Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe
- Size 1.6MB
- Sample261027-lapwhssyez
- SHA256 ed91e4580b2d1d7a6c9f2eedd8899594330eb119e794ff8802f852df09e9db25
- MD5 ae71f81f7a7852ff3f0371f4a515e068
- SHA1 9d04bfd653c28906260587770e149523cc19f77a
- SHA512 4197ab2c527bf8d36edb189e97422f4155978a7baf1dc07ca7ec093f9c3b7042749c137f6a64e6e0af6de718c0a36445579cd0536616f4b7211df2ad23cd9b75
- SSDEEP 24576:qFz87OL93HPYsglYbQkLIT6ETzgDXaKngL2jdshRTdG1YxITqvfPkbIcbjLm:a3oyLITJTcDXarSj8RoTCCW
- TLSH T16875CFD0B783D1F3E741007240A25A3955B277BB9723A9E7FAF82E8DDC256D26C35206
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe -
resource yara_rule behavioral2/files/0x0001000000009344-222.dat upx behavioral2/files/0x00010000000093d3-226.dat upx behavioral2/files/0x000100000000994d-230.dat upx behavioral2/files/0x000100000001b990-241.dat upx behavioral2/files/0x0001000000009cd1-246.dat upx behavioral2/files/0x0001000000009cf9-250.dat upx behavioral2/files/0x000300000001a17a-254.dat upx behavioral2/files/0x000100000000b96f-258.dat upx behavioral2/files/0x000100000000df1c-262.dat upx behavioral2/files/0x0001000000009fcf-266.dat upx behavioral2/files/0x0001000000009b8d-270.dat upx behavioral2/files/0x0001000000006215-274.dat upx behavioral2/files/0x000100000000a04b-278.dat upx behavioral2/files/0x000100000000ba38-282.dat upx behavioral2/files/0x000100000000a0c9-286.dat upx behavioral2/files/0x000100000000b949-290.dat upx behavioral2/files/0x000100000000a1cf-294.dat upx behavioral2/files/0x0001000000009384-298.dat upx behavioral2/files/0x000100000000a2bc-302.dat upx behavioral2/files/0x000100000000a2ff-305.dat upx behavioral2/files/0x000100000000a314-310.dat upx behavioral2/files/0x0001000000006223-314.dat upx behavioral2/files/0x000100000000bd49-318.dat upx behavioral2/files/0x000100000000627a-322.dat upx behavioral2/files/0x000100000000a027-326.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107515\java.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe Token: SeDebugPrivilege 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe Token: SeDebugPrivilege 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe Token: SeDebugPrivilege 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe Token: SeDebugPrivilege 4636 2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_ae71f81f7a7852ff3f0371f4a515e068_elex_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 ad1cfd808185afcdcd98158d786b9d04eedb0772697d5c17dc74688afe689e42
- MD5 d9393d5d8fbdbdb91310e38496395ff1
- SHA1 141685d13de70d1207a0dc15b4cf47943e4d684e
- SHA512 47dadb3a37c41635e7e1badf4766bd471ba7eb30535a03796669764aa5b63926e8e7b470987e19dbe6362f39387a3ed01d1d834bd0d3a68200332682f28ab169
- SSDEEP 49152:Ub+632BuPkFKRrdE6oh7stBhuXjfS4LWxncarSj8RoTCCW:O3q6gjBPJTy
- TLSH T13DE59D03F2D901E8E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 e0434815bca1419b672225bdc2160f6d3bce617a58cf234d9a7587c98dd9d82a
- MD5 988f9d8c4281efaa2f5424a6ab008718
- SHA1 a42dc06f9ec9dda0344a0f2479981ec09e57fbe2
- SHA512 e4996a376024be70f9b862fbe12b98f5d62fff5ff2eaac03e653c0aaa82f3c89ab30bf7b03f9adbd0cebd2b6867488b7dd1fe1c55086de616c6227d72307d10a
- SSDEEP 24576:BXY1QtczAzaKngL2jdshRTdG1YxITqvfPkbIcbjLm:ZtcearSj8RoTCCW
- TLSH T177250129A7D409F8EC6B927CCDA2C905EA7378554764E78F03E099691F233D85E3EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 27e416c609d5bd874695399b5f754957fc0b628191ab64325899636b190d7c18
- MD5 1584111faed17038e6abbd698e23397e
- SHA1 8711b919fe1429aad9a227badfb3c391de0b99c0
- SHA512 b6a3ec1aecb962117e5e6eb6845dbb9e596e014dc42ab0490ef047e9eb5f473db60662f2555813070bc57a027560a2e1019f510cbb0f1022b71a7b6c29b669f6
- SSDEEP 24576:dwu7OWlaKngL2jdshRTdG1YxITqvfPkbIcbjL:dwIO+arSj8RoTCC
- TLSH T1B225014A67D40CF8E96756388697C536FBF3B8052A26C70F07A0C65A5F37361AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.8MB
- SHA256 7f5fe3f0b878de643a6212740da003508e24365168ea7d0144f79b3af6036479
- MD5 17fbfd777536f2953aff35f623618897
- SHA1 f1f437f26ebd57dd205f0ec8cf49c15f96862ea0
- SHA512 9af58eb7a5cd7539a5d4f2a9d07ba6a960c477a27443f720cd4bf7e5079b91d59b6032fa825edb2f29e33dd13e3a1cdea787e947a2fb40828f0ab4376302e6bf
- SSDEEP 49152:mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UJ:1QRQyi36YOcP8Lvw2gAf+PN3qJTy
- TLSH T16B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 42c17aafd81e60d2c72bce362a37b457aa689aec66545fc4af01075913534340
- MD5 3c3e701cce4088928286f5fb9b9c40e3
- SHA1 81193d841c4265c4666e238c1c705e4abc8cc560
- SHA512 2d7bff43a19e3883e6941b281f5a3b9067158fd8076ee7f7c935afb9e50c426975da767adcfed8ac89492a1a398578e603868c44ba6584ed0849a2e251ceb814
- SSDEEP 49152:LB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glGarSj8RoTCCW:du6JmTxd2dGJTy
- TLSH T124E5AD13F2DA01E8D06ED178974A9233E962BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.2MB
- SHA256 0ae718f447167d3eef2818c3ff3cc57b3fc6263f7a2d89d7ac162dc5e7ef34fa
- MD5 a4576879d113577881560eb955ad5bed
- SHA1 5c1ac0d501116f1b5c52665ff7821f2b664c8ad1
- SHA512 324315a6cb4319f32cc89f3ffa9ed090a70e88b5c809a91ed8fc186a669f3ca91c260c698f93e48ed3da9819808df1e5e92dcd0a4b6bd614f566bef1a606c76c
- SSDEEP 24576:gRwvtk9RX6wkyAIcaKngL2jdshRTdG1YxITqvfPkbIcbjLm:HMnYIcarSj8RoTCCW
- TLSH T13645E029EBC844E5E177923C99B7460AF6B2786D1B32C2CF029953AD0E37ED45E39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.7MB
- SHA256 35b30d598abcef972d06865c584f90b929300d391d5c9521bc6761f23f49e874
- MD5 ac7d014fa895d193dac779bdda339acd
- SHA1 ffa6fd37e8f505ff9cbb2721fc2562f0a6339ee7
- SHA512 5d1740ccb2885c67947d016e396b081f2fe0aaa7eb091be6a324d7354a1a7bdf14e22cf10c87dbf577ff4bf4363619b1bcd6d9934bc2c26f0e55c6156ed87bae
- SSDEEP 49152:/YklNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09arSj8RoTCCW:HySzPlJTy
- TLSH T150067D56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.6MB
- SHA256 02829e137de62e5c7cb213497b845592d51adae4e9364aeadae4f1d12bd61d83
- MD5 745e71d7f8e3988c25f24406315f15a5
- SHA1 97ed43e6b5573507448ba44cf3b58dcd50c39e8f
- SHA512 216216fc58e0173d93314ba20c0747b61d6e576955e98fa9d3142ca529634815ea834c13cf860710ee8c6706b981e4ffe971f47308286c83f1553feda792c22d
- SSDEEP 49152:V07JUQjXirIhCnDHUPfF/sarSj8RoTCCW:mJtglD0PKJTy
- TLSH T18375BF1EA3DC02E5E1BA927885158A5AEA71742D1F32CACF12B0437D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 34a8853259f7992e8344a75ecd790156033362aa841ecaabec3c3f2e8abf3343
- MD5 92d0c5d03e06086c19244f4b2d57c2e0
- SHA1 9704cd4a6e419a76a436521d081274b915a66037
- SHA512 115b7fd9bd2eb1596a1586c812b77991ffbf7d414b179c5bab1fb3ef1e367a85349a9c78e3c78f650553e42da29c57900608ef93489ef23099a3fe9fae60bf8c
- SSDEEP 24576:cHaKngL2jdshRTdG1YxITqvfPkbIcbjLm:cHarSj8RoTCCW
- TLSH T1FC05237BDBC88F50E57A3B743AABE94D3CA33B5D8A0B824EC990169C197A7D05D3C504
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.6MB
- SHA256 8d38e19ae9605ccf728275885394d39a9a10589197bdc117f741958560535c95
- MD5 01ff92c094678bd58602f962a050008b
- SHA1 eb0395a912be4f68ec0a6ddbe9248cd148ff45f7
- SHA512 5c18620fbcd0fa9b73bd644d90fe424239a1d833650c68e4b05f6d8e3d91cc0f2646ed3acc8a1a205ab09576539a4a515d07bfa70a16c43877bb5db011fe1931
- SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYCaKngL2jdshRTdG1YxITqvfPkbIcbjLm:Ygb4mBIBhGFparSj8RoTCCW
- TLSH T1FE75BF1E22EC02F5E0FAE2B89DA64407D6B378164732D2DF1151426D2F3BEE89D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 a3fbb8dfbf474abf997433b3bfe053ade68ac4517558362a193061149fc5b2b3
- MD5 44691af31b34bbd69faf98730945c347
- SHA1 b08209c5abba23703f0c30450206827fc9930a51
- SHA512 bbfe269a70bd4ed66eb35a4ff42deefcee53e0026f536a40d0e736722b4b935b7feb2fdf4be1649196e27262910c21489d61ff31848a4a911e3b1d2aabf15d18
- SSDEEP 24576:mTkNvNnaFeYhJNtmZBmvaKngL2jdshRTdG1YxITqvfPkbIcbjLm:mTMwBtOmvarSj8RoTCCW
- TLSH T1FD75B06EBBE846E4D1FEC6B49D238516EA727461073293CF4290C13E0E679D89D39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\GameInputSvc.exe
- Size 828KB
- SHA256 0521f3ff267aee1e77e96d53f347f7f804b51f78dfdc014cb1a86fd711e211f8
- MD5 ef61da695fe5fd463ad8740ca5896cc7
- SHA1 c696e6688220977a9e551f2128993b0503a19ad2
- SHA512 8630000b511aa04950286e94e6c5aee3fd3a417cbf20f816514930c2042eee052ed04a60b2ce8ddf5813a3d6a477af00a4474889d5b564a7658c786f68aa4e6c
- SSDEEP 24576:bG9aKngL2jdshRTdG1YxITqvfPkbIcbjLm:bG9arSj8RoTCCW
- TLSH T1DE05237EA7C556A4C43BA77829B6A84A3CF33768470A46DF4CE0957C5F6A7E0263CC40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 792KB
- SHA256 3fcf211890ab920888b33585d57002bd5cc41d1481fa6fe3efe22f877efeea32
- MD5 50aabf1a791a30169e145800eb97a8a2
- SHA1 d4d1c14553b43693d9253bd4dc426dd6c0089ac8
- SHA512 4ded03020c8ef3fcbcdcdd95f94280b83f6c681fd84063147fd59bc62732fbcd84581570c15cf45ad84528bcdb2cf080c5bafd006acaafcba9fe2fd677d52619
- SSDEEP 24576:+uaKngL2jdshRTdG1YxITqvfPkbIcbjLm:+uarSj8RoTCCW
- TLSH T1B40523AFDBC48B94E55A3B743AA7A84D3CA33B5D974B47CFC8E0159C19AA7D1263C400
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.3MB
- SHA256 d2dfb32f3a3724529fa0b399d5b8fbb067af1a03a940754e8320f1845e37bab5
- MD5 6a13339654cb47abf12a9f27e6492399
- SHA1 39d53c525be2b0d8e2aed95cccb75742ba489c1b
- SHA512 5446922b2c9865d1c1967e02ab2b16c792fab32b0b10d18e0b1fb5216e09b614bc8ca1845ca0bf7d56a7c9f756054924eed2b7e2c92c12e8c5e9a5e1b7d3299c
- SSDEEP 24576:00O8s8FpJqH1Vzria7/mBaKngL2jdshRTdG1YxITqvfPkbIcbjLm:5tTFPqVMa7/KarSj8RoTCCW
- TLSH T1BF550265B7D102F0D47BE2388A964657F6B2B4250365EBDF07A88B551F23BE10B3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 996KB
- SHA256 eaee52329d4805e3030101bffaf2ed36bd047ca9e5e15d974b81d5f6f87672d5
- MD5 77b12e1a797f16bb7a8076d4dfd9202e
- SHA1 132653c3d25dfce6318ec6559c5bf0b7e1e92eff
- SHA512 2d0a82d72b2850b7354600be077c29f7850dbe05bbe46fd0a3056b17aeb57fee270ad086a63bab6d57f616892356c78909f1f3b5f1a5f1351071cb8bb771a502
- SSDEEP 24576:sPUr+NQbaKngL2jdshRTdG1YxITqvfPkbIcbjLm:sJQbarSj8RoTCCW
- TLSH T1DF25F22F66D81CE4E67AA27C9986860DF67274660702D2CF02E0817E5F67ED87D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.8MB
- SHA256 43dbc04a336f2735f1ae3ec18a3a171cd413b3ad984b031703b9ee7690c89330
- MD5 673bc7dd3850b494f7698a398a51a338
- SHA1 f4ff90b771b61edd2ae584d4e56e5f56096803c8
- SHA512 159445861f38921f420ce520b2f18f5bcb804964d7f40dd2fea6fa0899ee6451847afda695dbb24eeb3b2c9ecb38c3326e3a3681f358ce28fbd8695fa34e17d5
- SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxarSj8RoTCCW:+G05lO43bYJTy
- TLSH T199D5C06E62EC11F8D1BBD17CDAC68A0BEBB23815032556CF02A486A91F27FF4557E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.6MB
- SHA256 703da9a0e5adf212d0b04039d1a9bdd63ad9f158646f505af4d6a5610efa8ee6
- MD5 f0dbff58f2dc1db28f5a6c918270fb12
- SHA1 20e63ae4ead3af09d96fc20bc4e5ca69600c40ca
- SHA512 1bf2207545d9ebb5f0d07c59fd8c22f0691ed15137ced23499e870c77de4ac6e2f440ccbe905c4d20681e318e3ee576e249678acc1094424f943c7eba3cdba96
- SSDEEP 24576:TRa5POZ3dpbWVM50JicR2hG0lasx2+47eidn4aKngL2jdshRTdG1YxITqvfPkbIp:Fa5POZ3wJt2pasx2+mWarSj8RoTCCW
- TLSH T13275BF5EA7E801D5D579D17DC583860AF5B2342553329BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 0d1301b6939c649a4eb7b9f35f4a6716942a21a1e97a959dcdce994ca52b64ad
- MD5 f7f3114e593dc8bc5ebdfb893c487c63
- SHA1 95fb60503f7019b4d7d99d0af445392b13e23147
- SHA512 a072a560bd27137621c8d497dd8b15d87fc11fc665f72f33cd943536a2237ab085e340059a3c9b3383bf05c447ae4d26027105398f4f3150210444aeaca3d160
- SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkOaKngL2jdshRTdG1YxITqvfPkbIcbjLm:PNc/zEOVHFNarSj8RoTCCW
- TLSH T196959C2623E901E4E1BBE1BE89779546FAB17869533086CF0291851F1E73BF45C3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Sgrm\SgrmBroker.exe
- Size 1.1MB
- SHA256 766074da3f0a97e2b630863fda7c403857ee5111ec4541f17deb0ee554f842d3
- MD5 863bd33a5be50c7d89514b946542ca76
- SHA1 9b96d2f181488d2f92e9da3f491330dd7f466bd1
- SHA512 73359dccee4a4fa0196209a517a2e3f3d29d0c5449f22f3783a27a45c88a72a46aa9c8776fe6a574828de1de8c29b9c97ea5044f8c580b0ecc5a37683296bf0e
- SSDEEP 24576:PD3FHshBIYQgA1aKngL2jdshRTdG1YxITqvfPkbIcbjLm:PDVHeBIAA1arSj8RoTCCW
- TLSH T19345F17EE79C04E4D57BD2BC9A638906E67238AD032256CB05D081B91F6BEE46D3DF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 be6b9e60a5da91afc7afbc6ca69139346ed04cb95c7311606822128ecebb6936
- MD5 56e550e166decf3fcf00a77d9485bd30
- SHA1 daab7ff8fd17b9eb2de883cf233504433c8e99e4
- SHA512 b1e8e1614e958bc71926d58a2f05a949c565f220c4f63fc886ad8212045ba9069a539d074e9471333ba09d98348ac6406b89493798fe0a35077cf61ae49d6418
- SSDEEP 24576:AKJnJPbzB4SBaKngL2jdshRTdG1YxITqvfPkbIcbjLm:AKJnJv6SBarSj8RoTCCW
- TLSH T1E435F13DD29810E8E4B7C2B4815A1B5ABE71387D2F1669CB59B4D4343F12FE0A939F18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.1MB
- SHA256 6e9f6b201b62df4a7d3832bcee5c01d338f96fb61fcff8e8976df656432da112
- MD5 049d3536f47c2c381fb04748ff993f05
- SHA1 503a73515e0302a4a8424860fa01e1b2e970022f
- SHA512 31e9f0388b26d7674dc35ca29e369de317ad4df2f1f66b5f2abafc3470c00e0bfb498420fdeaa053b881a1cb0913e9faa88bec557c937a48b9cc5af5209c3836
- SSDEEP 24576:uCLHGL0MoeVtFumTijCmlKQWDk7aKngL2jdshRTdG1YxITqvfPkbIcbjLm:uCLHGeeV5ijCmlDWDk7arSj8RoTCCW
- TLSH T191A57C05E7EB4284E8F3CAF5CA2694169A327C549B34F7DF4E80C96A1E32BD1D538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 944KB
- SHA256 3ae5c6f956de0eea22234ee5fe15dc2fec8dcb293666cd17990ebcc5df51722a
- MD5 7dfad9025f6f2eafb907842b55486aa2
- SHA1 5b23423f2e25295d7468065d71c8a21929565c4f
- SHA512 67240c491ade43fda4239f986308ea0da87a372fda0c5520f911888012b4f21931f48e17229b39c868a8aba14309ebbdedba7f7d68dd12fb9b4a72fae4b70c8c
- SSDEEP 24576:66DIiaKngL2jdshRTdG1YxITqvfPkbIcbjLm:66DIiarSj8RoTCCW
- TLSH T1C525126D63AA01F4D06BE13D96934506E5B2B67483074ACF4AE4C5BD4EA3FD8B93CE40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 928KB
- SHA256 5418bdb980430e554c476f388bf0681c7b24f8f65dd0d0e3ca34c8f610be9eb9
- MD5 cda4c13920374ccbc860e99bdba3051a
- SHA1 63b0472bedbd312307b4b4ebc2b209bdd5b8f29f
- SHA512 5559a359b35e3af494de3ef662bed2a4c57e8f0df92d3338f9cf8d14d8294b1da5cfdb18b99288829c5eb39f51ee388f7fa05a77328dbc8f6510b805bb196363
- SSDEEP 24576:Rty2aKngL2jdshRTdG1YxITqvfPkbIcbjLm:RtNarSj8RoTCCW
- TLSH T1CC15231AD7C456D4E97A27786EB385886D727E249B0783CF89E0E63D2F367D06934B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 936KB
- SHA256 6014c58664396c1aa8f6c7a04b20d337e43094b959c5ba19035ec58fdb5ca4ea
- MD5 4ca9351f197a4c0e5099b6a535190137
- SHA1 f6f92932f8ae1da6dd890652861f0d5f7a9c71d2
- SHA512 549aa1d57fb8b578a8d21b727a6cda4b910341dddd5d65ab6e6dc6189ab1aa5e1f86472bc37af0da80132df80a93b34900dce5e50077726bc1045938abded57f
- SSDEEP 24576:a6UqjptaKngL2jdshRTdG1YxITqvfPkbIcbjLm:a6U8arSj8RoTCCW
- TLSH T18315236E97C419F4E03A1334AAB6C10918B27E3A035B86DF65E4967E4F36BD0953EF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 800KB
- SHA256 2c5be7c1775b5b7572dc4ca05ccb2502ee994aa568c66a22c3385397aa749f60
- MD5 34c83196960a088a35660cf1e1673ede
- SHA1 e60739056452d1f89d767d98488c718185ab29d9
- SHA512 3a5df9b4fb8d9a10632c9a6c709ea2cfdc24d6de7231085452ac736a64a79826246c12085f72e463ab4b77b89ba0d8965c3150fcdb585ad7a8f1dcca89fc3c7d
- SSDEEP 24576:qhaKngL2jdshRTdG1YxITqvfPkbIcbjLm:qharSj8RoTCCW
- TLSH T17505237EDBC45BA0D81A7B743AA6A98D38A3376C970B46CF8CE0597C5E7A7D0153C900
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 724b2709b1f3e776f7a9a062f003f9c8066729fb5b4f030f70712c1b182631de
- MD5 a1d5a80265f53eb2ba32249a2430514b
- SHA1 b0a0e2bdb623bbd00621f9ea70982a41498ccdad
- SHA512 d74f5bc0d6e7692ab4cea05e96e22738800abc01231659d2b0140ad604df826b9f660b264cff9b7071a16602e74ad9cc4a1ee2d571de990d8815a75b9007eacf
- SSDEEP 24576:wFghLoTfaidZ8aKngL2jdshRTdG1YxITqvfPkbIcbjLm:8gmTrZ8arSj8RoTCCW
- TLSH T1DE65AD1DA7EA06CAE2B2D675D8725483D633B4315772C6CF2448C03A4DABED8AE74F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 960KB
- SHA256 1b81edff25749e16202246cde85e74ea581f574157a6e9046bf7acc2f75591ff
- MD5 3cdcd8e04c844cc339138ba27c45925f
- SHA1 b1679b3ea1f5ebdb8a77b4f8d3c44ba5cccc5b40
- SHA512 bece3e19cfe658081ea3525428d7efadcfb221917af7cf8893451fc69f3deed685086e089db9d813204722358f28f8a6610ffbd1684b638afc07881438c6e296
- SSDEEP 24576:ArcmRfaKngL2jdshRTdG1YxITqvfPkbIcbjLm:CcmRfarSj8RoTCCW
- TLSH T18125015EB7AE00E5E1B7923C89828549FAB37534530257CF46E0877D4E6BAE97D38B00
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.2MB
- SHA256 ffeb637a2ef322a7b296c3be573dd772989edff502e71ec0b6f7f3e36cf96587
- MD5 8c68adefe69a9be38566f35ea177a6ab
- SHA1 ca70b372625e17ca6245b2b0b6f3ffdd4a2ce6c4
- SHA512 77d383afa21689fc3b898b6107307363cc837f0fff29cadb2e7e76a5c6f06949493a2ab5af41283d2f699e3e451f915baebba99d8f67e934fbc95e365f6dfd09
- SSDEEP 49152:lDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3yarSj8RoTCCW:m3Upow8sBXJTy
- TLSH T15EB59D3DA2E800A8D9AAC379C54213A6EA71782D3F3015DB0174C578BF1BEF19A39F55
- MD5 SHA1 SHA512 SSDEEP TLSH