c5c5e68c516fed0303ef279d696ae083fad7e22dfdd0a157811a048ed4b4da17

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
Size 873KB
Sample260708-e4ty1aay7s
SHA256 c5c5e68c516fed0303ef279d696ae083fad7e22dfdd0a157811a048ed4b4da17
MD5 794a0ba30de4f5eff2033bfdb342bd9e
SHA1 9c8a5714d1953a58a3619a213056de1025f3b617
SHA512 26ab88b0237ac45fa05557e7c18682b6fdf65aef01231c17eabecd47cc145d26b20847165a0204df1aee42e24ea80d353a3243c6f697f2b591bbb254adfa6c0d
SSDEEP 12288:umyauiN/HbZ57sqQgc7Nvea8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:Fv/Hb/xc7kXKEFG1rDHmj7dip
TLSH
T11215F12173E08071E1771E75AA3ADB3148BFBC755862848E63D439195E32BD1CA78F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 7 IoCs

pid	Process
5160	alg.exe
3464	GameInputSvc.exe
3452	GameInputSvc.exe
5948	elevation_service.exe
1524	elevation_service.exe
5432	maintenanceservice.exe
4264	OSE.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d9da49d514575bfe.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118750\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	GameInputSvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{BC46FA71-5DBF-42E3-9D35-5ACF299EA00C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{E7DFD5AC-8C85-4F96-80F9-A477496B40E0}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3452	GameInputSvc.exe
3452	GameInputSvc.exe
3144	explorer.exe
3144	explorer.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5056	2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
Token: SeTcbPrivilege	3464	GameInputSvc.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe
Token: SeShutdownPrivilege	3144	explorer.exe
Token: SeCreatePagefilePrivilege	3144	explorer.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3416	sihost.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe
3144	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2664	StartMenuExperienceHost.exe
1200	SearchHost.exe
3144	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 3452	3464	GameInputSvc.exe	89
PID 3416 wrote to memory of 3144	3416	sihost.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_794a0ba30de4f5eff2033bfdb342bd9e_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5056

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5160

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3452

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1524

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5432

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4264

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3144

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2664

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2e90df38d46c062d0fc26b5921b7c8a857304f2cab1d7c76298ebde1f7650265
MD5 2e6ca8fb8e2fa537e22f2f290aaea8b1
SHA1 f0b086450d610335d51bdeb78a14d03e23070bb4
SHA512 06cac559910bc0bdabff2e213443c192e72ad5053d09c729305f7b6188dba1fc9d5430d1eeaaaa713cbd894db8b52d4bf77bf00aabedcc59c76ff8fe4e1d8438
SSDEEP 49152:94O632BuPkFKRrdE6oh7stBhuXjfS4LWxnHXKEFuDHchip:c3q6gjBmXKEFuD84
TLSH
T1B9D59C03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 d16b637d447e4118a625ee31934f18b0d1a97331354e57c8422080563b7cdc0d
MD5 631c35dc304bd6527d179d15d4815b6a
SHA1 d937b6cd3766f2433d6ce9eb271f5f4f40ef0902
SHA512 ad74c6f40d8422cf31e250243b9ec8159bf3365dd7be970d6697fb39756ceb9c0c89c6581c50882e0c3e68a3a59e9b1cbbbfd885e876d09ddd66e82a3315d81f
SSDEEP 12288:v1XLsyMWZxZV9a+2czAqda8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:NXYJW0czAqdXKEFG1rDHmj7dip
TLSH
T15A050129B3D009FDDD2B427CD9628912E673B89147A0E79F03E49A251F237980E3EF55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 041a703100e3c6e5f0e7208ee7bd70ec6f1e4a968e08fafd520f5b36767f4a4a
MD5 b88c410cbf0059af8d11ec6862917a12
SHA1 f888ea2cfecc05156d4d4bac1417e0d0ceb756f9
SHA512 88020f312bdeb6e105af5e6262c68d0344652f9c435d2e0a68dded3b351c6cb6abf00cbc21383d2c3aa37368845697f4648580224441dba96d211f0458692790
SSDEEP 12288:qwsNYVQe/U1L0E9QVQiwxpGZIVuhrHsKRa8lKYK2krUyEGGgp9IobHGqR+pf3jJk:e0Qec1L0EXxOrMKRXKEFG1rDHmj7dip
TLSH
T1F635AE16F6748335D073C0B9C5D2A69AE97230825B308ACB4285D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 488ca8ef65ba7064f4f7defbf931470578550767779a2e9c51b723bca5d3fb6c
MD5 75ba9521de452598e6633a36d9a02baf
SHA1 56f406405f91e67ec023bb45c6db3403c9507b81
SHA512 328d145f988ea4ed542094b46f6c77efed60acd3ccef68093dcd7592208666640774e9a393316d34a07682402d4c08f6419a0b91f41edb38a5f182b5e78c046c
SSDEEP 24576:wAacezSC6vUyD/aqgrvW/6q8wyuXXKEFG1rDHmj7dip:wcezSC6vUzPvuHjyyXKEFuDHchip
TLSH
T167756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8c94411c5bdf0cba99245f2d01b078070cbf3e7491b83be6b7f44fc268e9569d
MD5 7731faf558436ec44ab5cbf8083c7eb8
SHA1 c2acbb55197f02d10b86a71146d1ad9db4b370fb
SHA512 a7c7d2bd66bc5a90c09a7d575228cdec0e62bc42da37111f83064e5169dbceb3dd6652c002fb5623276237c93b81a2607e108652a6e7c3b021cecdbdf35ea0d2
SSDEEP 12288:haJjBP33vTni7B+l1D0RKsMBYWrlx4jf0Im98Ua8lKYK2krUyEGGgp9IobHGqR+M:habPPTi7IXrl+dUXKEFG1rDHmj7dip
TLSH
T116559E66F5748335D073C0BAC5D3AA9AEE3230415B318ACB1246D76C2E677E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 03eb2850025a350688c11b76b0c9c44394bf9d9040f3958d7ac85c8e65cbb075
MD5 6a5a0d46b24bab261ab346846ce68c0e
SHA1 84390b579c5d9943c89ecff435ab34fa69f3d451
SHA512 f6395363700540e1bedfdda8b5a55b6c2244da37803a8f0b65284d408b0760a4fd1c0fdc925afd0bd3bd92be720abdfb07a3b5e3628d7a1c66d3480d36969c02
SSDEEP 12288:Q9ga8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:Q9gXKEFG1rDHmj7dip
TLSH
T17DD42303874043FEC3192DB9721B6DA990B6D7E08D851EB865E43A519B989370BCFF1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 49de4dbedd1d79485012cead8c96fcf403bbe808ca674a94ab940f5266279f68
MD5 64bf1fd0f3b38bfcfde7391aa44d0e80
SHA1 845286abd888e9cdf14057dd48c518669acb7097
SHA512 3cbdbae0731c26034c894a0c2dec11826721af2d52df57e4066bfc2971acd0695e9044c7e1a37759a9056549d0c0cec1859a16903f1b35770363568fc5947e1e
SSDEEP 12288:YeBNUbTVO86U7fa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:YJIUzXKEFG1rDHmj7dip
TLSH
T13615CF2BEE28FCE2C27E5DB967518640D7B274704F52A3CBD164820EDE135E10E7AD29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 81d175f07abf439c27b34de591da068d269994343d49da5a23fc2bed9dde4a50
MD5 b705a0d1830bb0d61ef6ed15a13f0f74
SHA1 ee84dc32f76e58b326e67ad85ef234f221135028
SHA512 a2bd9e5ee9926c2f929067e9427c4f6f11b9dc686f4ae5827f365b389dd198d0c9c260f92017deb63976daaad98f4446502de69f08d36a8ab82eb37c0ad59232
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THu:DQvGAdlCEL8c/NRNw5C6XKEFuD84
TLSH
T187367C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 426b58ba7f0c5491a2b37fa83481857f5eaa1bee9231dbee5cadb12c752d9be3
MD5 91d368a1b67e56e62f2e9a82554f5240
SHA1 2acffd104c19ec034e57e3de3991200fc4be1337
SHA512 94594881c1849c9f84f3ac54d9b46d382b9f04f7476805d3f2bf106e14da82c1d02f627825bb730065b3ddaeac636b023bfd7d63ede11a05780cdd257184e980
SSDEEP 12288:gGwSfxL/2Dc3bDLLmt0LDQewsAjya8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVw:vmewsAjyXKEFG1rDHmj7dip
TLSH
T1D215E031FA70D036C37B0DB62B26C716147DBA604F511AC3E3E85E9D5A602D2277AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a8355dd5a95387b4e0dddff589f90183c7a4d1a8ea882d66caefb7ed9d898670
MD5 64a36c9ea5e15c87d2a1fa1fd15ad1a9
SHA1 eef5ae505b184bf8afad46d742d9e8584b502caa
SHA512 4db8ae1cd897e81b294661b3851f256caeaa3e84b437e52f12e885e00a0e332a3c662b674dc1f612d4aa12b677362bd76bcf35d17d08f63fbaf20f154bd9fa78
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHFKEFuD3:FUEtQevvqc2W1cpV2X132PuD3
TLSH
T140474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f8c95c780b0e1fc39829f32b08b0220952804bdc7b4d1413c25d3328a2dde702
MD5 05c6f0473c9627072a0ffed6fb9bc222
SHA1 190bd5839e26977ddca9e5ff107d46d6ce9ac522
SHA512 6d4ae7a37617db5827d37e41f797108dcc641c15481933dbec0b61b3392ce4436b1ff07574bbeab676407935ffef114fc91a57bc33859244159bfcdc3d8d9e22
SSDEEP 49152:BobRquA/m2yL5zMfFiV+XenmE3/zuXKEFuDHchip:Yoq1VjnmbXKEFuD84
TLSH
T18FD58D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 70a71b19e4a683cf674fa2f986e615242fd750348ba04b9a50653ba4e49dc880
MD5 d08f5c41b1d815a574a762db21bc39d1
SHA1 69def2cce5e0d75eb7116132e814452dd3f01f22
SHA512 c6609ebb7550c80cd6b91a8194b04e6da0d0ba17027490666688eb76351e9c9dbad530ef7bd26ddb85618986dce47dc7639e33df656650d4b1598c9fe7a705d1
SSDEEP 24576:BAhGLveFoiwtA5l7S53FXKEFG1rDHmj7dip:BAM6Foiq5VXKEFuDHchip
TLSH
T1DF45AE81E7F941D4F5B3AAB8A9769570EA76BCA65E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 3e657b4e34e6380c11cc754e74f3cf2a9cbcc8d700fc8ffbd85e7447debbee3f
MD5 cf4729ac5216c46ce315ab0aca715e87
SHA1 b62aa0addedb41e428bda8f186cda89339235375
SHA512 fb1ddd809769a891a8628d776b7fe5e0209816f26b8b475d0b5d0f3bbe87a288fa66efb1fd4fa8a87c14e0dfe3bcfc65df4cd31ec5270fa01a5eff7628111e25
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+CLda8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrV:Owu+OWadXKEFG1rDHmj7dip
TLSH
T1C105F14677A40CFDD66756388257C536F7F2B8112A21DB2F13A0C65B5F273226E2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 85dabb617d27cb443f2c9a9a22ee46080c5c25e02ba8fb2566b397d3c197f1bd
MD5 44496e266d4acc1d68c0fd5e9ea7127c
SHA1 b96d984d09e7fe288190e2d42ae3e5e42f11f7dd
SHA512 4c2623a374760b22586067e50dda13debed1979b8370d2d5c80caf9f40181597144f83897184f0591cfad3a213f88be51b8b11a457ebe3a3216e8bf68a0e7e31
SSDEEP 12288:Spf1Ig7a8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:UfuCXKEFG1rDHmj7dip
TLSH
T10EE4120723D021FEC267167CF5A25A45D3B2B0A25B7603DF12A416655F62EE30F3EB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3c50da137834d281b065451d4df0302914e01528c9c17071a814110bf4314508
MD5 867b7192cd2f10cc42426c0b47a501f0
SHA1 0483aed649f4ce497a8f159d289c29deb8227d8a
SHA512 0614a96e3f5d6c7a1aab93ae9fa1a143e67cbcfa478c94fc5331818ddb4932e2c3f92e272aaac9cc8b571204dc4caac52d5c57bd21509bad3075202ec8c2946e
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UV:UQRQyi36YOcP8Lvw2gAf+PN36cAsg/OF
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c491e196a719d1517c548bbb00cd2c4047d8a0a44273845a7d39350ef80bcae0
MD5 0fd0e8504689dc9feae490e114409e42
SHA1 7a2815a74627886483a90827821856ae5847dcf5
SHA512 0d870b8edd578f132ac47ab1157d664db6c96556fdc02099dfd62f9cc1bb15ec73eb8d082c698873cdc6a104aac825f4bea9dd635dc730e81f61fe446fae2495
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uo:UQRQyi36YOcP8Lvw2gAf+PN3ncAsg/OF
TLSH
T191667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3cebdb1030999a791e915d354688e3e655498d98417118c5a597429786918727
MD5 c518b4c5a62201523a9baeab6918ab6b
SHA1 0c37c69bfa35a545958af4a16b55bc9bd98d223b
SHA512 3cb2ffb34923566ecac17589b91a06d0d8b7ec115d09d926ca60da894ccc56fd1a229679d83364f5395ccd241e8127e2c6fdb6bfaa9556225f9ceb129587df94
SSDEEP 24576:Owv1qf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0pXKEFG1rDHmj7dS:g68Qg55nhMeWu7PNU3/yXKEFuDHchip
TLSH
T1B7B55A33B2F200A9C44DE1769F4A973196D27C718FE1E3DB855172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 16dab8b5c69b0781a56df14137c4d8224f5659907aec13564d69ad7af7bed580
MD5 c651bf39e815dd77c4d241db6b673354
SHA1 218f59297b15fd9090bb70aa3f76543113734221
SHA512 21f8a82a4beead0d5913b55ad85ce761c0272cfa91322595623ccb42ea289f7138aef6c06d59a9d06b8f3fd06e9dcc1bcb0a9adf897fb8a3e7675130e3997a3e
SSDEEP 49152:53aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99x:oy5112gYy5azzVv569nLKnhZTcAsg/OF
TLSH
T14D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aa5c2dd15986147c38e7b16a80684eba14c7559921e1ce4e3158e630cf0872ae
MD5 eefff080501c4743b4213fdc186cc7ca
SHA1 8fbf61acf3f18271b7f803e3a93cafc74fc6bbe7
SHA512 2f7b2576ab41b296bb2ebba8d71306ba81d0d7961a38eb83888b9c5b4bb338d8f04bfe13b2a42eca2358f357ee36a6c1a60a3b4348ad032bd006597a3fb5b677
SSDEEP 49152:My+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl7XKEFuDHchip:Vu6JmTxd2d7XKEFuD84
TLSH
T1FCD59D13F2D901E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 52f1bc920654213419172c4ab7eeca074f474559c9e0efba57e01f4e218b36dd
MD5 e2133c8e0b6190c321c528e10ac7c6f0
SHA1 2d80f3893afc48e06773e424ccdb5df83988f790
SHA512 0a533194037466aeb5df1ecc2991709eae8e3f83e7c1e3b3718d2c6ea4f9f60c5abc7e01f89405b608e192c26876a3fd22b769223e3f435d86c6b5c8d1fad8e1
SSDEEP 49152:M1hpsNoJpF1A6UU44CwH7R4xHHEcAs2JlACkgOF:MmifPbRJcAsg/OF
TLSH
T150B5BE13F2D900E8D06ED17887569232EA71BC460B35B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2b4f16069390ccee32a9810e370cc49548ca5b3b2b3f68e960ef4cfbe2d6e809
MD5 e8938154a041c9694f2d4dba0042bdb4
SHA1 3a87759e0e8e9d799a313dfc89ababb008f93340
SHA512 e13c9ebc9d30cc1c177f4e12dc5c32f98627f8c26c45240691866c2974096de646abcc333d7fb473207f665e7bb4c883c23f046ab14f47baef609ad19c329fec
SSDEEP 49152:uSuZQIY0Be2K6RVtOnks6NMHqfHEcAs2JlACkgOF:g5dKoi61McAsg/OF
TLSH
T1C6C5BE03F2E940E8F0BEE67487665232EA72BC464B34A6DF065072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b31a1551fc8112d65ea56d6561d28b5bc6fb12e45d9d618d882899e9e8aad6b
MD5 28e7ab9621d81a3ecff502108b1dae11
SHA1 1d800f27584f74924edd2feb822240cc55314322
SHA512 8c48d8e4971c78cb72f9dbde02fcd37643814e693c7b623619bddfa52291db5897f8de6e93aa32198b2aa2005fc4aa8129dac2b96d08a3ec7246fb8a0e47b747
SSDEEP 49152:ChtSn8EApI0figTgiDn0AP5wiHEcAs2JlACkgOF:jX2iyphAcAsg/OF
TLSH
T170A5BE13F2D900E8D06ED179C7468632EA72BC150B35A6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 2e12a117a0e30c7c96aa29fee5ff95cdc168a39954987cba857fdfd05ab44e3f
MD5 f2dea577a89c36eb3674ce70cdc0c810
SHA1 91e8337786f57a132d93a98f2ecc430b1c89395a
SHA512 16671f4993186e13562c8b3b8d57433bb93ca67899324937722c5c1c48b369eab4888090440afaec900d3fba1e7deeb01894dc3f4008d6e9fbce39ad6112435a
SSDEEP 12288:NO713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:NOhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1CCD42383956D884BF1FE7477A945244DB37CB88AA76B942E07F0E12D0C60A3F24A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 fd55862c8632b116019a43601ee583051603d179c1fa367365ceccb9f9db43ea
MD5 5bb8ee5fc7c8399bd94adfb59f54cc78
SHA1 d7d17df50ffa689c661416f05362bdf6ebce35aa
SHA512 3753cea2d6fa4ff7793f92020b9f4c7513f397673b24394c8d54b26c7da590602b68d311b31a47f72effff14483784b9b36b9995490c3b76c79c525f7149e50d
SSDEEP 12288:L7713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:L7hC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T16DD42383997D884BF1FE74776944244DB77CA88AA76B946E03F0E12D0C20A3F24936F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 739029b4a76e338dce1ac16784f7bb97af8256f07738e17e488c91576e2b34df
MD5 d6063707a088e4afcad09e06211da309
SHA1 2512fdb3edacdd7718e2828221cf835b47c7754e
SHA512 60325f74f699334a9b7631c84a5eb809732f8c48131402622ba631375763392477ca48b7a3140db0b98f2e5cd2c7c7ef1f4cb2030f5608c4c35c28da8402f385
SSDEEP 12288:xi713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:xihC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T152D42383857D884BF1FE74776945244DB77CB88AA66B946E07F0E12D0C20A3F24936F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 618KB
SHA256 4aa6d8e07fbaf476e436c21dbe3d9981f876cbcc703d051895908e670220009f
MD5 1377c8270e2566e21236b689ea88435c
SHA1 23b5cf73c5d25f9c571323f4e1eaa3ea90cc9c74
SHA512 5ae3e0b6c748236c12d68289d949a4ea92f0cc79c1b5339ab20428eb8555f2d5c87827696d863c155080c803a94cff2274e1ca7f6c2d4b7979afa0256866c3f8
SSDEEP 12288:ilQ713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:fhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1DED42383567D40CAF0FFB17A99551009F3BCBC8AA636962F47B0551E0D70B2A6863BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 87cf5398a3d1ca63456cf0dd9253c8821d231e6063637d23d2baeba409548d9d
MD5 1a68f5c5ca25550aea01f4a32faaacfd
SHA1 660b3b9ed31f1dd54703b6cddec43c9eda9883ca
SHA512 06bd8952f34b28b095a665053ea2844403c2cc0aa8a73afcc163ff0f12b857b71f3310c7b736adffa753363f9204491e00a137839237dbffdc4d4fd9ecc4c697
SSDEEP 12288:AN713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:ANhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1B8D42383856D884FF1FE74776945148DB77CA88AA76B946E03F0E12D0C60A3F24A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 8f82af7cc09e2c3e44475c3b4a456854198d21b4dbfbdb02e3094fcb37255bbf
MD5 6cf383997654eda8c01bbfd2f0ee220e
SHA1 647f6f475e70ffde3b8cf789e3407c7abec96d99
SHA512 a321a3669af5006c4dab7c5bb164ca1a700d9c3f20b36a0ee11b9eda58a7e90a660cfc04c069daa195a132f8aa243c07d6437c6810d12d49bb3afd8557a1bfaa
SSDEEP 12288:DL713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:DLhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1F4D42383956D884BF1FE74776949144DB37CA88BA67B946E07F0E22D0C20A3F24936F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 3e5f0488ad78439f92fafb3b9f7a54e581417a7031ba447aca38ac43c01a7b38
MD5 2f200919375ff2c9b0324e8227cebfd0
SHA1 bd5e4b00ca4f1c8af6e79d20ab4083679f37da25
SHA512 9a805592da594c5d05ffabb714e0571c9670281e1eeb8345301209c9dca87d09b6c9891e90a3d287dc42160b00ed4646e173a5db47749011388b6b8ecb305eda
SSDEEP 12288:uh713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:uhhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T15AD42383956D884FF1FE74776944244DB37CA98EA66B906E07F0E12D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 859KB
SHA256 47ac8c48281adb0cd4ca24a4c528245361cea728bad70e713217e3cae32aad0d
MD5 7fb8934289ee7644fcca7c20cd0fcb6b
SHA1 66839b88c61a8a62579ffe9b7c122455043aecff
SHA512 b7bcaa9e66bd1dab0f7901e37de59be4d528cf22b4e5d2cca32bc46e71258b063c551123ea7b153bf9ba48ecda349d046094f67e2c74fb1b67de8887b5aa17e7
SSDEEP 24576:3ZMKzFuS7NhC8EcbTo47VOxpd9KwlgLCLgXQtorp:3ZMKzs2HEcAs2JlACkgOF
TLSH
T17B15F195B36418F9FCAB913EC9554906E7B1BC5A0670C61F03F4366A1F333621C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 3e936d02149b13b37a94057535ab44e768879b97eb5c8ed7e9151bf5ccbdf069
MD5 ab25e229f1854bcffe5eb489d137f7ce
SHA1 98dfacbd4a534f75141205d11a75b55e54be57f7
SHA512 842fe7bd3b8f3395cda4566d1b2b8b6f23b8d5fe190caccb0158e5e2cf9ca1f74877e16518507128720c58685f32b6d5726659c5c743010b0494a6c9b0f2376b
SSDEEP 12288:PB713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:PBhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1C2D42383956C884FF1FE347B6945144DB77CA98AB66B946E07F0A12D0C20A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 760b739ef8a73edcdb97894e5f36015a0d17cc6af546321893459bb0d61afc89
MD5 5e4a690d10ac054c70f77513acab395f
SHA1 940cfb5fb91f03e8e0885f7f447e75f8d41c7c8b
SHA512 bd772083ab55dc74175ef1000bae68e32eec64a72acfc3946cb720af20dd13203de31d1693e2349981a4e35e44af8b4e007397f73f1f0e92233cdc1e9befadb4
SSDEEP 12288:Nw9713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:Nw9hC8EcbTo47VOxpd9KwlgLCLgXQtoF
TLSH
T1BDD42383856C884BF1FE74776945144DB77CB98EA66B946E07F0E22E0C20A3F24936F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 d37524c834bd4acf557590c1848bdc52fa03df06816e76f64e4c903166227f60
MD5 3818123d4f69f258b530a3c732e9a651
SHA1 b5064e93a3bc270561e06ede2625bb0b98660c58
SHA512 bad073af361e246dd9f17ed1322ea0e4f7262a016eff4ca21bb548b896501908335adbb538ac4544f0189982ed99835b357962e0cb5732550ab07b87d53181e4
SSDEEP 12288:6NPK1LQR713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:gK6RhC8EcbTo47VOxpd9KwlgLCLgXQtW
TLSH
T120F4124773A520F9F1BBA139C8921906F375B87607358A6F03B0477A1E236665D3BBB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 46cb7273a68de677b67a54a0f2327ec4480e72e58e260a31e089516a955162d0
MD5 49a5b53a99ad5dde9949d6c9310f9441
SHA1 1e2e2920bbc2a229febaa4db2b96a801d26bb243
SHA512 76f4545b33b67e9d578c3076b854364e85cf295f1e9fe759a3c271ade02a5547f8ace475348ba6a694f3325e933685ac424d5ab27114b2ddb8aaddb2eae879d9
SSDEEP 12288:LX713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:LXhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T150D42383856D884BF1FE74776944144DB77CB88E666B946E07F0E12D0C60A3F28A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 0ced23b439678c46924b0e78abe73702c5e532aba0ba1f1c5e3276f96d900193
MD5 1bcc77fe6c276979a2c192b0550dc309
SHA1 7481957dfde64559d6a782964031b7c9abd2d7d3
SHA512 ba67b48bd133b6420adcd5ca58cbbfdbe8e2485545ee4913ef3351a612a1e38be36b334b4491cc0048cfa39c6a91761239efdeb480d66f16e16d46beeb2456c2
SSDEEP 12288:v5713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:v5hC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1D9D42383956D884BF0FE74776948244DB77CA88E666B946E43F0E12D0C6093F28A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 756c6732da09af7b53b087e3dc7abfa62a62f90f3581f403cf27f38b7ad6ddb0
MD5 04f33e7e5f4bbff122eac0a65448fe49
SHA1 7304e0de774005c484bc409c6495392c7f7a6d88
SHA512 b9ca71f085ea781ef6e8346ef3630c3443b6e8310972693a8a478bc86cfbc46810475a2a1dc03b285d6f910dca315e7369d86cbd51846895eb1f48ec53c15cf3
SSDEEP 12288:XNPK1LQ4713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:VK64hC8EcbTo47VOxpd9KwlgLCLgXQtW
TLSH
T15EF4124773A920F9F1BB9139C8921906F375B87607358A6F03B0477A1E236666D3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 859KB
SHA256 24a274e48941177255853f0ea5bfeb01bf9adae95261a2921745b4e55cba5468
MD5 d5296c5630935e56143de31dd931f8ac
SHA1 7fdc304cf1e281f91baedaf109baeda786c2613d
SHA512 ed2c74a1e57b02dcf5a49ddc2e3f3e25283303ea0adbdd28ece13fd49079c8fd06fc9d21da67b5c4a15dfce917a178ff9f2cc5742e09f3d3b4cc924d6591f039
SSDEEP 24576:6TVaLq3z0zc8hC8EcbTo47VOxpd9KwlgLCLgXQtorp:6TYLqjuHEcAs2JlACkgOF
TLSH
T12315F195B36458F9FCAB913EC9554906E3B2BC5A0670C61F03F4366A1F333611C2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 5751808c55f0c02d19767b757521d4c78b004359420a2c8572d567329c93d0f8
MD5 517f6bd18ed854c7c396e68250540046
SHA1 ae0334d2d6b1b23644f36a28ed9d12361084a199
SHA512 86a7b9d827e180a1a811e8c69c7408b8fddc0b4cf8c62916516e336e2a2cff87c27f15b2c2cd8e01a97154141b84a4f8e2a884bf6461c89ed4993716100c24c9
SSDEEP 24576:J34dJCH2y7DdjhC8EcbTo47VOxpd9KwlgLCLgXQtorp:Z4dJCH2yfJHEcAs2JlACkgOF
TLSH
T1E535CF91F3E814E8F0B79A3589764511DAB67C5A1B31CE8F03A4661A1F33B918D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 7b70d410f974705afdb265768ff4d810460da55ce64a04352d7a6971bc007a2c
MD5 b0140eb68020ed82809707cf80d1b197
SHA1 baf41d3442f31004d6573ab49fba04b38d80c8fc
SHA512 2f721a8affe613be7e0db71f1542e7e751f15a0179c06b7e22312a09ad983fca0ff16319f3b4ef2a89904a5c4a24c0866cd9058b50d0ed5618494c71487af5db
SSDEEP 12288:PL713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:PLhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T135D42383857D884BF1FE7477A945144DB37CA88B66AB942E03F0E52D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 a2dedaa26f74f616f756d915adf397569b96ed510fd58caa16d10d8da6d4ac7d
MD5 47d0a595860e20827634dca86fe4d0bd
SHA1 ca189481879df51ca1ed092587729fe1859077f7
SHA512 15e3423b52903578852605f976dc066d7f8218367a185324bdebc3912c86c5e3c19e9a1a01d05f4ce2f53b56b1746fef07a7b19a6ad4d42583cb6a6a89d404ac
SSDEEP 12288:h6713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:h6hC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1AAD42383857C845BF1FE74776845144DB37CB98AA67B946E03F0A52E0C6093F24A36F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 093498d82d337cc6c0cc20cafbece31f61732cfcf7a98abb7ba9a4095a2a7762
MD5 42f5ca115f1ef0d2942ee14b66496bd7
SHA1 8ac5a6e01bde7b5e6c072a2c70d9d720108cb112
SHA512 a6936dfdb5d21b95d944bf4cdc7ba9ccc3079f4ccc0ff83f36d6e6368f303c8e23e7bf5301cf40b7b8a250b134cfa317997975f67c566cadfced5eaadefc7529
SSDEEP 12288:aL713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:aLhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T110D42383856D884BF1FE74776948244DB77CB98EA66B942E43F0A62D0C2093F24A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 0205d7c92663a4fdc1af66598fc6b3229bc3d52954c7e81605fecb6541ce6ba7
MD5 c52372f7e47da0a10e619b217ebf00ce
SHA1 e2349218579111406f8e0b9146181d134a32d04f
SHA512 34ef88902b5d2c1857493c95fabf6f5690c5500198bf3e1abe856a36f53bc45e62fec39d86043fec9a3957dc68d24915ede93e1d6797cae48b7aa04f86370e10
SSDEEP 12288:Ja713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:JahC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1FFD42383856D884FF1FE74776948244DB77CB88E666B946E43F0A22D0C2093F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 c427f222d23650f76ec85bd8aaa793118f5181e72ff71e53a53c58c10dd008a1
MD5 fbcd86b809b980f8308292106157d603
SHA1 b6772d5a7d45f42a78abbe4a8eec785a91935dcf
SHA512 f7e2849c8123a8b9efff580e548e1e6d37098b9ca6856f52cdec1ac91414604afae68d371bd853071148b22caa6b56851b1a0334ba2f8bba15bac04c5ec9741a
SSDEEP 12288:Nb713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:NbhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1B1D42383856D884BF1FE74776945244DB37CB88B766B946E03F0A52D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 50ffecb465dbb2d536fcb3cca7d3b0a5171cd2e1359c3ed47377e6b38a63075f
MD5 019d979f440e409e4b4384552f75b576
SHA1 d90f120bc2a04b83be76901966ae89fba87367ae
SHA512 773776893720b2b9908905e7aabc5ee9a4c77e5b99043b27df8cc9f8575871dad486be5645744b32dac070147d01579b5b233e6ce801ed7066590417712d2469
SSDEEP 12288:AE713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:AEhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T147D42383856C884FF1FE74B76945144DB77CB98A666B906E07F0E62D0C20A3F24A39F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 eddedbe29f1b35b3bf145bedc019c88431de8429cb3b1edf1e60cacfa25a013a
MD5 c228fd4b6ff6fba57f95d0b3743e8e70
SHA1 ccae2cd627e5769cff63a38e67103747d708410d
SHA512 1d12fa0fe62b8f92feb27211d19e47d9f9895977ff283be5f2678ee30002d850ca14b7c55cbbd72ad6090b8f982243750670061f0974f16a6b0c52f3151fd05b
SSDEEP 12288:ht713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:hthC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T18ED42383896C844BF1FE74776945244DB77CB88BA66B946E07F0E12D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 318d01799429ef2680f9f1aea7c34f414bcbc12156dede754f62ac1a8dfcee41
MD5 b4f93da9f9057156e6be1326f0524728
SHA1 d9cc61b83dd0c2c5dd3d096edfd6997661cdaf24
SHA512 c4c2d3a2ba6c604a11303bbcd76bf9cfa908a9674523a199e57a8421233f7cc09e9610ff77222ab27a501100f1bb7e1cf89cb48e19189fc31380fa92ad0d9cc1
SSDEEP 12288:y2713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:y2hC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1CDD42383956C884FF1FE7477A948144DB37CA88A666B946E43F0E52D0C20A3F24A39F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 598KB
SHA256 85ce3575a80fa80ab3b1e060709c8a378c55ea92c4138f73ff2923cd5f6b6254
MD5 de5449d5e00baa620eb2d98278f2ab20
SHA1 90783650eaac4e1d0be8faa5f085e8ac767165bc
SHA512 7db6259b9aaaf83471b8f0fb9059586f2a1e7f228c3dcff7255b8696c769ada4e5686b46997758a9cf15fbe1354667f8a22ed17b39c1e3e5ef1921e9feb35b92
SSDEEP 12288:0e713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:0ehC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T162D42383956C884BF1FE74776945244DB37CB88EA66B946E03F0E52D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 598KB
SHA256 905ba61677e626818d029aecfb94284c49ca9f370316df77443983c647626563
MD5 e24607eecbcb96091f50f1c1b914d6a7
SHA1 213c741a60a09c689822d2497710a44c26509657
SHA512 f75e75ccee16a8bfb6bcb0fb3cc9ac98ccd86b4a9c3b21ab6670fd1b5a13a2caa26a370f869fa1c7f4fe3197cbf9032c470f88393b2ac866203fced297708b9e
SSDEEP 12288:6E713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:6EhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T13CD42383856D884FF1FE7477A944244DB37CB98A666B942E03F0E52D1C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 598KB
SHA256 5454e008d4627470ec9bc5332dd197fb3811d3d7a9e28395056b309ca8523877
MD5 a19cfa5941f65847a8ccf7f7ab73dd44
SHA1 3a6a7b062cbc88b0d695c88edb5ca59d4714c952
SHA512 d9d9ef1f15cb3515e6a4a9bf7945a04c3e8d3636f090611b308c8435ae56bfa3136b4d6e964dfad08d77af2e9e1b1ae0be0d7c09c428e6ba232120e55d4aae15
SSDEEP 12288:qv713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:qvhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T16ED42383956C884BF1FE74776948244DB77CB98FA66B906E02F0E12D0C20A3F24A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 598KB
SHA256 d346e3f160c9ece49958ecb56d62650c5bc12b7703cd6fb8648554fd6e161180
MD5 adc07b4965324bc68d0b9a925abddfbb
SHA1 87147b01240bdf2d403fa8d5f1a174cc79b31843
SHA512 a68a24c51393ecfdb9e8945d9152355b55cc53cdbfbcbb20ede0410b94636e65d6165110fa53fa280b6d2f35270c4cbe9285d95acfad8c23559bad7cc4b9ab51
SSDEEP 12288:H+713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:H+hC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1BCD42383996C884BF1FE74776984144DB77CB88EA66B946E43F0E12D0C2093F24A39F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 598KB
SHA256 6b0b141395c4ad5516a9bc201ef5282fa0bafc5879c633302831fee8707ca39f
MD5 b5d3973e9629fbdd4b829b3681085638
SHA1 87e4a355b76e29be96b47f83797a66e5da89d4f0
SHA512 b2dba7cf96ec299318ac53227b3c5c65dea0472879becca8d4a16c943f80465779a7945a73a981595fa0cf71fb9b16ba585293d11c0a439660cb82a8d79f4417
SSDEEP 12288:Od713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:OdhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T161D42383857C884BF1FE7477A845244DB77CB98A666B946E03F0A12D0C60A3F28A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 598KB
SHA256 cbb3d0dbd76984dab69149c87ecb86ba26644bd5be955186d6d266c724c2e976
MD5 432e5b932e325facd7999f6eef6da548
SHA1 1912bef33698f9c868b1bb18a12dea1a3a8a5167
SHA512 cec96f7558b75904e0673ad1156f4b9888940b7a874bc7ba8ebce06a6b95dfc4c7216729a04849933b4b14741c5a90c966060423689337e2a4a2a8b0db019f59
SSDEEP 12288:Hi713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:HihC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T131D42383957C885BF1FE74776944244DB37CB98AA66B946E03F0E12D0C60A3F28A35F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 598KB
SHA256 7cebaa4d8796370dc879975e0c993af565a4c26f9d63c4aa699f35310eadb7fd
MD5 26ebb29c15e9bb9430533479afda8eb8
SHA1 dc3ea808a1fff880162a519a98327e3f549293cf
SHA512 26f8764f1266639af5ef5be09e83d1371bfd4f3954b2ca21c75d6fe08f8559c68643591075483f548a10849973151a3f98e7e3e01c5e6f6413f17b13ba3dca10
SSDEEP 12288:Gq713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:GqhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T194D42383957C884BF1FE74776944244DB77CB98AA66B906E07F0E12D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 598KB
SHA256 1f5df477d822ed3141724d07c4d5d0a300cd71a289cc74834bd8b32ab173faa6
MD5 3c4155e66fc503565691b38889c01f24
SHA1 41a22a8a40990a7fc606f6453d94512e946a4fa5
SHA512 18a047a2a25ee9ac3d9e7a5c54f20beee3c65390c567bcdc7ca41f55d7f566bcc8d917768461e5f2048b3479261b84c8fc60b84bdcd4e501d5bfb8574f7ae246
SSDEEP 12288:nT713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:nThC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T15BD42383857C884BF1FE74776945244DB77CB88A666B946E07F0E12D0C60A3F28A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 598KB
SHA256 c58f8be47d4af188d7b62f9e98aed1b8286f444c388134edcdbf68139938f18c
MD5 51ee60cb3b2f21e4d78683d43aa10fbc
SHA1 038aa7868d378ca240447052c4d16caa636aed3d
SHA512 bacb9ca209bfd4f9e7512fa732155a2217ec5239fd485815ba7e4ec75234dc84bc1bd976d703f2ae4f83dc1e8cbe5557eca35aa1029608713e054a7e5581c95e
SSDEEP 12288:hpj713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:hZhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T139D42383856C884BF1FE74776845244DB77CA98FA67B946E06F0E12D1C20A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 598KB
SHA256 9d71f0968847f67494bcbadeef7e7be55f6ff5c4451da3ea6d4d5fb370cd4649
MD5 3d35ce5916cf242200789d90f622c94f
SHA1 f84d5dff44703268cd3dc6740fc56e80ec99bf18
SHA512 de9923bb1bc24a1fdcf591332663e6836154490daa050097a74068eab0685cedca723b650f67740c2dd8bf6b0d72b7c391a1a40345fd039a6ac38d2f2719d23f
SSDEEP 12288:tN/713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:tVhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T121D42383853D884BF1FE74776949244DB37CA88A676B946E47F0E12D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 598KB
SHA256 e16067519c4bf597641f1b531e23166c5de3ce924a26835f50e73beccf4b9d54
MD5 9d28802da55f7fb50d61b98a97a929fe
SHA1 76b5e196c6892eac3c04fb44ea48b535af034faa
SHA512 f85095c0a1f3c46ca333ac66512a0e802c0936e5c7452a6234946dbf88e8b50b8aa639e0045dd92e49e38eaab3efe846dff2d3401dfb9ba9959823c8e91d1b21
SSDEEP 12288:Ps/713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:PMhC8EcbTo47VOxpd9KwlgLCLgXQtorp
TLSH
T1EBD42383856D885BF1FE7477A949244DB37CB88A676B946E03F0A12D0C60A3F24936F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 598KB
SHA256 607ae009300ab5de56eed0036edc646c6deb0db882e30b943f3514981e5f371a
MD5 1e8a6292450bacd6c4145f962d791e9b
SHA1 ec383d851679e47e287d42b5f8a3f0c7c338c934
SHA512 8e0b071a7a6202eeb3d12691a3d411afb3169cc906aa100ec22e2464522d45857b1b52d5421f34ac48e6bad023c7d5f91065bb6ea52cf2506aa66ca1072e61e6
SSDEEP 12288:69/713S84fxcbToiG+7VOx9Z5ae9/SwlgwwlD+/TgCkqGkG+gd/rp:69/hC8EcbTo47VOxpd9KwlgLCLgXQtoF
TLSH
T1B0D42383957D884BF1FE74776945144DB37CB98EA66B906E03F0A22D0C60A3F24A36F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 1cec4856d01b61eb446342a1b007ac803ba9f7fc2a58ce63a4d1eba8c3019ce8
MD5 81dc3cdaaef50c5fa540c374f4ffd4ba
SHA1 ad67294eb42271438655db93103b7ad485a2bc1e
SHA512 349c9d224a83baf93d6d75baf7366c3ec15566c0f11acf628da512cc1c39418e9da8e5e31a14af041777d5c13528c5395177b881c3f859ac6007d2839b67cdad
SSDEEP 12288:wF8fla8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:1lXKEFG1rDHmj7dip
TLSH
T1D2F4010AD28402E9C12E2679E3065A41F373BD6187E193DA63D0F53E1F766A10EDEB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 a47bb90930b7299d4b8a043d76fddadb993598a58995e2357731bf40f1277ade
MD5 f92b2a9a73e6f6cc7385119be4dbd93b
SHA1 d101fd225aea7231152767bc64fd752a21cac591
SHA512 8a89e640103b45a43de18f6d5fbe5d420893f1983f711e695221418d9cd53928948fc337459e294ded1bff23c2fe07700bc9925637710eca0f8dc6128d561dde
SSDEEP 12288:8dGUa8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:gGUXKEFG1rDHmj7dip
TLSH
T179E4231A66D022FCC2395AB9B1175966B0B2B2B04F0426FF05E475358F989F21B7EF1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 aa066a45a8541ed6ea1b0f979b81f247fe1e3b4dd7caf7f8351cfdde1ec83d0f
MD5 5ed35f2d171757f3864b9f0ce9b3d711
SHA1 ded9106b3167c570ea16f56f3c2b4c6ee2371663
SHA512 af4804d3285c94805d371000ddb8fb4416fabb92c5eec8c99c13b52e6ba76f0853804708566520825aef5c26c343c800576381ced74c56c27f8b9c67dd8fe947
SSDEEP 12288:U1Huk6j5ZI7da8lKYK2krUyEGGgp9IobHGqR+pf3jJwkDzVJUxrnoC:e6DIxXKEFG1rDHmj7dip
TLSH
T193F4020D236611FAC16B907EE2430512E1B2F1B187121AEF06E495798FE3EE97A3DF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 94716c1c5edb454cbf49c94a9cabbe3f84f4cbeeee63d9cb301f93817399c2d1
MD5 8c75f74808c4440e5e3757edb753f849
SHA1 d015d95d7dde7000917a9d0372d94cd68ff53777
SHA512 03262211b0b89900f8849e4149c873bb1a5a3e8ed2c75da7bfe474be94ae170dfc59290ff9d425573c62fe918fd2815b1b024bfdb757fbd1ab13c886b2e22960
SSDEEP 24576:mTkNvNnaFeYhJNtmZBmdXKEFG1rDHmj7dip:mTMwBtOmdXKEFuDHchip
TLSH
T10D55AF2EBAF806E4D1FEC6B4DD238512E6727461073253CB5290C13E4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-117-0x0000029A001E0000-0x0000029A002E0000-memory.dmp

Download

memory/1200-123-0x0000029A038E0000-0x0000029A03900000-memory.dmp

Download

memory/1200-116-0x0000029A001E0000-0x0000029A002E0000-memory.dmp

Download

memory/1200-118-0x0000029A001E0000-0x0000029A002E0000-memory.dmp

Download

memory/1200-125-0x0000029A13D20000-0x0000029A13E20000-memory.dmp

Download

memory/1200-130-0x0000029A03B40000-0x0000029A03B60000-memory.dmp

Download

memory/1200-155-0x0000029A14080000-0x0000029A140A0000-memory.dmp

Download

memory/1524-61-0x0000024D37490000-0x0000024D374F6000-memory.dmp

Download

memory/1524-62-0x0000024D37490000-0x0000024D374F6000-memory.dmp

Download

memory/1524-60-0x0000024D37290000-0x0000024D3736E000-memory.dmp

Download

memory/3452-37-0x000001AAD0EA0000-0x000001AAD0F06000-memory.dmp

Download

memory/3452-40-0x000001AAD0EA0000-0x000001AAD0F06000-memory.dmp

Download

memory/3452-89-0x00007FF6F0780000-0x00007FF6F0848000-memory.dmp

Download

memory/3452-36-0x00007FF6F0780000-0x00007FF6F0848000-memory.dmp

Download

memory/3452-39-0x000001AAD0EA0000-0x000001AAD0F06000-memory.dmp

Download

memory/3464-30-0x0000013EBD510000-0x0000013EBD576000-memory.dmp

Download

memory/3464-27-0x00007FF6F0780000-0x00007FF6F0848000-memory.dmp

Download

memory/3464-68-0x00007FF6F0780000-0x00007FF6F0848000-memory.dmp

Download

memory/3464-28-0x0000013EBD510000-0x0000013EBD576000-memory.dmp

Download

memory/3464-29-0x0000013EBD510000-0x0000013EBD576000-memory.dmp

Download

memory/4264-81-0x0000014C8B030000-0x0000014C8B10E000-memory.dmp

Download

memory/4264-82-0x0000014C8B240000-0x0000014C8B2A6000-memory.dmp

Download

memory/4264-83-0x0000014C8B240000-0x0000014C8B2A6000-memory.dmp

Download

memory/5056-1-0x0000000002C10000-0x0000000002C79000-memory.dmp

Download

memory/5056-7-0x0000000002C10000-0x0000000002C79000-memory.dmp

Download

memory/5056-57-0x00000000001B0000-0x000000000045B000-memory.dmp

Download

memory/5056-0-0x00000000001B0000-0x000000000045B000-memory.dmp

Download

memory/5056-38-0x00000000001B0000-0x000000000045B000-memory.dmp

Download

memory/5056-23-0x00000000002A3000-0x00000000002A4000-memory.dmp

Download

memory/5160-18-0x000002CD12160000-0x000002CD121C6000-memory.dmp

Download

memory/5160-17-0x000002CD12160000-0x000002CD121C6000-memory.dmp

Download

memory/5160-16-0x000002CD12160000-0x000002CD121C6000-memory.dmp

Download

memory/5160-15-0x00007FF6BA260000-0x00007FF6BA382000-memory.dmp

Download

memory/5160-52-0x00007FF6BA260000-0x00007FF6BA382000-memory.dmp

Download

memory/5432-69-0x00007FF705440000-0x00007FF7055A7000-memory.dmp

Download

memory/5432-76-0x00000192D4A60000-0x00000192D4AC6000-memory.dmp

Download

memory/5432-78-0x00007FF705440000-0x00007FF7055A7000-memory.dmp

Download

memory/5432-70-0x00000192D4A60000-0x00000192D4AC6000-memory.dmp

Download

memory/5432-71-0x00000192D4A60000-0x00000192D4AC6000-memory.dmp

Download

memory/5948-46-0x000001DCF29D0000-0x000001DCF2AAE000-memory.dmp

Download

memory/5948-48-0x000001DCF2B80000-0x000001DCF2BE6000-memory.dmp

Download

memory/5948-47-0x000001DCF2B80000-0x000001DCF2BE6000-memory.dmp

Download