Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 02:53
Behavioral task
behavioral1
Sample
2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe
- Size 1.0MB
- Sample261017-ddkrzagv7q
- SHA256 203aabae061a0f3ef28944de0e9368bf92e6ca632d812ce53a489fe2da91063f
- MD5 f1c2c6b044f5888a07051d8df0ffb393
- SHA1 f12ccbc3abee03fa4bf7b338196beed23e585a7b
- SHA512 263e9e6eaec9535fa30bc778fd2dfaeeffae5daa98d400bd073bddaf2aa18abe925b55311eb0e5be6cbc3f200af8b3098740c751e7588a0eea16b9c8e36cb004
- SSDEEP 24576:Kv/Hb/xc7EdGTmS/1cQXRQKNhIS5uqvXQVRe:G/HbKgdG6S/1DIcv2
- TLSH T1D435F12173E18072E1BB09709A36DB314DBFBC755962958EA3D53A1D1E32BC1C938B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe -
resource yara_rule behavioral2/memory/1872-0-0x0000000000220000-0x0000000000521000-memory.dmp upx behavioral2/memory/1872-14-0x0000000000220000-0x0000000000521000-memory.dmp upx behavioral2/files/0x0001000000009323-222.dat upx behavioral2/files/0x00010000000093b2-226.dat upx behavioral2/files/0x000100000000994e-230.dat upx behavioral2/files/0x000100000001b987-241.dat upx behavioral2/files/0x0001000000009cd2-246.dat upx behavioral2/files/0x0001000000009cfa-250.dat upx behavioral2/files/0x000300000001a29e-254.dat upx behavioral2/files/0x000100000000b972-258.dat upx behavioral2/files/0x000100000000df1e-262.dat upx behavioral2/files/0x0001000000009fd0-266.dat upx behavioral2/files/0x0001000000009b8e-270.dat upx behavioral2/files/0x0001000000006211-274.dat upx behavioral2/files/0x000100000000a04c-278.dat upx behavioral2/files/0x000100000000ba3b-282.dat upx behavioral2/files/0x000100000000a0ca-286.dat upx behavioral2/files/0x000100000000b94c-290.dat upx behavioral2/files/0x000100000000a1d0-294.dat upx behavioral2/files/0x0001000000009369-298.dat upx behavioral2/files/0x000100000000a2bd-302.dat upx behavioral2/files/0x000100000000a300-306.dat upx behavioral2/files/0x000100000000a315-310.dat upx behavioral2/files/0x000100000000621f-314.dat upx behavioral2/files/0x000100000000bd4b-318.dat upx behavioral2/files/0x0001000000006276-322.dat upx behavioral2/files/0x000100000000a028-326.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe Token: SeDebugPrivilege 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe Token: SeDebugPrivilege 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe Token: SeDebugPrivilege 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe Token: SeDebugPrivilege 1872 2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_f1c2c6b044f5888a07051d8df0ffb393_elex_mafia.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 9f3e8e14eed153e73e4dc92628acee9c1ba816f40cef591eb78a070180b66f40
- MD5 10781685cfd9b006317157009d0cee5a
- SHA1 72b23891130a0a7c455bf055ec0ac31a9dd1cc36
- SHA512 ab54a8be45f8aa2eceab07bf93c32268e6119cacfd576fc4d00a84898c10846728e4a1a260d4591efd7b1224f48b5da3244356cb55a177ccf7874cb041d0752e
- SSDEEP 49152:eAX632BuPkFKRrdE6oh7stBhuXjfS4LWxnDdG6S/1DIcv2:M3q6gjBoGJd
- TLSH T15EE59D03F29900E9E06ED178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 732d4013c0fb08e6b27d73d5a9223a8ba8b90112187845cb1119de210981a11b
- MD5 59eee0b720e1752050da569ca5d8fd78
- SHA1 960e9023a709b2222ae1c5da98d50fcca8c11e4a
- SHA512 07824d75556395b35d79a3f1502242f6d8009a7bf84199cd5e58ed0e7169f06cd4cf9d44b00f6b81fce6416cda2d7ed77e310bb830db3f97d0530bbf48d818c7
- SSDEEP 24576:HXYBuSczA7dGTmS/1cQXRQKNhIS5uqvXQVRe:ZScgdG6S/1DIcv2
- TLSH T13825022977E108FADC6B817CC8A2C511EB7374654360EBDB03E49A690F237985E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 998KB
- SHA256 a40164d64f1e492e19c3a889bebf6db20f257d6876da3c8ec021af21b1540642
- MD5 66a2a5d182e68b7828c6cb5f8f4a4a26
- SHA1 d5a440518350bcd8d10d3cec14cd51966db5be51
- SHA512 82956853e5d3dbdac4d77448ff6c73a5cce37660eec50cf3ccdb2a40e3990eeda3340a59d59040575b29a761b7295f4a3e402e7f93e9c6d3d962ecfc51699f40
- SSDEEP 24576:ZwutOWGdGTmS/1cQXRQKNhIS5uqvXQVRe:Zw2ODdG6S/1DIcv2
- TLSH T16225010A76A50CFAE9AB4138C593D535F7B3B8112A21DB5F0360CB5A5F37361AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 bb835ea8c648565f8958a9013ea86342240cf76698a95b52276de10db4ffdeb5
- MD5 6ade25eceb5433ae88ea42504398bbc3
- SHA1 ca4f6c0006724cda4f0426c038d5324f7872923c
- SHA512 e4ab01f439caff5e91de4e95f10438d599de7f431f8fd9da8a9e0abeae9c6eca606f2e3d39771f274fae78073f80465bcf1a7922810dc80c1728eb96ab8efcc4
- SSDEEP 49152:hT+taZ3usBWOBr4tEGp0bqx0z+n217aau1glNdG6S/1DIcv2:Fu6JmTxd2dLGJd
- TLSH T154E5AE13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 812effb1e112b735d8878d0aa10e0b237bcda449ed339a59cc05b3d5498a1afa
- MD5 913ac8b705b0987d1f98908d9b1e24d8
- SHA1 04d973f1c2afd012f91b146f30786ecf983c768f
- SHA512 f4c925ddd566fb416a1a1f5385d4e7d6003495d33d06ea8cbebc93e84825f5013b82aa1476a72e462a16e3aadcc28486ca921806b91d958370f72da28abe231d
- SSDEEP 24576:5Awvtk9RX6wkyAI0dGTmS/1cQXRQKNhIS5uqvXQVRe:rMnYI0dG6S/1DIcv2
- TLSH T15D45E029EBD848E2E07B913CD9B3460AF6B178691B31C6CF029A53AD0E37ED45D39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 910e0284e4a62f8b98905ce73d8ca1bfe13fe83ed739f08379a369d0855fe67c
- MD5 892d2a813a368b781b7e3147885815da
- SHA1 c7a1f1b171050c5ee9fc3827896351fee167f47f
- SHA512 35b3f6b10ff96e2154b8b4485100d4f8e956e3b4c02e51a396edfca8614112d246eb9a399655b9de9065c1efdaf5d4532bcfc56ab08f79f0592bc8e3b720aba3
- SSDEEP 49152:BYg1Npsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0RdG6S/1DIcv2:hySzPfGJd
- TLSH T1D6067C56A1A801D5C1BDC1B98B1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 48f41bdf6a9aa4de255f39e63003a95a99fda1467d815599f4c36f900c8fdbde
- MD5 5504798e7635f8726cc13ded17322627
- SHA1 2d30cb3f6036c95a41564504a6ce220af3f897fb
- SHA512 2e0265403646f5f60faa084647af722e65813fcb84a5cf3c14cf8108dd4583916102e2f4c616a82e76917283e3a69729c2c4da33d6d55662de1ee5c0bd045905
- SSDEEP 49152:m97JUQjXirIhCnDHUPfF//dG6S/1DIcv2:UJtglD0PvGJd
- TLSH T1F075BF1EA3EC01E6E1BA827885158A1AEA71742D5F32DACF1270437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 33d725a496012f6500b495af704132fe2f60939e8b90d05ff72db40f8ddea89a
- MD5 bdf0deb8382bed0316d6c1f64c104b87
- SHA1 79b709e9047b7ec0b780de93fa6a3c601938dc33
- SHA512 b830bff48f64a5cc04df6b855a9f73d8712c9ec960352deb765b19855cdb40f718e78e4bd79ccc703d1db559f6aa92c81ad07284846c6f34e803d5b8e21ca241
- SSDEEP 12288:DV7CgQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMlf32cpvXT:JCdGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T17205232A96B74DD3D46F05B0D563E920FB77B2748742AAD6C0562FCC0138FAE4E2D909
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 bd024604dc7de1f8dbd42bd27392f2e736a2c6202c2a705c31a8759a52ede622
- MD5 e7f6f30bfd25c3f1da3c0fb866c31ac7
- SHA1 02bca774617f3cc825fbeec63618db009dc934d8
- SHA512 cc6a52070e7f96008bd486d700734f36bb24747a964079a5436313cf781d93b21eb8267ffa1b2d0e09c59da903c85a2a3bb3b422dbebe051b60c85c362327448
- SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYadGTmS/1cQXRQKNhIS5uqvXQVRe:/gb4mBIBhGF/dG6S/1DIcv2
- TLSH T1D075BF1E22E802F5E0FAD2B8DDA64417D6B378160732D6DF0151426D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 9aa8a884cf4171b67c9e5899841a7f88aa3a967b1c7d6c3f8888adc6bd94a7bf
- MD5 98ccd127124f0e6c4d0526b0b779919e
- SHA1 c75aa2228d79784101060a804c3b1737f1c0515e
- SHA512 134bdbc49a5e037dd721fc61876f354ab672fb6b3922aeed16a383af62ad8894dd0f519e25db8d6c134bb8e39e722667cb43572e15e6eca66faf9a2b3a444ca5
- SSDEEP 24576:oTkNvNnaFeYhJNtmZBmTdGTmS/1cQXRQKNhIS5uqvXQVRe:oTMwBtOmTdG6S/1DIcv2
- TLSH T10675B02EBAF846E5D1FEC6B4DD238512EA727461073293CB5290C13E0E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 832KB
- SHA256 bd7df7a7ce76aeb732b199d70e5de4dc16c588282bfb851fbda4b31890edd467
- MD5 e4371175cdca1f93636e81ff11852d22
- SHA1 7a25963425eb5646e8d2b82d5b7aa94d82b20a2a
- SHA512 ca9f273de2488d6b033872ab15bebad375cbb2b34c770b17438d3ac1e0cc46789203629298296d46e58965fe96c9cb30001865e9ea1d2189022120bd6928eb09
- SSDEEP 12288:cMGlgQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMlf32cpvXT:pGldGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T17F05232E65F729D2C43F85B8D572A951F9B271B087023AEF40D1AFBC4B28AE5563DC04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 796KB
- SHA256 06587abc2fa1b9fc5da346bcb7a9b52fc5b6b13bdefe7601c216331ed2308226
- MD5 96a40aa6c950d8535dd6a4c8c76fff51
- SHA1 e8ab7ebfc20d9e34b89b0a020e44cbe65f3959c3
- SHA512 a781b77cd1d368c1801b9bc1dd017e288abb56b02995df318302b111527386737dc92a63098369f723ea8b9e2e258c1f5b0866868482fd2912ea0691ccb0093c
- SSDEEP 12288:TUgQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMlf32cpvXV+i:TUdGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T1A505232A65B74DD3C45F44B4D5A3A950BB73A27487833EE7809A6F8C016DFEE0A3D805
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 7b04961bf2c1ef54b1c919a42d5ad21290f4728f6062864f55d84bf665f5a5be
- MD5 c978fa1a85f21a71cec01d10fe8e08d6
- SHA1 45c31ef2b94cc410501fa153675cdbbd20289a27
- SHA512 c4178ecf4bcd53a37cfa20f9d1ab82b92ab0c103aeece23df13dc7ee40245eb9ac2c5177c847bdd4ef804c73f589ad545f9197fe558f599e9eb11ba1c8261d07
- SSDEEP 24576:WyH8H82pJqH102r3a7/mfdGTmS/1cQXRQKNhIS5uqvXQVRe:1cc2PqV7a7/SdG6S/1DIcv2
- TLSH T1F255012576E101F1D47BD138CA824A63F6B2B4250365EFDF06A88B551F23BE54B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1000KB
- SHA256 7e61cb10fb517328856c63c8313486610161696bc16ef066d4e62f9a7da81a5e
- MD5 b927cc2e51b09bc9dabba8fa2195eb6e
- SHA1 35dd5086508ec340681bfe5d3c184f2456d38007
- SHA512 1f16b9c225bba9d7ed33dcbaa676794f1e04dfb6828ac1777a05e9e3d31a9e382e2be1a375672d53e300f3c33a0da876375bdfad13c7e66e8ca25ddddabe7dc1
- SSDEEP 24576:SPUr+NQ1dGTmS/1cQXRQKNhIS5uqvXQVRe:SJQ1dG6S/1DIcv2
- TLSH T10125F22F66E91CE5E57E917CC5828719F772B4620312A6CF02E1817E0E67EE86D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 670fb3b55a4dfc989878fd9e95f6054d64c7cdc4ae0ebf66f198c126f57e3e74
- MD5 de86cf628bfb6044dad68114985dffc3
- SHA1 09d7fa2ebad9c123aa9372432ed0e9af26e43863
- SHA512 878ee1f5ca314d5d95a7732b6c157ae542bf388591eced2ed9ba34bf70e20879376bbf4a5d8e7babec931ffac7dd762c7f094d99dd7d516c17ae9cf22faebc03
- SSDEEP 49152:vBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjWdG6S/1DIcv2:gG05lO43bfGJd
- TLSH T19BD5C06E62EC11F9D1BBC17CDAC68A0BEBB23425032556CF02A486A91F27FF4557E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 fce19240bf98c74e53bbb6c5cddbd28a89e7938f1f3eb66f0e32d508a6d9e564
- MD5 0dd8463151b67dd8c772a675f891b4e6
- SHA1 b7e825a6019b1894fdbb81a23bcfd2163530b92c
- SHA512 6891eab0c6e9c514dfee9fa55ea545e207029612e396b2bbbebd7c2fb9394e6684e37d0f00728274d8d47b8386ceab88c2063975adb8e2275544c8fe6616ff60
- SSDEEP 24576:WPa5POZ3dpbWVM50JicR2hG0lasx2+47eidnHdGTmS/1cQXRQKNhIS5uqvXQVRe:ma5POZ3wJt2pasx2+m9dG6S/1DIcv2
- TLSH T1AA75CF5EA6FC01D5D5B9D17CC583861AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 920efb1e3f42ba5055ecd358067a4674d24e8c16eb6df37e3d389e9ebc8fe59a
- MD5 8a2266b0a071631d0f4207d489767edd
- SHA1 f241eca7381795871085dd96b5ff0bd169367123
- SHA512 1a0dc00666c9a4118ab84bf92828da72dcaf20231b48f81a8a1aa7736ecf2440f26eff3d5ce1f89edc10506992b82b233ca307d2f3200f2837c69974b4ff1202
- SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7FkndGTmS/1cQXRQKNhIS5uqvXQVRe:gNc/zEOVHFidG6S/1DIcv2
- TLSH T192959C2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 65f81b5f85d104567a6cfba490292b4ad9b9d77c8f94afb3a26cb39b02cebe63
- MD5 ea5f3e1e7ab25c15588aea03ed1fa270
- SHA1 5bfad5a0d10575369f95cf0a2f019cb12b57d975
- SHA512 65fc2c6041a438d008338249b6f9f2aee77389b1ab6d4809082fb8ce3ef9cb820e5e5bcf897da66485cd9727abad7f28653fb5b00ebd0bd601def30b520a9cbd
- SSDEEP 24576:vD3FHshBIYQgAYdGTmS/1cQXRQKNhIS5uqvXQVRe:vDVHeBIAAYdG6S/1DIcv2
- TLSH T12C45F13EE6A904E5D47FC1BCD6638A06E77234B9032266DB019481B91F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 1ad031ebdb23c114c0ac22eba3784cf0859dd9052df5509a6f879fbe0e235250
- MD5 9b01917bfb0ab7fac0c1179129cc13a8
- SHA1 5be4ece993508c86a0a5c1866abce9bc426adcc0
- SHA512 4b321eb4f52fb558efc212bad2c31fbdbff7c1a473164126d83f9e8f8d64cbeaefc0650e31b868e27a156e543bf754c00889b0bd5b92733eb6e503bada19579a
- SSDEEP 24576:+JnJPbzB4SwpydGTmS/1cQXRQKNhIS5uqvXQVRe:+JnJv6SwpydG6S/1DIcv2
- TLSH T11935E03DD2A810E9D4BBC2B481561A59FF72347C2B2269C755B4D9343F12FE0AA39F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.2MB
- SHA256 8b75675cd5971f03e1089ab5e61bd5ca72b62826a2d84cc0d480950e0f091d62
- MD5 d4ba099ef9f8370432b325870ea2ef29
- SHA1 ffb29db9adafcec04aeff991a6efbb4bb642ab3a
- SHA512 f58b9e4989d742493771e2b48ce95e449c3a954a65631a568690a25ca7e8fcd95cacabd6441eb6fb70fc2d4f596505be97d2dde3d11d30b4a56781e7737f53e5
- SSDEEP 24576:RZLHGL0MoeVtFumTijCmlKQWDkOdGTmS/1cQXRQKNhIS5uqvXQVRe:RZLHGeeV5ijCmlDWDkOdG6S/1DIcv2
- TLSH T1FEA57C05E7EB4184E8F3CAF5CA2294169A327C549B34F7DF4A80CA6A1E32FD5D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 948KB
- SHA256 f0ddcf3327eb8177d4dd597b1830d6cfb3f20191b0630e3f59868a07da0c05cb
- MD5 c0acd5a1df809c6f6d8c345556210bfb
- SHA1 d6167e2cf651589a333f3fb542c003822e012446
- SHA512 c35dbb356f3efa17e248087f56d8bf0fff51f3a828d24bd9807ed8e0cc9489bb7896800b01d4716d8a827847c0a3f14aa363a5a3224c09568b2bd142d2b3d7c2
- SSDEEP 12288:36H8kuj5ZI78gQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMp:4uDIYdGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T17E25011D23BB10F6D06F807DC6934501E6B2B1B087526ADF46948ABD4EA7EDCB93CE41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 932KB
- SHA256 6663145e5c9992776587d43f1baa2506564d95fca4654f385dfb61eba8e09024
- MD5 f7a73eb76993a88de365a05c593df955
- SHA1 41ae963989d0f68f085452dd0e008f2574099d77
- SHA512 94f8c246c45cbd66b4bd29cf2cb7d10a1ad141bedf0a7d2f4ac5e957c31d83ec50a140be87165417bec95b32f90548c9aad6d6d7b55a824a1f9ac8cdb13d0928
- SSDEEP 12288:NG6kyOgQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMlf32cpr:0tyOdGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T15415220963E558D2D5BE0178DA738660EF32B8308B1267EF41D1AF2D1F39BE96934B05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 940KB
- SHA256 b7fb6bfb3115e9c6578080714ad261dcd0afe5941edd4ac270b1d63eabd16b3d
- MD5 71c2572b6a86b155a1d73c0370bb5589
- SHA1 42cfe97eb5e9da03ff07a4b38e761911fb0e1776
- SHA512 98621d6bba2d156ff8741e764c540fc42814d85413af7a1e4dc493f6b8362f2649974ab7a2d0df671cd6cc8704c92a68db84609fb110281074cd79dfe41b83e4
- SSDEEP 24576:h6UqjpndGTmS/1cQXRQKNhIS5uqvXQVRe:h6UQdG6S/1DIcv2
- TLSH T10A25231E66E118E2D03F4174D972C124C6B2B87103A26AEF61D89F7D4B39FD9893EE10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 804KB
- SHA256 d36a52775bff1df5f5d7802c359e8c91b50a6cdf5fe20b8001396091f3b6bddc
- MD5 834690087d4cfdc8ffff6a6268086acf
- SHA1 7bb7b67102290ac7db7a64477d9ab7600c2896d3
- SHA512 4da08aa0671ab9ece80d3fc64e005475b4b8c66934f0a7938ef9439292031863a268ca52fbc6f90f027e837bdfb6a1b7790ab28d42527d9db56ade8592e27cf7
- SSDEEP 12288:xtrgQGUemscUjftLhem1PKFfD0DJXXQsQzZL4v0YDK8TIWJBENRYeMlf32cpvXVV:brdGTmS/1cQXRQKNhIS5uqvXQVRe
- TLSH T1CA05232E65B71DD3C45F44B4D162AA10E673B27487433AEF80D66FAC467CBEA4A39C04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 52846316690ea12c4aa7d56b2a6399fc29add9ed4abcc52c0f80cab2daff94d7
- MD5 a47a4e64d7e73d0e7bafa4d0394ded69
- SHA1 581e89ef256923a17508c9f2fe17aee85a1959c0
- SHA512 e9993f4400b032247a462d88369eec553bba7422e94f66314f1a8a9442b1f7fe73df728be591481a737f3a3d67490416121b4e474118c799006d85616e796cad
- SSDEEP 24576:eSgtXoTfaidZidGTmS/1cQXRQKNhIS5uqvXQVRe:lgKTrZidG6S/1DIcv2
- TLSH T16165AD1D63EA09CAE2B2D275D8725493D633B4315772D6CF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 964KB
- SHA256 948b641bbf83908ee7977d5649d7138da93aa507709f5d21efc6fa1400fc7e4b
- MD5 83114f528d83f64f6426488563290d01
- SHA1 bae7c05e25d0db92e614a45f7fe48c5b9c533a1c
- SHA512 bfc1dc461971e3d991a3d2a4b3d9bb478033087c21c6db84e47eb8661b12e718d9c8ea7e4cf3de145fa92f3460d5369b368d9f4f5f2aefd1ce197b8a2e19577b
- SSDEEP 24576:XrcmR/dGTmS/1cQXRQKNhIS5uqvXQVRe:7cmR/dG6S/1DIcv2
- TLSH T1CA25011EB2BB00E2D1BB817CC9424615F6B3B070535267DF42A18B7D4A6BAED7D38B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 d5e200f8eccaa55160801bb8ac4f0c2de820502898a15006cc09d684315a1601
- MD5 2c54f2ec0c9c08e751c178a292f5847b
- SHA1 d4138967bffd1860c56457e55cc9bb5082e59c19
- SHA512 28d1b892fcaf1910efaaeeeee5e2c88b408765a9d19599a955432cbed672cbc22716835d093e3d86ce74c64d2f1d1c6c8477b4df40c561b35ee5bf4f946611b3
- SSDEEP 49152:EDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3JdG6S/1DIcv2:h3Upow8sBIGJd
- TLSH T13CB59D3DA2E810A8C9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F59
- MD5 SHA1 SHA512 SSDEEP TLSH