2aa20eaf116ab854c439a64f4e22cf5199fd77d03e11f7fa1fe53b40bdb39d9f

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
Size 877KB
Sample260701-lbaszsav4m
SHA256 2aa20eaf116ab854c439a64f4e22cf5199fd77d03e11f7fa1fe53b40bdb39d9f
MD5 7b12a63447b90d6b7e6d7516c746329e
SHA1 e1fc6930c40e8619a9e4e7e277dbf987efee52fc
SHA512 129f6b977ef0014bd1b5e3fc90159ea866ffa1b66d826b4e39a6da6008440045d7ead33ef8348f1ca51e3cdac5e18b81e930411dc58b99c088a8e3dae8f0e9ba
SSDEEP 24576:1v/Hb/xc7zICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:R/HbKnATGBrMGWr7nTC8HPS
TLSH
T1F515E02173E08431F17769349A3ADA614D7FBC765972C18EA3943A1D1E32BC1CA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6084	alg.exe
5344	GameInputSvc.exe
3048	GameInputSvc.exe
1648	elevation_service.exe
2496	elevation_service.exe
4864	maintenanceservice.exe
6908	msdtc.exe
6764	OSE.EXE
1784	PerceptionSimulationService.exe
5928	perfhost.exe
6208	ReFsDedupSvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ca674ba3649edfd2.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_106562\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3048	GameInputSvc.exe
3048	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2960	2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
Token: SeTcbPrivilege	5344	GameInputSvc.exe
Token: SeBackupPrivilege	6208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6208	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6208	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6208	ReFsDedupSvc.exe
Token: SeDebugPrivilege	6084	alg.exe
Token: SeDebugPrivilege	6084	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5344 wrote to memory of 3048	5344	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7b12a63447b90d6b7e6d7516c746329e_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2496

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:6908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6764

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5928

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 87876541ded663ed497e1e6f54fe321310b7374e3d2501b2b8e6b44b568c44c5
MD5 1cf709eb31f6108f4b2fe6cc6305e459
SHA1 afaffe42b676e1c3fd8e5c3fa812ee5839a5f7c9
SHA512 ee2320dbf98b8d11a1bf62984f0d6f34e34b9bd8da76fdf053d5411e939155f52c53dcfb4bb90b1b1f00735f62df870ab2229b0c328e000429f0137f15ada47b
SSDEEP 49152:KoI632BuPkFKRrdE6oh7stBhuXjfS4LWxngATGBrMGWr7nTC8HPS:V3q6gjBQKtMbTC8HP
TLSH
T1F6D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 00513a56a74c979baa1816fe845bb291a01feea583753036ebe4c61faff761ea
MD5 aa11c3c2ea562779e79a6ad95288b1cf
SHA1 510eeeb2c94b541048eceebf05573efcb2eb288b
SHA512 15d4bf1712922add8379d693553a8d4a17b18ba8f363c3ec29160e98eb3600fefd758fb698c4da1815c932872e8dd1a1086441162ce5a8b6ee93ebafd60a5eb3
SSDEEP 24576:kXYN4uczAXICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:6ucGATGBrMGWr7nTC8HPS
TLSH
T14B050229A3D448F9ED5BD17CC8B18811EB33B85547A0E79B03A49A691F233C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e801d4b486ac8468f4adbf4b4347436bb4c5d3ef5776647933a01a8e2a29399f
MD5 5695201baa17aa289cc4cfb88504dfed
SHA1 ea74fc899f960ce2e90d22e3fe764c4bfdef1298
SHA512 c1f17a1792bb0cf3e246d6f8fbbcd69a442f2dce37df161901fbcd883d8011f9eb9032f4c9cac9010136eb7e2f623be2d1845e01d7aa02ea2b37c762ad309be2
SSDEEP 24576:X00eQCE0rbxOrMaICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:XDCE0fofATGBrMGWr7nTC8HPS
TLSH
T1D945AE16F6748735D073C0B9C5E2A68AED7130861B308ACB5286D77C3E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2a3f2df3b648d6f6ad0b85c99baeeb527e1441f015e6ee448d56ed624cf5624
MD5 128d56404f884ad0038b1376737a75bc
SHA1 d5f444f7948054fd84891660b74fc7bf67224e46
SHA512 c55db56167c4cefb196311bdb244b07a63b12ecbb6f958a61dac63ac0dbff0b70ae78cb1ba26d6e34b07c8e13d05528fefd8ba30dcb73d647317eb9add054033
SSDEEP 49152:KxezSC6vUzPvuHjyuATGBrMGWr7nTC8HPS:cezSC6v2XuH8KtMbTC8HP
TLSH
T1C6755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 db1db729a050e993d2cd215d616309be3618e0f4f7c026007edfbdf98fbabcb8
MD5 62144ee7444f22767209df29f23e32c8
SHA1 6d3f3fff003ce1b4be319eedb77ef5dc6276956b
SHA512 6734864e90a2febd0ab459a3e5f2b4838ad538a2b47f514779c3da5665568ffa5d79bc972170c762c1d1cfcb3056461a982fe46fbdea5c07139d134761008b6b
SSDEEP 24576:rabwPn6HW8/l+dYICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:raI6HWYl+mATGBrMGWr7nTC8HPS
TLSH
T1E9559D66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 3565ba2ec866cde12ba094c4c660b12d246afc9a6d99ec9af357cc6d89c59a79
MD5 3d731eba2c6e6246c018beb15a3a1966
SHA1 4c78fc2889ae9dfcad07d704121c54b40cef659e
SHA512 33b05c0efcc78f1df5af2d89771e0a61a940cd8409bbb3e0c068857b4d4c783f7af6c0608780bec44f205743a09b4ac10d97f7e28cad1b518151afff3f5bf306
SSDEEP 12288:AgE4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:AgzICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T185D42303C664D8B9FE0FF07C74759CC59E35AE9526E0C759B7142F9D083A2C4E2A92B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 d8be727d1f5672f0c533375d41c56cf4a2806ceefb4887cdf4c349ad57c14123
MD5 48320021d2495c28428fe7d8b3480450
SHA1 f0d5393dccf3073123a860dc6db0d48b5894c3b9
SHA512 961760f9d0a7a1b3ed01b3fa634c43cdeedddcb10225f35173b562c5e16801f2dbbb7659501e8f2f015950e777b2dade120a32094a2d075433265f48119ce9a0
SSDEEP 24576:bJIUDICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:bJIUDATGBrMGWr7nTC8HPS
TLSH
T1AD15C03BEE28FCE2C67E9C7856A18640DB7278704B6193CBE125834EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 8168b6f45ca350f6d008051101c299681bff6536e7705e641c7fac63c123a198
MD5 0805ff43bf823c47d562428416625231
SHA1 1e3c2ca747d6ed3ade3c232b16a2cf68cb76c3fa
SHA512 d184da33bc15e4bc5302a0630cf4c46a83aeba18c828b47b2f6e6b0b2d762e83660e8b2e443e6e5b77fdf636572dde808bc3fba66f0f2c9935ec0296053b0fec
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3TH/:VQvGAdlCEL8c/9RNw5CjKtMbTC8HP
TLSH
T11E367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0251CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 1e11eff92846c5427bf6e3680a0a3224a12545ba961f4946b2158b5542901c6d
MD5 2795e403f4a646fc82a84b98c9dc9fab
SHA1 35c69f3dba31b3772c3d2e2910c3ef6d620902c1
SHA512 2afb0630a558e2e1b76d967f40d560f7f76dd384c923a2ebebd81a1a52f467ef930458f235d1534d7a62bfcd94317533e21946b8a0fcb41be872c82a8c212af4
SSDEEP 24576:cmewsAj9ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:Xlj9ATGBrMGWr7nTC8HPS
TLSH
T1DE15E031FA74D436D67F0CB61B36C716583CBA600BA11AC3F3A84E9D59342D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dbf4a0c0f45d86a6cfcefaee5e98121d6cc33561c62743b1d443773815c09ffc
MD5 9e5d75eff196ca8a8e9c43065ca7cb95
SHA1 90060a85bad4a8ae035e8a09782d483b6719ad1a
SHA512 dcdd5ecd63453d68922b8ae73f2dbf9251fe21e6cb0e30b98df493b5501158b424fb0126f68e9102484c1e4b16d1cb352a0265badafea6d2508256cf5bb2bc59
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJH2KtMn:HUEtQevvqc2W1cpV2XF322uM
TLSH
T12C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b00ed4cc21fcb02e2b6017b4f0fb85f0eda4faff9b34dcf1b8350c3396c00806
MD5 ecaa561a033540c56ecda7c0354f6176
SHA1 1179f9d318396163eef1e189296975396f59fa28
SHA512 30c42d4c92800a6d541f63673ce3995c55fb83c58cf05ef1c9e81836c120143ee7fa2cf8a2eda76fafe847ac48ad89cae3c944e0038ae3c6699dc13aa528c8fb
SSDEEP 49152:RMbRquA/m2yL5zM6FiV+XenmE3/zYATGBrMGWr7nTC8HPS:woqgVjnmcKtMbTC8HP
TLSH
T17FD58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f720dbb3cc4b616011dee9ee2b48dbdc8f58fa329195fbafe3ddfc0e357fbba0
MD5 ff02ba35663f05166997c712f691df52
SHA1 eddcef4d264142451da6460bce7d27ede88ba6d4
SHA512 ba119d219e5e9824248a5a35e53a7913d024c05d8fe700b2b9149a538dc87e7740ba630a021c4dded16bc5e5aedbd2bd64ee01db8659827e99935129eced4709
SSDEEP 24576:RAhGLvPFoiwtA5l7S53FICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:RAMDFoiq5VATGBrMGWr7nTC8HPS
TLSH
T1CE45AE81E7F955D4F5B3AA7899B68571EA76BCA65E31C20F2210D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 830KB
SHA256 1c655a83389df66304bba2b040071416d9b4b95d3c7445237d501cc16df76c3f
MD5 38c7b865a56a5d8a873a7fd9c07c0c8e
SHA1 1383ddcacca79b0c647e134c062de78f450dc8c8
SHA512 38fb832115db013b8756297e78488373abc0f37bd2c1e7c2e874802a4385a210e02b76dddd2c20791b5f3aaaaaa676bd8d94a51d28b1cd42e6b75f2c0fce7f88
SSDEEP 24576:QwuuOWhICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:QwVOGATGBrMGWr7nTC8HPS
TLSH
T1B105F14676A44CF9E967913C8567C436FBB2B8022A21C71F1720CB5B5F373A1AE2D760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 67356d6ec6ad21bcf962263e3ba4726a36f9dbc9cc72731c9b1e97499c8b1290
MD5 1ba82e2b5cafd19d42d7eaf0f628a27d
SHA1 26a0c4162034961a361a217c7220d3e671cfebc0
SHA512 5e620d3c80c7017061dba016420f1a9c3513b077d3c471ad5e8986dc14174386b623396d75e56757e4780be1e0cf075e8c9a84f8e09d19245efeb1693859c5ee
SSDEEP 12288:n+O1IrT4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYbs:+Ou4ICgpB5GBrMVyJWrwgh5AQorrYWbF
TLSH
T1B1E4124A62A4A4F9F55BA07C98F14945DF32B496277183CF27240BAD1F23BC16E39372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2a49a634f355fe6b3550cce614e9c8a5527b0bacafd4a574d0459593824f4b14
MD5 3e0a3310ad976940e9bb6d63529a1e11
SHA1 387a12e453ea0c007713130c9e31849c0d00b9bc
SHA512 fa1d0f5af357ab6edd693dcab54e3ec4b96fe22f4cb8b45b9ca47b08e64e656f02e5e0c5eebcca0828b05c052906e6639d3935a6c03fcd2c0ecac5cf87b828ec
SSDEEP 98304:yQRQyi36YOcP8Lvw2gAf+PN3FKtMbTC8HP:pQyiKa+X+PN1KtMn
TLSH
T1A3666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0f466320372cfed9922b7f5542680deaf449232f2270f72dd6f92a8e1c390821
MD5 892f4336226b2cf063803f36ccc6b087
SHA1 0d80eb94bc115d3c3643d76ba3d855bcb8473b8b
SHA512 6bf6930fcc1e01f6594761ce6d319fc527376c9da545dfcd93f5647ea566a44a58d42c0785ab33e22e3045cb1370a83877bbdd6b5323976cb14bca4d8553db1f
SSDEEP 98304:yQRQyi36YOcP8Lvw2gAf+PN3hKtMbTC8HP:pQyiKa+X+PNRKtMn
TLSH
T14F666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0aa6581c78b81d3d78211d71e5569bbbdfa59abd2c3a5fc636ad41a8448d08a9
MD5 54d154487a61f3aac90e6b79a1fd84dc
SHA1 759528223d9b6820b1f3a3676528af301ffd886b
SHA512 4021256b4aafd3a1defe9c2ddc8ca14dd4e180c8b56996c03511713502576d47007a9b4ebed2054b8441596236ef202d59d8cc401cdd8ee14b1e29ccd7ea7876
SSDEEP 49152:368Qg55nhMeWu7PNU3/vATGBrMGWr7nTC8HPS:hthbRc/4KtMbTC8HP
TLSH
T1C2B55A33B2F200A9D44DE1769F46872196E17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 faf610743275b198f278056470cc10752534cdc03668716d8776775b6278fd8c
MD5 fd3a22b0eb34b3f23529e9d92116a949
SHA1 91e9433126a155b9efbca78e201c6da1ad3612d9
SHA512 b41266fee204fe3a571cd80d9c296bac717a10b9d07789084d3a04c2200bf64ab61038f85eb9ff108738f3beed260712b14e1c7690b3d7b5d3cad921ff6686be
SSDEEP 98304:By5112gYy5azzVv569nLKnhZhKtMbTC8HP:cLIHAWhfKtMn
TLSH
T15D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d4590c6eb2fb153103acae7b6b749850ef1b123db5b5f4d61fccb806665957d6
MD5 5b11d1dc1f5858a7b24ca4ec78d7a164
SHA1 be0b22e10f8c3ba643c1d8f129994989cb6324e0
SHA512 7d57cd896815be049c7f7a69916fb2361573b4fb460a07a1bbf1cfb25970a8e307a97d16e719b766a555a8da1ccfd22010c7288e872563e7d55567abe98847e3
SSDEEP 49152:Os+taZ3usBWOBr4tEGp0bqx0z+n217aau1glJATGBrMGWr7nTC8HPS:Vu6JmTxd2dKKtMbTC8HP
TLSH
T1BCD59D13F1DA01E8D05ED478974A9233EA62BC490B34B6EF0A9077562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 91651acc33e25b219c6d8ddbc89bacfe677b0d57e487f4340a7c2fb196044cae
MD5 835605be6dfb1b278efccef05a41de30
SHA1 e66232bce22ee90f4322014f907a169391128100
SHA512 2cd2d8b7da2f52d42eb0a31804c94fb034f37945ac7a4a8195a9e62ccd50ac23ad4ae3df4ac77801f55b3d636ca42bfea32da20e1db84f140c2a73667f8d9f10
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xfATGBrMGWr7nTC8HPS:smifPbRDKtMbTC8HP
TLSH
T113B5BE13F29940E8D05ED17887569632EA72BC460B30B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0b984c6be0ea8ab273b0c6ee37a522412e5bb75d10efe2da5c3ea46f430c7ee0
MD5 2eaf28e7f41b9cef18a4686f10db00f1
SHA1 7ed7e514243cda0e0859b84247644c6b8a5d9eac
SHA512 81c63312c19a3d7c6c342ae02c10a68aa24511361249e6a1893a7bffcc084066d8ea58d8bf772faf6231e63e9ec7cef9b852776253e941144f3c677636f581a0
SSDEEP 49152:nSuZQIY0Be2K6RVtOnks6NMHqKATGBrMGWr7nTC8HPS:95dKoi61vKtMbTC8HP
TLSH
T1ACC5AE03F2E940E8E0BED57887669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 602f095428e0bc3a3d2e7d9db9b746ad1ea3f35b06871b2db803019b865eb433
MD5 3abb7da8d99de47c9f6f9671c4fe54ac
SHA1 54309266b3dcd497840b63a80a62aa1dc4c8ca71
SHA512 36443ce94ecae0df78fb653a2be416df001410d510364ba2f9df5232d0141e7a33bcf781ee57beea338f333414abecde702d86c6b0a7bb486f0ddd29048160e3
SSDEEP 49152:xcDSn8EApI0figTgiDn0AP5w6ATGBrMGWr7nTC8HPS:FX2iyphIKtMbTC8HP
TLSH
T12CA5BE13F2D940E8D05ED078C7568632EA72BC160B35AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 f5fed3b3bbbbd38c61e9adff14e507288e521d9191058de362ba9d385f033de6
MD5 45f4de7b9e920c54ce2192ae7b644bc9
SHA1 d1bf8eadb69f7591b6425c3c8472997447b7755e
SHA512 9435ea0a8778b3dc0c8055468392692b521abd65c187e936d144e592a8afdcd5f2f9657818570ac3876921b0c54ca217d0f4cea723f5574157dad09d8ad3eb8f
SSDEEP 12288:LB4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:LOICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1AFD42306C9A5CCBDF90EE07C64719CC5DE39BA9A37E0C359B7081E9D092A7C462592F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 34e573edcf540c8c940312d771c4c5d451a5f4a23be5beab0520266333c259be
MD5 c24e58f651eb473b87ebdd084447b827
SHA1 80d8d384aa884b67195e1d73f9c0355827077eb1
SHA512 1ea52cf4376a16a58ff90ead619b90c79667d9c1c8233ef6114adedcecab9e8b9ac1bf7fd8825c324b2e30454cca00805cc6b11451467f9bdf9ed20224aa3656
SSDEEP 12288:VT/4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:V8ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1E2D42306C965CCBDF90EF07CA1719CC5DE38AA9A37E0C399B7081E9D192A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 cfca9a8c165b2cdf67690610c8e8d4ad2a3d2708db3f35a74ee650e23b0dbc62
MD5 3e224cc501da7a8582455c40af0bd064
SHA1 039e4c819a096ac3d6598a1ef92f663113e62128
SHA512 9cb0b0be96981b5b785e1f904d3360afd79ae8816efec9e96983ab4f2b83bae01135a872dba4832f7d27c08ba0e2af691a83d14e1a85177247eff98ce9632924
SSDEEP 12288:TO/4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:TFICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T165D42306C965C8BDF90EF47CA1718CC5DE38AA9A37E0C399B7081E9D192A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 2512dc9412c384bac40ee16287bd7921754f9f00508afffcc76985a5924a4ff6
MD5 183f19f88be50fdc0af30116ee85eb59
SHA1 b58c4ed130d65f9e9b581f01d32ec480a52788a0
SHA512 c67d4ea84fa30fffd5c3aa087cc5b91212191da3fef3dab70a9b03114aac691e335f3663a3f8f213e0dfc436a6e756db21ff5cd0cb245a19352029b0adf9a4f7
SSDEEP 12288:Dl34ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:aICgpB5GBrMVyJWrwgh5AQorrYWbJ6Hq
TLSH
T168D4220696A5C8E9FC0BE07C94718885EF35B99637B1D39FB7000E9D0E367C4A6687B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 603b3c6279211fb348ea395741582e82eacadfad5043daeda67829cff3345a6e
MD5 6ff1b86df00f34e65abe7eedcd52af5b
SHA1 b9228e97bc4d9842fa2484f72514c625305be932
SHA512 6906e17aeb399010c5d9da37528ce816df800075d23257499131f258edff9675b56d491e838898369371ba10ce5fff614c8ad66b655e29e1b1be96ed2f46be0f
SSDEEP 12288:id4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:iKICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T17CD42306D565CCBDF90EE07CA0718CC5DE39AA9A37E0C399B7081E9D192A7C4635D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 c7af9726701da58c1e8d6af66db59ebc6ffd7ca248b308e297078631b35cc3ce
MD5 7f0b7de2bf2eb70d4f4a483dc6ecfb78
SHA1 c5f163476e446b96eb31a177290ee5fe7f95b420
SHA512 2f51d1f10170f1d140a1ba1b404eb4daf69efa43f9ff30653fa9a999d769d041218518f7503776daa8abe435bde957d69f8689a1c9c1e5918aad808424f20f4f
SSDEEP 12288:x24ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:xpICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T14DD42306D565CCADF90EF07CA0719CC5DE38BA9A37A0C369B7081E9D1A2A7C4635D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 23e0b5a386d617976460a0120dfc6ea78648356babb77681b755efbff61a3166
MD5 6dd6cf716d73945916225b59a3a763bb
SHA1 87b0c700aeeebde6dabd6ed68cc253f9bc27ae94
SHA512 50ad9ae1d6ad0291c85483ad09f0b60a71a513d499a76e5aaff48bf3e7d4fda974d27e31f4bf126c7b82509d85fbd9340e0c87ca4056129a940b8b860d49351f
SSDEEP 12288:Et4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:E6ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1C7D42306C565CCADF90EE07CA1719CC5DE38BA9A37E0C359B7081E9D1A2A7C4635D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 e710ca2069ef40cd91a7613510dea6f5151d26eeea4cf16dbbf2fbb166ca6702
MD5 8308fd853c9291d9215e4a74eb4ae232
SHA1 731f58d5626f6bb1b7e9ceae242554aab2d56f57
SHA512 72d858b34f80696f307c1cc4d5a867c1e85c91bd699a3437117c43297cdb4662fddd4a714b3e0b4584c32288fc706547a3c950835052536fc82d0226f0c84ed4
SSDEEP 24576:RZM3zFVSXEICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:RZM3zfDATGBrMGWr7nTC8HPS
TLSH
T10A150255B3905CF8EC67813DC8258D46DAB2BC5A17B0C71F13A43A6A1F333911D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 70f7e45220283529b2876e884f92820234c324c0483ae4eafd2670adbfb788b1
MD5 496a3e3f40083f52f479d1e70af6b9bb
SHA1 ed11ec5f2a7b7cf91d4593af3d400bfc5a82eeed
SHA512 22831b0e4248b47b3536d28b5784764abec6104a50bfe1a08f5bbe77c03c7a86ad1a2e444495b778e815a4b7b1cf5bff85223e9d831dff07ebcc8d0cfd3958a2
SSDEEP 12288:/y4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:/VICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1C9D42306C565CCBDF90EE47CA0719CC5DE38BA9A37E0C399B7081E9D1A2A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 3d154faf9a58b70739f9e6fa6c67ff61c513159f0eea84a6c8fe2544da8960ca
MD5 1dbe0f97e2d94e0fc26f4fc395df9af9
SHA1 ae01d7d242717389bf57873f0235c6cabe9b3e44
SHA512 cb2db9eb4138fbbe522fd2917cb3b8876b4fd984bcfd700f96b8a87e87c2a4217212e539820e241dfe3b3a3f67626ed30d3dfc301a8d6fc59d313961fa3e2df5
SSDEEP 12288:FP4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:FgICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T143D42307D565CCADF90EE07CA1718CC5DE38BA9A37A0C399B7081E9D1A2A7C4635D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 fac0fba903187047e31f16777bfa8466657d69a6d72ea02dbc4aebc701a2f3bf
MD5 9bf71c0978fbb08fca4f2a1dd52ac1f0
SHA1 d5f763237e1e5d9c24cbf19fd75518dfaf7d15cb
SHA512 3720f02ffac8a0cd28d96c43523b9a25726dad49518ec17afdde6b46fd530fb5be7082260974065e7e41b61a22ea90758e3c7ffc41f2545524403798ca8cfa8d
SSDEEP 12288:stPz5LBr4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYY:OzvsICgpB5GBrMVyJWrwgh5AQorrYWbF
TLSH
T1FEF40207A2A160F9E52BD13888721D41FB35B8761760CBAF67240B7A1E277D09E3E771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 372d9bb4f7228232dd5338e95f91273c45f56f0063285717867a07a60e21794e
MD5 7dfff3e3a1f9a1f31a268c90a98ea442
SHA1 9382678827fd378b267617015445b1ffb269387f
SHA512 e862d6e0a8ff6bfb5615673b7ee4ed15c395e1def1f923ea0fba31085ed12eef82df1f51d8d02a4527cbcca9c334477009b51401f1ee81701a83493a90704e48
SSDEEP 12288:HY4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:H3ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1B2D42307D565CCADF90EE07CA0719CC5DE38BA9A37E0C399B7081E9D192A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 03f8ba64b9ee0467dd66638fcf8b80091017593edfcdf4201de261f4126fd5db
MD5 ffa26f4925d4cbbaab0fdbcb731dae71
SHA1 6d0bbe285694c26a9b5300a9b88672054343e46f
SHA512 7a0ec52d50f5865356f5417eb905cec8109924e1e881e7d144493b9bad7ad09e5e2af1abba920f724454cc73714222734202bd34dc9a983c46acacd89d38684f
SSDEEP 12288:HS4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:H1ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T191D42306D965CCBDF90EE07CA0719CC5DE38BA9A37A0C399B7081E9D192A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 3b6cb90c2d2b045285c0a6236231c81732a5fbf4cc96bcac3d0ebd544bda6236
MD5 0ef2b3eea807d09d9472f87ac52f22f0
SHA1 70381bbaaaa86376d7077fd603485daec58fc032
SHA512 f33dbe2f6d070bbcee4df1c10cd13a2289c512932be3513681c416a55f784c15887a3a8449dee2b9d1f056ac019f0786bad80ffda102b2baf450563407433548
SSDEEP 12288:ptPz5LBZ4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYY:TzvmICgpB5GBrMVyJWrwgh5AQorrYWbF
TLSH
T1CCF40207A2A160F9E52BD13888721D41FB35B8761760CBAF67240B7A1E277D09E3E771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 207b129524805488751c612e859fd284e321ec1600903ccdc4b1344d3d4ee826
MD5 9e08ae870e3d98720b916d85a7f620f9
SHA1 0af037f8112040f3045f365d8529009274e55f0f
SHA512 c528a785b33181dfed19b415c3d201f3944ffb1993ca85e4e83105d551476eff410b811069ad2fedbda650403f5f9f0f051c2668d0619e7c13c3c453cd03be58
SSDEEP 24576:sT9aLl3z0zVXICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:sTQLljsATGBrMGWr7nTC8HPS
TLSH
T145150195B3505CF8EC67813EC8658946DAB2BC5A07B0C71F13A43A6B5F333901D2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 470a715e11de3fcff7d655b616fc1a4a121d989f333ebef250f95423079404e0
MD5 ac2490ce5f0b79a72d4f558dd3c0b27d
SHA1 ae915590632e4ef6b91b100eb0b2a724141c2293
SHA512 18a48d4f9d7486349bc2a590b5a003cd880e4d4efc86ce835831c236a6144476b15060ddb2e6cd5d7149f80df02e357640fb9354d570147047a49219f5ee6af0
SSDEEP 24576:+3Ud0CHKy7wyqICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:AUd0CHKy8xATGBrMGWr7nTC8HPS
TLSH
T19E35CF90F3E414E8F0B7DA3989764511DA767C9A1B70CA8F13A4265A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 78a7d686c9392545bead67a94451cb7e5a1c1fe99096e5526a445fe70c6871cb
MD5 221a02a9c795c51b1881fe1a59533b04
SHA1 0ad615281629336b12b15fc8eb6887ad802f9f20
SHA512 a8fa6faae1ba66bb0eca0d578dc3928245029b1d2b6c6aa0255f8a5ca4ff09be9514611e8cbd5317c84195ca7d6d380aabf525edae2ad3937f3baf285afb6708
SSDEEP 12288:F14ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:FiICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T11DD42306C565CCBDF90EF07CA0719CC5DE39BA9A36E0C399B7081E9D192A7C4A25D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 8ca71ba02379fb59028f77ee97ee6d947d710320f55be1ea1bcb666acc52c014
MD5 2163142c00fa1fb22769eb0de15dcd79
SHA1 8ef507f7e73707ceb693fd03e10e661e48d3e502
SHA512 f96b484ece64497881f306dae59c7a1724286c06ba4801cfca78b0709f60b6a26cd59f40c2658d73a194df79d593a463a2683eebc9604c80df899b01f8fd7dc7
SSDEEP 12288:rm4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:r5ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T110D42306C965CCBDFD0EF0BC60759CC59E38BA9A36E0C399B7041E9D192A7C4A25D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 98c6e30ffc75ec8d5577a554837ca51f12eb77df3474f5360946e0bed5b08f3d
MD5 f12909b6a28c6d4fe26990f09f00d1ba
SHA1 85ffd1c5f8f5587a5cd74eb3f956b437e19e69ea
SHA512 ada25a13c4b9c7a2b9264a2387651ca56b00fa5aa4dc23a3528331a5a1de657ba2909b9f589edae70694159eae30eb344fc9eab8a8e1f10fdd09305fac84e780
SSDEEP 12288:OkSZ4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:OkZICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T108D42306C565CCADF90EE07CA1718CC5DE39BA9A37E0C39AB7081E9D192A7C4635D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 1d6d0e609609a09096d82af996d16226149e60e30abc61f59fa287dda566d04c
MD5 15f3d8262c8404e59ece45fd79ee2774
SHA1 24c81370b77f1c4c90329637982f3766789b25ff
SHA512 0ce4062611ba4c1a6a1ecf4f225be3677ce6f938ce0ec75335ed95bcecfe88b385c965586c03101446435580acae63234ec7be46b365318def7973a8558e30b6
SSDEEP 12288:Fv4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:FAICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T116D42306D565CCBDF90EE07C61718CC5DE38AA9A37E0C399B7081E9D1A2A7C4A35D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 afe8f115aab0ec866195dcfab113d2dbeb36bff4f5f43950705ba526fe550d61
MD5 ffabf03475b5edc2a2cc00dc80510796
SHA1 0c60e92f9fd086991dd556b5fffdda07b12e6b49
SHA512 cb4b15370ab768158a4a94386c31fecbe78ca88ced725b2b9340e7372082e75b7de654a13d0c3cb1fb86d3e03ad4321f2b86cc6356bf2a61ac26776c1b70e528
SSDEEP 12288:Dy4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:DVICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T189D42306D565CCADF90EF07C60719CC5DE38AA9A37E0C399B7081E9D1A2A7C4635D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 5053a52fd472bd4225f87b7d44264505d7a2934c5770c2012691141dacc36289
MD5 0b710526bb7b9323cbc7192ac47e9530
SHA1 a2c3b83ae8bcb6987769dff2a3ce57ced395b03d
SHA512 93a79b1f9f776c4b7ab076871a3966d5f3120b2eed551d593c3245420a01b734937629cbc9135f49dbf8445c308a27ab6317adbd09fd342369d26521b9b6000d
SSDEEP 12288:AO4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:ABICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T115D42306D565CCBDF90EE0BC61718CC1DE38AA9A37E1C399B7041F9D1A2A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 1df41a3c21d8caff10c0b05a35b2e6e231247cafe7d157b0d6ed95c69813e811
MD5 7222022b80bf678c8b1e4c5070b21c56
SHA1 ea98608697feada4205bd01d9c52c3e4b88afa7d
SHA512 158dda4e0e841005fa477b490ced9683588b1811cb16c567ee8fd4a0fd63cda508ee49b5af1112f7a15ac5b103ac10d68046e61acc104c9eb87416fc6f69f393
SSDEEP 12288:XD4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:XEICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T10AD42306D565CCBDF90EE07CA0718CC5DE39AA9A37E0C399B7081E9D192A7C4629D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 00a8cddf208a17ef0d2cfbaef35f1b1bca3a61b2ecf0e6376e16a0bde92fb94d
MD5 d97c6a837a4a2db21a5e62c0dfa9a3ce
SHA1 61cc0ef618d0c2112b5c73293fe037cf08b3a7e8
SHA512 8e1c5bbc0363e04f61d468a856fd6d02f95ec18e3042d24e1550ffa65dbc9e5b9cb5251fadcb6e756d8f638f9e5688cbbfaf3f28109caf0189f199e18c0f4ad9
SSDEEP 12288:Gc4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:GrICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T142D42306C965CCADFD0EE0BC61718CC1DE38BA9A37E1C399B7041E9D1A2A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 de39dd4afa54f7c2b1ba73efec55f7965e057a444e6838aa50f07a147ca50129
MD5 65544aa1e4caab6c281f7bc195e74cfb
SHA1 0b6387e36f75545e7891b8695ae60ed0f2503c92
SHA512 d9fb4041d4ec251cbf54df8072f4b4d7bb7945be1e51543651a7f32df297ef3b7c501acbca0f4b637ddd777cd82ea30322758d920debe12580abf8aac73f7b26
SSDEEP 12288:6m4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:65ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T1F9D42306C965CCBDF90EF07C61718CC59E39BA9A37E0C399B7081E9D192A7C4625D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 602KB
SHA256 e4ab781fcfd2e65ad04dc0e883db80e43f950ee4498aa3eaa151819c26f964aa
MD5 9588bc228c56036b94cac4fecc3d5712
SHA1 5b3d182b1f670b99e2354e4c9187144d5daaf683
SHA512 d9ecb2745d48e0ca4e153a3eb4769d5edc4c9d0730647649448be6f1f65e06c5e2e8d84ead8edce8c412e6374c307746371f32f92d305829a70f02a29291b9b2
SSDEEP 12288:wiD4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:wXICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T162D42306D565CCBDF90EE07CA0718CC5DE39BA9A37E0C359B7081E9D1A2A7C4625D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 602KB
SHA256 5ba2f40063d3c8ba46a8e0bb1f1c01332c6921e6605b5a7d893e08e047077287
MD5 2b5b1942c5ae0eaaf5fe495ce453912e
SHA1 c547931e709cfdb26ce9ae10ca28bcbdcabe03cc
SHA512 59b8a97e2137a85a8880ab59c4d505385e0f4be4cd972204c900a1fe52e23217f2657f9f9061dd2400f950b5009c8272a6e0dbd226ff6bc9d12e5559807faedc
SSDEEP 12288:iK4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:itICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T17ED42306C565CCBDF90EF07CA1719CC5DE38BA9A36E0C399B7081E9D1A2A7C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 602KB
SHA256 eee8710cb495c7ade87348dccc103b7bda7aefca945b55c21af76c8a8d973f14
MD5 c5c0b2203a4c9244c67b310e27d8ecea
SHA1 7add18c26cfe9c4c1147312833deb5b125af08cb
SHA512 98fb99d666026c0ca843111b518edee2d4e51944469ca44f9fa41016d7be734e65927a0a3b4238a6ceaef3cda39a38de17780e7d789b1e9527b9441852b3e888
SSDEEP 12288:7F4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:7SICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T138D42306C565CCBDF90EF07CA1718CC1DE38BA9A36E0D399B7181E9D19267C4625D1F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 602KB
SHA256 5200834d9cfd4b297cf00889ea65f42c7db6de3825caf302bac3394afe193e15
MD5 e039d6e7180db0804544b9b0b7b43449
SHA1 1a1586d610a9babb8bf6256cd11b11e84257ff27
SHA512 fc7ffa4fe5dbe393847c8eb14ece9765e707c10c6027264bd3755d64996ce332133e4477a48ac8960bbbc0fc808e4b9355c28e1862bc97382b8dd8761e2e57e1
SSDEEP 12288:864ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:89ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T179D42306D565CCBDF90EE07C60718CC5DE39AA9A37E0C359B7081E9D1A2A7C4A35D2F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 21dc62895d6431315c064be9ded886187e3a9a8ef953082e89829084226a5556
MD5 981c6ad9b42db4f5b1aef57d18366365
SHA1 61122c702678fe77883a25e409d92d426e1efb7f
SHA512 85d14d53fb25ff0de1ab6cf2d79cb5282c0017f51bb4bf346d879f3084e0b80ad31d7f63802bee30d11a31ac339df4cf5b9b97ca9c7573bac092133c4cb1fc6c
SSDEEP 12288:PPDfS4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:z1ICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T14BF4F10AD29481E8D45EA079C7624981FB337C6557E1D3CA63C0F97E0F36680AEE9753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 c623e698536207ed38590ac150c252bb4a4a9629bb6647635b26ced03969acd1
MD5 d214c293228c95ea5df0c9f34ef1b98b
SHA1 d86c06880d0a87e7fd5e372425a222836bdd542c
SHA512 72a92e28c5a0b573eb29ddc8d1b77c3eb988fe1191d88cfaf734665831edd47a3acf9e9f971fa85293b2b8af7d22211e2c4aa497024c55c05a36d57b2308f716
SSDEEP 12288:Rl7I4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:nHICgpB5GBrMVyJWrwgh5AQorrYWbJ6K
TLSH
T141D42303C658CC69FD1EF07C60758C51AE39BA952BA0C3DBF7041F9D18367C4AB696A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 52663bb50c3461d23fc2c41fa00fb7fea52629a7414d15d665d17be04e9c38f5
MD5 5782f62594ea2e1698fa2bb26dfb0950
SHA1 5b22e5fe375a4253477e0c757fcdad7e887b0ae3
SHA512 a6c7317fa4c27de8ff740059476a28f952797f49a5aa4c87844d32d8a0a9a7050bcfe205a758cd8151528d4eedd49df9f6e0f0b3d7b52cf30346cd549f34163f
SSDEEP 12288:s6Gi4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb3qB:DGlICgpB5GBrMVyJWrwgh5AQorrYWbJb
TLSH
T1F4E4221EA1B5E8ACE93EE07C54718892BD3075A0276093FF66106EBD4F266D0733DDA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 6eb0d822377cfa069f3b40254497bc733ac0e44f1f66fa77a28f64c4f910f5a1
MD5 6664194a496b182d8891e9af956afb05
SHA1 fe139aeac31897ef0c6b897dabb280db4bb4567f
SHA512 ce1ce6e02330e9823af5eb662225b6ed1dc65abd860db62b2db1c7c44f3ed7e58e1f685b3726c0eb89fdbbc52e9a3abf725fd24d3761444a3aed53f05b86d0e2
SSDEEP 24576:hPUr+NQ+ICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:hJQ+ATGBrMGWr7nTC8HPS
TLSH
T17105E11F62A81CE9F67AE17C85928609FB71B4621751D2CF0290817E4F27ED8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 36f8711bdf655b1b51c52f9ae082517bf784e852ea60cc88a124bedbda8eb0d1
MD5 fb3fbbd8103c1f306bd490a687e8cf59
SHA1 9282ae9daf9a88a4105201a7a8f92991f8ea77e3
SHA512 b29665ea8ca0114c12a14e367d9600acce58ac3d76c167dedf80d825bf3905efda80f2a1207263db8c8b514ae26b58320f4c0542f3263b326a73a99984a3234b
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVATGBrMGWr7nTC8Hq:dG05lO43blKtMbTC8HP
TLSH
T1D2D5CF6A62EC11F9D1BBD07CD9C64A0BEBB23415033556CF02A486A91F27FF4967E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 1ec3350f374244e26b24ac382e007701378a5a581dd7b774c7253e13b27c1814
MD5 55d86a4f7f1a025ba11fa84f276c75c9
SHA1 e218d4f1a62a6ccc4c3c4816948ce0d73d5a643d
SHA512 ad048b76d64a9a5e4f05de96c6a81d4711b66f108f81da17d74c9f82bdeb25274c02c8e783caafdd8217a52653ca46b2b881b698de177c0637fde1f42b86d109
SSDEEP 24576:m6DIwUICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:m6DIwUATGBrMGWr7nTC8HPS
TLSH
T1B805020D637A50F9E06BE03DC1A30441DA72B0B1976296DF579489BD4FA3EC8B93CE91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 ce6a51b81c307c91491ca83f4ba2ea4bd57690562be8be09302ce929c9973cd2
MD5 c57bc7e56d4e18fd82ca78aa25df3fb2
SHA1 78e1a39bb3e521e7160918881c200e6073289909
SHA512 448f350ffe33439179c59b622a640dd8ba86eb12a0ba89577ca6b8302e6a5fadfc2d88f4e202a340c8fa7f25e214722702047b3193777246b7a808732fa70f94
SSDEEP 12288:bG6kyY4ICuXUXIJBAXePGBrMl8OyZD3Wrwg40AQoDmAQlyrrCjpWYsJ63XPIYb38:aty3ICgpB5GBrMVyJWrwgh5AQorrYWbF
TLSH
T163F412059394E4E8F96E903C997285909F35BC202B60D3DF6650AF7E1F367C4BA34B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 643f6095ab99e5fc537816d18cccf9ac6d9c188364e87e484b3b418f78eb17bb
MD5 aad732c44d385cc9008a73fa2575b186
SHA1 547c62e4bae4bba8aa5a3e9a4b13c882e9fc2f8c
SHA512 e83a4f3059cc8bb040ff2846d0e902a3bede29a31b362efe7449e961174a2aa426c43611f3d97cdfbdb16c59cb07d7ce4e081842d54023aebd842e6ebae052e1
SSDEEP 24576:QTkNvNnaFeYhJNtmZBmfICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:QTMwBtOmfATGBrMGWr7nTC8HPS
TLSH
T1FA55AF2EBAB845E4E1FEC5B4DD238512EA727461173293CB5390C13E0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 f841dd4b336e0bd35160fd789a91996812adad1d182c335e1aebb4ff9f1532f4
MD5 612faf1240ef782810f08f240dc403d2
SHA1 5efa67f4a85dafbba066376d7b3be5cda88dc497
SHA512 63644771297659af39804c92542edea0c059ea2e7fe794a56df002410104bdae0c739d743ed0cd97f3aec8878f2b8d5824a4360bbbaa42cc15924cacdbe55db1
SSDEEP 24576:C6UqjplICgpB5GBrMVyJWrwgh5AQorrYWbJ6HPt6B:C6UkATGBrMGWr7nTC8HPS
TLSH
T159F4120E9294D8F9F43AD038E47184658935BC7227B196EF72845A7E4F36BC0963EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1648-48-0x0000024517470000-0x00000245174D6000-memory.dmp

Download

memory/1648-47-0x0000024517470000-0x00000245174D6000-memory.dmp

Download

memory/1648-46-0x00000245171F0000-0x0000024517344000-memory.dmp

Download

memory/1784-140-0x00007FF720200000-0x00007FF72034A000-memory.dmp

Download

memory/1784-99-0x0000026134F20000-0x0000026134F86000-memory.dmp

Download

memory/1784-98-0x0000026134F20000-0x0000026134F86000-memory.dmp

Download

memory/1784-97-0x00007FF720200000-0x00007FF72034A000-memory.dmp

Download

memory/2496-56-0x0000022711D60000-0x0000022711DC6000-memory.dmp

Download

memory/2496-55-0x0000022711D60000-0x0000022711DC6000-memory.dmp

Download

memory/2496-54-0x0000022711AE0000-0x0000022711C34000-memory.dmp

Download

memory/2960-38-0x0000000000E20000-0x00000000010CD000-memory.dmp

Download

memory/2960-43-0x0000000000F14000-0x0000000000F15000-memory.dmp

Download

memory/2960-120-0x0000000000E20000-0x00000000010CD000-memory.dmp

Download

memory/2960-0-0x0000000003040000-0x00000000030A9000-memory.dmp

Download

memory/2960-7-0x0000000003040000-0x00000000030A9000-memory.dmp

Download

memory/2960-6-0x0000000003040000-0x00000000030A9000-memory.dmp

Download

memory/2960-5-0x0000000000E20000-0x00000000010CD000-memory.dmp

Download

memory/3048-35-0x00007FF753AC0000-0x00007FF753B89000-memory.dmp

Download

memory/3048-36-0x000002E77B820000-0x000002E77B886000-memory.dmp

Download

memory/3048-39-0x000002E77B820000-0x000002E77B886000-memory.dmp

Download

memory/3048-115-0x00007FF753AC0000-0x00007FF753B89000-memory.dmp

Download

memory/4864-64-0x000002BD351C0000-0x000002BD35226000-memory.dmp

Download

memory/4864-73-0x00007FF66F280000-0x00007FF66F3E8000-memory.dmp

Download

memory/4864-70-0x000002BD351C0000-0x000002BD35226000-memory.dmp

Download

memory/4864-65-0x000002BD351C0000-0x000002BD35226000-memory.dmp

Download

memory/4864-63-0x00007FF66F280000-0x00007FF66F3E8000-memory.dmp

Download

memory/5344-29-0x00000219F58D0000-0x00000219F5936000-memory.dmp

Download

memory/5344-95-0x00007FF753AC0000-0x00007FF753B89000-memory.dmp

Download

memory/5344-26-0x00007FF753AC0000-0x00007FF753B89000-memory.dmp

Download

memory/5344-27-0x00000219F58D0000-0x00000219F5936000-memory.dmp

Download

memory/5928-111-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/5928-106-0x00000000009D0000-0x0000000000A39000-memory.dmp

Download

memory/5928-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5928-141-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/6084-17-0x0000022CC6720000-0x0000022CC6786000-memory.dmp

Download

memory/6084-18-0x0000022CC6720000-0x0000022CC6786000-memory.dmp

Download

memory/6084-62-0x00007FF62C420000-0x00007FF62C543000-memory.dmp

Download

memory/6084-16-0x0000022CC6720000-0x0000022CC6786000-memory.dmp

Download

memory/6084-15-0x00007FF62C420000-0x00007FF62C543000-memory.dmp

Download

memory/6208-125-0x000001843AAA0000-0x000001843AB06000-memory.dmp

Download

memory/6208-247-0x00007FF7037D0000-0x00007FF703F14000-memory.dmp

Download

memory/6208-126-0x00007FF7037D0000-0x00007FF703F14000-memory.dmp

Download

memory/6208-127-0x000001843AAA0000-0x000001843AB06000-memory.dmp

Download

memory/6208-142-0x00007FF7037D0000-0x00007FF703F14000-memory.dmp

Download

memory/6208-245-0x000001843AAA0000-0x000001843AB06000-memory.dmp

Download

memory/6764-87-0x0000015F78180000-0x0000015F782D4000-memory.dmp

Download

memory/6764-88-0x0000015F783B0000-0x0000015F78416000-memory.dmp

Download

memory/6764-89-0x0000015F783B0000-0x0000015F78416000-memory.dmp

Download

memory/6908-75-0x00007FF69D820000-0x00007FF69D93A000-memory.dmp

Download

memory/6908-76-0x000001B02AF80000-0x000001B02AFE6000-memory.dmp

Download

memory/6908-78-0x000001B02AF80000-0x000001B02AFE6000-memory.dmp

Download

memory/6908-139-0x00007FF69D820000-0x00007FF69D93A000-memory.dmp

Download