364E9E5F659F15AC37D43A99B555200FEFCF626448786811AEB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 742c596e068d85c0d38c98d12cbc03b1865a985d29c87de9734cc71863330195
MD5 3c2100f366853ddefc5a0afbf016c3a6
SHA1 27bc12f2d3a49a6a4938d39e2f5dccae9f04a0ce
SHA512 ac64d5355493fffad2a2dcf04eec35be59a87deace375c32951f943366ed37283926991bd6cd41fa14094804ffa753ff6d3152c6f6f3abe9f05061a855a69835
SSDEEP 12288:SyPz5L8wJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:PzyAdCN/j2GLl3iFSE33b9
TLSH
T161F40257B7A130F9D177823889A55A02F331B87597208A9F439007BB2F377E49D3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8c25101065a91082c93236af43c5610cdd0e8cffaaefebe3b0484cff500dd069
MD5 2779c6d46908668e6c8466979aae48fb
SHA1 0938ff7fdc813d34306660bfd2173290fa8db1f4
SHA512 c63731ef1bd35836a56037551613c738f0df61b41b2480a77bdb33976dc9853ba828fc126d87d0c56267f3ce312da37accbac9b1e59a1320478fbaaa6dd1d60d
SSDEEP 12288:lCd9eWYoaLHF3z0z04PDvhWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:gTHaLl3z0zDadCN/j2GLl3iFSE33b9
TLSH
T1A10502A4B39058F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c9ad8c07f0bfa83c0741e5678dec0a5ea134a16172b5e57bf5d52597d457c2b9
MD5 dde135a6f37e10b3087e7cf68b5bee77
SHA1 ee159acc3b5601bc17e5c3f24feacf64658891e7
SHA512 566a62a85c5150891a91ebd89c01ad3ceed30e382487df0f68712c9da4ebbe604d42d0f13bcbb130180d406e57f158ad3b299e4ca2ecc2cfe23478ebace7757b
SSDEEP 12288:Gi4e7+RdTfgwCHKy7GLbbdIvjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:G37d9CHKy7GZudCN/j2GLl3iFSE33b9
TLSH
T1F325CF90F3E414E8F0B7CA3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 25beef8aef1f1c8f83596bf5cfce297509593a117a4f16d108f33e4c8386cbfd
MD5 3149db682f80fae3713fe94e02e7dfd1
SHA1 2d5373eeb4944d3cc9bd7e8b525da6a4d72633e7
SHA512 3cdd7c0cd1e063e50a3f9a726fa72b791d26df59f387c50d8b15753dcb21be58de4fa69ee16437718ab8695190807e84888bcf02d26c6b2054cceec0c007b53f
SSDEEP 12288:DmJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DKdCN/j2GLl3iFSE33b9
TLSH
T141C42364E9E6F659F15AC37D43A99B555200FEFCF6264487868116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 bca271e316894eecd563c25069ada5d16ffdb9423755eaa157c9ff5d0fbfa332
MD5 b5379051352860109798abd361812452
SHA1 8aac622820a3eb3ada8eb21699fe8c84ccdb3b9b
SHA512 67d6a85138e21c9ee6833319c69590013b8e31619113f1a61b6c4895ad15d59d6ac2cef9fb61d1b0ddde95e50f3035875ad39aa0905983f8d80be4b2a73e7040
SSDEEP 12288:eQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:egdCN/j2GLl3iFSE33b9
TLSH
T1C3C42364E9E5F669F15EC3BD43A99B555200FEE8F626448786811AEB137CFEC8032072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 723a8fec8b94aab30c0fbbd08fc4e61b891287b90015150cd7a27708ee7a3244
MD5 92bcd2f8944ff67ea835eb185b674e47
SHA1 cb90d524953b4f2de84020ad6f9f3f42603fe930
SHA512 8baf3cbd5c4d9c7c9e1d5bad0157c9e12e2d349072a0bce8cb8ba73cb5e28adb19fab53f6f923bea291636db0f644a6d2dc10f2970840e43b3f6a9244d651d1c
SSDEEP 12288:LjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:LbdCN/j2GLl3iFSE33b9
TLSH
T13FC42364E9E5F659F15AC37D43A99B555200FEECF622448786C116EB237CFEC80320B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 5b7d89dfc49b7f68c630aa80a521e1af6ac5b038808dd47c1c529b14de780410
MD5 d2ec89ef6267be9afd0792986d3aeb43
SHA1 9286712b47841c9f745cbbb20247e745c4a69e3c
SHA512 1e38b22f8bdaef16b68cb6b8e7239bc90ee499665dc1f5506de2430d4e9f001ce8f8cb48d1919432875b868403426b1c8319ceda0f15d74c8d4766336dd3683a
SSDEEP 12288:0NsfhJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:FVdCN/j2GLl3iFSE33b9
TLSH
T14EE40119D29852E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F39AD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 33391a0ab23a14f61a1e436b381d564ade484ac5726830da4e127ef2d30acca2
MD5 9e37f26b13b3be392ed17b187431c253
SHA1 8eeff681a9e8f4e4507acece32b4416b86140e5d
SHA512 1ea4b57cdd0c6b86163be82045480e585612935cddefefaa7c3105a1086a7b75b7b814ecd141d7281ecb4d03c1fb82f2f365cfe3c70b2b2f72e2873547f01cdd
SSDEEP 12288:1vJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1/dCN/j2GLl3iFSE33b9
TLSH
T105D42365DBE9F656F17F83780369DA256200FEF8EB258487C54116EB5178FE8C832423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 62584f398c4f0375978ffd90a4c17b12e2492fa7a11ca97c841db939b012eef3
MD5 4d6fd96fa02a8f464a00a1d6246f2655
SHA1 5382676fbd5c5565996476dd84b08ef3e99707af
SHA512 0efa481ea03bbb4c9355f083dac00d802caaddcfea67194372b2161838515d509a28c19d5aaccbd1c1318f59481df1d93c12252a0527b1992b80f613fdd2ba01
SSDEEP 49152:na0h2GEkuAe73q3pp46zwwQ2N/j2U4FH:na0hNYG4Jwvj2jF
TLSH
T13585AF1D67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 659KB
SHA256 9e1954c80069a222a86bcbcd40337c6c9afbf0087183365a8e9dadb996ccd4a8
MD5 a50a7059aa3da057b27b8b76fb1f3771
SHA1 72b3ea76dfdbb7d93ac48dd9262aa9e534304455
SHA512 6c3f6d3b0e127d22d914de2a399f88ab17ec2d762bf99de84f1624b48c13437622070b50abb3eb129c12f91a4bd4ef7ac4abb6811278d07a0aa4c1723948982f
SSDEEP 12288:xhbHjfXzJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:xhbHjPLdCN/j2GLl3iFSE33b9
TLSH
T1A9E4027D66AC21D9F176D27D86958A06D330FCA8572183DF42C182BE1F3BEE84C35A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 4c7a1b4b53177f0224cd0e48771e9ef0f1b82c9b0b1842dd4f7bd20710cd51c0
MD5 80efb0a06c188f53e852b2db42d52d6d
SHA1 858e7c408e9ac6740c3d12d52f55ed231fcf3745
SHA512 a3f7094bb321e176c2057ffbc00082f3de203c3cfe37e3215e1d2262250dd2ec0e02e0bd8dba4f838b34c683068b2562d98986f7c97586d3639d872dce1613f0
SSDEEP 24576:D3YgnJcRTk4yti+R5dBR/idCN/j2GLl3iFSE33b9:DIgnaTk46pBR/lN/j2U4FH
TLSH
T10845B02DF3B910B9D4AAD236450147B5FB71782D1F209ACB0170C538AF1AEE89E35F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 578KB
SHA256 d901fa981cd2df541d9e50ba7b6770be70ad29994fe5e671cb7321dfab9b2835
MD5 a571dac0e24134711a29b4fa48b8f36a
SHA1 a91413d5677411f8c839b40120950e1d7eebdfca
SHA512 f92bb5036b63f09d24d16a597d9aaa863ad7c85123c9a2a3827db41f7f1c726b139181dfe7cfbf18324f37fd7e8578e9c005569bfbb6dd09b85d17b7384a2690
SSDEEP 12288:sTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:srdCN/j2GLl3iFSE33b9
TLSH
T195C42364E6E5F659E16EC37D03A9DB156200FFE8E73245C7858166EB227CFED8032062
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 940KB
SHA256 1121bc30d6e21bd6ecd3105fe0eff7f32e43b203fd4fa9e1e349639f364a68cc
MD5 73c548893c6d53546068ee79d22cda6f
SHA1 e2208785648c0f954fd2e28d5bc978df0ac68240
SHA512 eee503bfbd489666efc9c8c649df50d16ed401499cc81cd79c05f33b990781e80e4835dd78d0b29fa8d77924bab1208ef408935b44f19daa611cf74d8ee5c629
SSDEEP 12288:EOb9A4LWOsvAYFTsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ppL3UTEdCN/j2GLl3iFSE33b9
TLSH
T11B25F154F7A450F9E96BC23C85A68A16E271B89C0724D7CF03A84BA61F237E54E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 671KB
SHA256 86927b596607fd7cf3235871a0c2c1801d35b14b6453d8d48955a9834c586fb4
MD5 30c09276ad2cf5b1b7aa21fe0d8b5971
SHA1 448575970aa4dca6c24a1b1cfb2d380e0eaad93a
SHA512 18576bfad716425841cef7c712b674b8464a5d65b03db3dc389b064f533a84ce6f59374bbe4bc16c3a6f7f5eb9ef35fc1ff6c1ff21923f386c2a531ed8abb51d
SSDEEP 12288:8pFtpOQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2OgdCN/j2GLl3iFSE33b9
TLSH
T1A5E4022937ED20E5E17A923C86968709D330B8A5572247DF42D081FE1F67FF85C36A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8504131140193bf28d6f24c2cb3fe45fc5045d1ce07f119cf38dc9ae0fd6b705
MD5 b1699d8e98d4171fb9e216417efecee7
SHA1 c0a1fc90b29447c74655488f6775ebdc70eea0a0
SHA512 e63172e9601ca91022fbbaa590523b4a7f71e4ab32e7107388f04f508c4e0649601bdd6ea27a55be1950148010f25c6e51de2426e12255b108efb281ae9445f3
SSDEEP 24576:R7NM9YqZqmWMUkPjZM48Mv6bEhsPdCN/j2GLl3iFSE33b9:R7cBWMpPjN8DbEhNN/j2U4FH
TLSH
T10C65AE2E6BEC81E5D477D13DC9E28605F2B1B4611B318ACB5162833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e8451e14168bb5195c5e433771c7496cac4238606bb7ae9bdc39b1e817d3a4cb
MD5 7d8f7c515de6697d4303ba264c2a4fbc
SHA1 eeaa20e6350b4e70ee53c0d86f7921f4e87dfe87
SHA512 45b751189d1eaf99877b63a18ca154bf43920919683372916de704d4018fcf3b219428e4122f7036ad6ed18b04674017555f414ff0e1b8346e2be26482fdcff3
SSDEEP 24576:kW6BApg2YuyuNDYTabvcdvNYf8km1FdCN/j2GLl3iFSE33b9:kF2YuHNETovAvNYf8km8N/j2U4FH
TLSH
T12B858E2967ED80A4E0BBD27D45B6D246FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 6b5c2285d1aea953e4aa271118c2e0d6264f80b2574dc4426ff6643d4880985c
MD5 b17d13ab0d2e019096810a5a74af450c
SHA1 b027f1285f828fe6d89d09a8fb2241f9044806f9
SHA512 4cf7d36b4b15094c9f56fc79a15dfc3f3602c6297cc1e8ec84bdeb85d6857811c3f4cc1d8b9e20330c7658728203d51614b83c5d69ed17a5b4f26558af5e5a18
SSDEEP 24576:hAFs06+Omlf3NXEbToMdCN/j2GLl3iFSE33b9:2Fs060lVXuWN/j2U4FH
TLSH
T14F65BF2F62EC00D5D07ED17D8A97C91AF2B1746307255ACB0260867E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 885KB
SHA256 ea758b49581994e0d15e0946e5f339e888e8e800f2f8cfd81b0d62f5c8286a6f
MD5 8cc9cd956d923449d8b57c44a6f39562
SHA1 d8245cb232143b59f58336f2f61847439b4c7d37
SHA512 06d7c231db1911e7293de946796ab8bd7b59c3cc89e14d56bd47ce9517e9a67539ea9f65feeb08209b9ad16c3eadf472a67b5f75f2bf0eca6b6f4b1c01f7e66d
SSDEEP 12288:dCJnJ5D3VkrDzx/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:0JnJ5D3WXBdCN/j2GLl3iFSE33b9
TLSH
T10C15D02DD2A810E8E4B7C2B4829A1B56FE71387D2F2269C718B4D5353F12FE09979F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 61b72b2b2d492c0a7c60831ed7b84b80cbc0c1053345602e69dda663f893e4ce
MD5 3ddf4c0936e479366de864a35cf00e24
SHA1 5d5a24107f13cb8f4e8c8739a216c1a1506bb2b3
SHA512 bbc8ad144bcb704023cf180f7a8b10450a41a6edc04db0d6bd24bb9be89f523ba055b22e87dcaab0599f37a30c39dcd341d0923c9531ed800d5309f4befb5885
SSDEEP 24576:2EPghm6/7IIXdwcXrif7qQncjlP65i3VuidCN/j2GLl3iFSE33b9:Rg06DIKdwc+eQnSt65aVQN/j2U4FH
TLSH
T117956C15B7EA5294E8B3CAB1CA6291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 661KB
SHA256 44576095a3c48e92cdee9aac91080257b019186202200e393b5f0666404e6122
MD5 95aee7bfbfcebd5841870ae3d4858753
SHA1 7c91f9510348d233fe8ab8378f49b035b4a4539d
SHA512 e7bda2e03e6f95426d3b6245ed5ff7007205758a9a1e4d8ac1691668c6b393b5a8248fdddd108166083812e77b8cb39d39d3c473b372e7233ce0094bc455aa7d
SSDEEP 12288:2EP3RncJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:1nUdCN/j2GLl3iFSE33b9
TLSH
T1CBE4126D6BACB0E9E12AC17D42918605D331F4B4AB2217DF42D1C2BE4F37EE85D39A11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 712KB
SHA256 0f348d5238c26933e7d52d65060b725fab1f4cfbc7c3487b1b7ae4b94c187b53
MD5 d0af24151b956938c8938932d624b3a8
SHA1 e2b7a38e961b071ce2e1e192181598a91c093bf9
SHA512 1800c27fe0550ef61bcb421f8495be0c647a5de2dcdf49148fd0bfa74202637ef32dae3fc1c59a2d91d35a19067055b9dd7b097485f3e7ce9431532112cc75d0
SSDEEP 12288:4jky2JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:4Iy6dCN/j2GLl3iFSE33b9
TLSH
T177F41214A3E4A195E5BA427C86B686549A30FC70EF2186CF41C0E77F6F3AFD49831B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 584KB
SHA256 7f4baaf11ec632c503f64df28c2391e2fc1162cda6b7c0a9e375c17b63840a58
MD5 e78356f3bd6e703073c3692f47dc37a0
SHA1 434dd06ff95a34b1f8d937bf38a9adfcf9d76fec
SHA512 91bab3ac8fe8fdb9dbfc87592cb3ceff337a0e56471a9549a1286148bc94c45c9252d66ac832e6fb42a5dede438769a498487368a08a9c7adc7c5874f28ce66e
SSDEEP 12288:6ygJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:DQdCN/j2GLl3iFSE33b9
TLSH
T1E6D42368A6E5F569E12BC3BC03699F515210FEF8EB2144CB41C0AAFB537DFD89032852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 d8fd9424734ed9b40ee7b506d6a7c6e140c7b9ab3875097c5a0fdfd0c6128b05
MD5 1cb1edfda7403cfdb5dc9c4856335df2
SHA1 d57e8bc53e5fef79536d1dc36c6f5c8c0bcfa4e1
SHA512 5f95cf87fe75a6a3ff6c36ad6ec6493a1bc25d08c801580062d6f123b6070531e536ad905d8c105db0441cb456022b1618cb797352a0fe2528a7cabef61e8cff
SSDEEP 24576:5Q9MxZKdcz9dw3XdCN/j2GLl3iFSE33b9:5VKZEN/j2U4FH
TLSH
T1D2558C2DABE9159AE177D27995A250C3A633B4301B31C6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 772KB
SHA256 db7ba67ca4a9704b6686980f5297c7036d1913f857a85c8309f2edc34891669f
MD5 e0fe0dc4b583ce192493410cee245498
SHA1 4b1e6dc165b07860737e7ffb8214e90000b9002c
SHA512 651890ca4e14fd90740417a08e4634861d99532215cca79b0ace499f063f13698985958f1f032e58214f90611f2a12104683df76e77dfa6ca4ad9777cf7d6266
SSDEEP 12288:CyoKo2JRple9p6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CyocDApGdCN/j2GLl3iFSE33b9
TLSH
T180F4E01FBBA940A2E076823C89858745E773B0709B6253CB5591C37E4F27AECBD34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 8ee169ccf573906d6413e4214d1f6fa399a4828ff5f34ba6a6917a6d9836aa59
MD5 10f7453dbebee44b8af5b8dde64641f7
SHA1 031e703c84e9f8c1a1bb30f8acead47af22db968
SHA512 c855d13036d44111a3bae84f05376442b63739a701994b3ddd9b1db0a2e468beddd67dd9f05a9ca82879b2b491ef4d494f66536e2fb3f897921efd5416466a9e
SSDEEP 49152:YWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKJN/j2U4FH:60zuNIxj2jF
TLSH
T182A57B3DA2F800A8D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 58bccc84c15eab7e5bdc0de3ff33dd59c08bbbf5fea06c3624cee0adbc5d0454
MD5 5cc5ef541b9a1cdfc189fd174d2fb02a
SHA1 89dcd3f922ea5edfd2790b99aea0975cbe0fb995
SHA512 acfffef7a6c0ca07d3cac0c01f63afbaf5f018d77af0b8113aff1ce40af1084bb560ca6f8e56e84d923024927c92af26b12258ee6e35e1866481d279ea9e6652
SSDEEP 24576:q1QT7EcpfxR+N5AWAz3ooiYtjMqbUdCN/j2GLl3iFSE33b9:XTDxR+N5YzTfjM+N/j2U4FH
TLSH
T16A55B02EA7F855E9D17EC5788B23C512FA727861033193CB42A0C17E1E6B9D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/116-279-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/116-331-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/116-544-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/672-264-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/672-322-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/672-270-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/672-265-0x0000000000780000-0x00000000007E7000-memory.dmp

Download

memory/1032-233-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1032-45-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1032-53-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1032-54-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1200-249-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1200-241-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1272-284-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1272-408-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1272-291-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1272-285-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1448-315-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1448-539-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/1560-310-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1560-312-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1624-274-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/1624-326-0x0000000140000000-0x0000000140095000-memory.dmp

Download

memory/2312-318-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2312-260-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2312-254-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/2312-250-0x0000000140000000-0x00000001400AB000-memory.dmp

Download

memory/2364-442-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/2364-307-0x0000000140000000-0x00000001400E2000-memory.dmp

Download

memory/3008-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3008-234-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3008-73-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3008-79-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/3212-12-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3212-121-0x0000000140000000-0x00000001400AA000-memory.dmp

Download

memory/3280-387-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/3280-371-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/3280-548-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3280-332-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3280-403-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/3308-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/3308-1-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/3308-25-0x0000000000400000-0x00000000004D5000-memory.dmp

Download

memory/3308-8-0x0000000002200000-0x0000000002267000-memory.dmp

Download

memory/3440-232-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3440-42-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3440-34-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/3440-33-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3852-65-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3852-57-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3852-63-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3852-70-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3852-72-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4084-304-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4084-441-0x0000000140000000-0x0000000140102000-memory.dmp

Download

memory/4084-302-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4204-245-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4204-314-0x0000000140000000-0x00000001400B9000-memory.dmp

Download

memory/4372-545-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4372-327-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/4420-432-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-418-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-444-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-414-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-424-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-438-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-440-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-445-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-439-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-437-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-436-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-435-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-434-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-433-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-446-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-431-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-430-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-429-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-428-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-427-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-426-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-425-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-423-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-422-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-421-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-420-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-419-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-447-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-417-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-416-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-415-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-413-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-412-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-411-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-410-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-448-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-409-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-443-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-454-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-453-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-452-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-451-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-450-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4420-449-0x0000023EB1380000-0x0000023EB1390000-memory.dmp

Download

memory/4836-281-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/4836-407-0x0000000140000000-0x0000000140096000-memory.dmp

Download

memory/5044-542-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5044-319-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/5056-16-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5056-27-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5056-217-0x0000000140000000-0x00000001400A9000-memory.dmp

Download

memory/5056-26-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5056-17-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/5064-543-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/5064-323-0x0000000140000000-0x0000000140216000-memory.dmp

Download