0c291cfa10a75ef440b6d30b095d0c5c434fafe82dd5077a12f2997d45d98f26

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Size 1.4MB
Sample260803-csbl6sap71
SHA256 0c291cfa10a75ef440b6d30b095d0c5c434fafe82dd5077a12f2997d45d98f26
MD5 ab845efbdc1f2431e207d4e0717c9657
SHA1 778d3dab3e3331dec4d80b555de625ef4206b8f5
SHA512 ef0bcd061fbb96b5b5152c01f4df7c512f933fcf89c11265fbe8fc99cc15441d68822129d969adb02a726ab515f042dd339bd0a7fcb619b2966effd1aa9980ba
SSDEEP 12288:Y/kgGFtCxG6snYy8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:YcgGFEDsn/8qZ5xpHEilpQJSPYT8L
TLSH
T14565F1203A62C036F5A715768E69D7AE653DBF200F6351C7B3D42A3E9EB46D24E34243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4436	elevation_service.exe
3404	elevation_service.exe
3348	maintenanceservice.exe
4540	OSE.EXE
4172	PerceptionSimulationService.exe
6068	perfhost.exe
4068	ReFsDedupSvc.exe
3716	SensorDataService.exe
3060	ssh-agent.exe
2364	AgentService.exe
3580	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b15566fb238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000097a2599dee22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e27ad99cee22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a10a299dee22dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ae695e9dee22dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ad98edeee22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe\""	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
4436	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe
3404	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	916	2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
Token: SeTakeOwnershipPrivilege	4436	elevation_service.exe
Token: SeBackupPrivilege	4068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4068	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2364	AgentService.exe
Token: 33	3580	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3580	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3580	SearchIndexer.exe
Token: SeDebugPrivilege	4436	elevation_service.exe
Token: SeDebugPrivilege	3404	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 4836	3580	SearchIndexer.exe	99
PID 3580 wrote to memory of 3124	3580	SearchIndexer.exe	100
PID 3580 wrote to memory of 920	3580	SearchIndexer.exe	101
PID 3580 wrote to memory of 2524	3580	SearchIndexer.exe	102
PID 3580 wrote to memory of 416	3580	SearchIndexer.exe	104
PID 3580 wrote to memory of 5860	3580	SearchIndexer.exe	105
PID 3580 wrote to memory of 5160	3580	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_ab845efbdc1f2431e207d4e0717c9657_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3348

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4540

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6068

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3716

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3060

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4b4254e94b8e68ef7a7f304ac685ab047361e4e7fded7021af4a02550936655a
MD5 3a0dfaf4b90db116792cf0a5e4c95ef8
SHA1 a36c1287797f9831a14e707903ba37419cf56b83
SHA512 fc6c70b3146f08a65fa4370e2bb08e35d4ed7c95eea78ab96bc441b6add8be693c948e47ffd86a7913db5017f66e19f41ac5e2b837d6f1a32971a5b83644da83
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhEilpQJSPYG:Z3q6HjBqEiln
TLSH
T107D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 c8495e31b5df671826aab57c736645a808fb0e8013c4d66f94f67d51467a4aad
MD5 617a09667509035d87f03ffe1570a542
SHA1 f8b0227813026bc8a45044e2aab1ee2c1b5afec4
SHA512 3ca79adab6d4b2b304e742379cdd038f324bfdea7c02afecf5951c6bbb30e7d7829f484c4d4ed942090630cdab251b4d1cb9f3002eeb06c07e0b13513b9d9f82
SSDEEP 12288:L1XLsswWkxy2lRq2czAM8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:xXYfDtczAM8qZ5xpHEilpQJSPYT8L
TLSH
T10965F12877E404F9ED678278C9A2C115EA73BC1547A0E78B03E499261F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 38b59dcc9836ec8ccd7caa1187e60aaded8dbe92ee490cb3a26146068b09ba3d
MD5 db32d8b1f1304b70fee9a019fdb406e6
SHA1 0578b88716f4e58cc57b5d8ca2e67e7e6576ace8
SHA512 644654779e6da303fa3836caad4059de73503624f84c0e17516c638bc55159ffafc1e804ec472bc770b1f6e4433659db95b690a350162b9719469f53799f4fef
SSDEEP 24576:V0Le5ji0hmxMrMT8qZ5xpHEilpQJSPYT8L:VPji0AyYEilpQJSPYG
TLSH
T14185AE15F6748335D073C0B9C5D2A68EE97130861B308ACB5286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0a3bd9010be4290a46eb0cff9e4e253c4ebec78e4cb947a3bef90ef43b76bf0e
MD5 316fb6b2c0780b429ca97068e21de75f
SHA1 732f4ac19da0cc7f2c5e18b53a9246c9bba7ce79
SHA512 0ff52f70c981ad107af44c8072ad76f850835a9b2eee4a3b47b8a8b0b5c056167c0dc0f9a8964e83fa2b5abcd549ff5a434385331354a71918396cd9eca8bddc
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuN8qZ5xpHEilpQJSPYT8L:a/ezSC6vUzPvxHjy0EilpQJSPYG
TLSH
T149755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ee4f5f0503f1e465611b3dcfa5445c7cfa960e91503592db844122657f5fb297
MD5 05272abf7781e246e6834f6d86c3a44d
SHA1 e5aca1238e1d30f6439d7f8e476250ad1a1ce5f1
SHA512 69b1a5d3b1946dd8207796fb6ef88260b5a8f89bb8759dd3e23bc81c610b44de937ec7fc0c84f808327d5c5337f4911164f3d776824d5425c59834d0a843f789
SSDEEP 24576:OVbqPb88hv/l+6g8qZ5xpHEilpQJSPYT8L:OVO88hXl+VEilpQJSPYG
TLSH
T12D559E65F5748331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a1a479daa7753e782ec0aaeb76491f50d6afb47786f6c081fa494f2174604b12
MD5 f41e562956f39ecced502805433512b3
SHA1 934608bb14d0fde32b1a2259b604a2cfea4d9b20
SHA512 2cd04e106a2c3315d36326c071458d7ffa1bbbc4cc29ba6a4354c583cab7b75078804ad5ca782f1088f9983fa3e36fc11ee49a57dd06b0bf68a365389d46e5d2
SSDEEP 12288:Pun8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Pun8qZ5xpHEilpQJSPYT8L
TLSH
T17C4523485A54C0D5F79B6BB093C5E19EA8B89E1844D8DE0FB4B07C1B493EA78DC9C863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 085e50c87c3c9eb456b5eba0b888e6f458c16f5fa884b6a0c0733d657485e3d8
MD5 098d7615ca181af2d002d1d876137946
SHA1 55482d76ba31b39cf39e3fc32a942ae45369f4f6
SHA512 ea630b59012120124863a627609d9e8b1c87edafa1dca470fef4978e429ec6b22bfdc93be316c24630580a94b7e3a63ee05b118eb0b805a1f5dbe198125998c5
SSDEEP 12288:+eBNUbTVO86U48kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:+JIU48qZ5xpHEilpQJSPYT8L
TLSH
T1A365CF3BAE28FCD2D27A9DB85791C240E77278304B61A3CBE175820EDE235E45D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e66cdfe92f0d525ae66c1a83bc9d2ec1eacf02ee99866676f69390aab0fac7ab
MD5 b463b50ebe5a039836a12034edf46998
SHA1 29c4590a5b2459b1a39dab6e26f8650ef699cc27
SHA512 f6244042b48ad36032750dc56efcd1d7c959951b002574d6dbcb005c474f131ee6d577f75d39f8ed9ad8183e18a8620bf1960693e12f2cc671cd13e90f772fa2
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:HQvGAdlCEL8c/yRNw5C3Eiln
TLSH
T17E267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 033bdabf6a8607e27e626988355b0a3e8c48e90de09a12ff74365672e6e2ed8c
MD5 618c315382130ca83ed9f12d69f7f997
SHA1 656bb628717deaa97eb46f96701ad0f8e275e38a
SHA512 3e0ed68f78b9bc2734a86820e0ff9bf3e85e4b99234a223a8dac1e97849277ebfdf856d55fe0098d62d19518ed98ce416e99b37d2f56483e3a6bc32ba14070cb
SSDEEP 12288:qAwSfxL/2Dc3uDLLmt0LDQewsAjK8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFEa:/newsAjK8qZ5xpHEilpQJSPYT8L
TLSH
T1FE75E030FE74D036D3BB0DB21B26D71A547CAA204BA11AC3F3E85D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 93d81faf83c8dff5e066aae6e184490ad65f84a2cc6eb627f47badfa6de6b634
MD5 4fb8cef21e5ec9d2f52c7757288d7c46
SHA1 7477eccf133aa79fe4b9d87eca196c964cbba0fa
SHA512 e259396f9aa77f53e00aef0b98a94f71510e1810076e2845922e40ecbdfa9d5c4728d19543e25c78865117f51c7d1857ccef4599e63a03df09d8c81928070449
SSDEEP 196608:9UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHziln:9UEtQevvqc2W1cpV2EI32z
TLSH
T12F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f1f137c3a5efc83052065c9785101dae001e989c8d7c7180fa8cb49b9184ede5
MD5 4a03847016615b8ceba68003606e0b9b
SHA1 2053bce59379d5375548dc6e63507895f85a1b55
SHA512 a59ef3ba6ff94e9aee12bc08ad9382f361a1d6f551ea3dc4b5f023ff198f0cf9a1931bd8b16355478e5014649315cf6c0b1252114a59440f5b0859bb6921e17b
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/zIEilpQJSPYG:9oq2VjnmjEiln
TLSH
T1F3D58D0976B8C1E4D1F6C77886A2C647F37178154B30ABEF5265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 05130a26b19568d21baf83476cefe5881cdb13b5e608734e1bba32f7009838e8
MD5 1ac75f755dfc957cd473d89ee9308a57
SHA1 fa2c3fb49540233ff377de2f1b27b07f688dc2e7
SHA512 24112ec0bcc2796a0d1777123b647b9402a12ce51c22ba86431f1796dcfbad39128238b072a448a02570336bfc77fdae3a7080ded3561dcd357fd39d5a4dd3fe
SSDEEP 24576:CAhGLJIFoiwtA5l7S5358qZ5xpHEilpQJSPYT8L:CAMyFoiq5zEilpQJSPYG
TLSH
T1AF359D80E7F951D4F5B3AAB899B69171EA76BCA95E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 aa1b2a576107cb525fffd6433af36a6828ba9ad05e3de1014a3a265a8f96bc24
MD5 17d7b94cb458fd0a35caec9eed283358
SHA1 476fcf5f5c118423ad108596682bd68d6d4acc26
SHA512 036e920b446e3f2264b76847624dcd61081bcf437748c90d3c6002a3a50d33c367d64be6615886ce47705c460c6c60faf1802d894cadc37053a977132b0d57f7
SSDEEP 12288:Ymw5HEjsChNHBFgl0WDm+Ct8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:VwueOWm8qZ5xpHEilpQJSPYT8L
TLSH
T1DA65F14976A408F9FA6792388687C136F7F2BC012A65DB1F1760C61B5F37321AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 84acb2befb966d952b6e3581222314bfb7323f979084c6b4b10ebfa777e66140
MD5 df53bb4759d03d4f029f889aadbf1934
SHA1 a100c4e06b639a2c70cfcdb50c727fa9ff771dff
SHA512 a5192785c06ebee9e93a5c74837d7187b38b98563f76d32a9c951e9838aae6ca6a336f7fd79f3fe90f3b195309a045326c4373ea001d9925c3b591ed6a767bdb
SSDEEP 12288:uXZ1Iy68kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:+ZuL8qZ5xpHEilpQJSPYT8L
TLSH
T14455128933A460F9F2A76278CAD19249E7B27C1613B583CF2160552B1F37AE55D3CB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a93e4c326441d704236785b3d457cf37ad743c6ab3059b9482889a14cfb0dddd
MD5 47c46367b9bb1f681e3f58ba61a778df
SHA1 fccbf4c067ebd3d626adda49eab1b8b666cf0869
SHA512 f38aeebedbe277a49ff0264d540a728c22fa7db7166d915a8becd6222626a37e9ad07b6f7d11baff598d7b865abcbff0d8670cd1eff5511866a18d6e19663c8e
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:FQRQyi36YOcPQLvw2gAf+PN3uEiln
TLSH
T15F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 94050f8149d9debcbafafea71c920c66599f475f0e9d1633344b411ddc5115c5
MD5 24d93083254bd16c8df910eec580674d
SHA1 475502c2852650d6c8488c2cbfa2176b107de4e3
SHA512 c3f912bd6db997e783816c2a56ffe735344e041f2a5fe1fdbde8e19e6c690fa573596749cabe71319fbd6a22611049898982e9031edd9dad8f3c45a6b031b595
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U+:6QRQyi36YOcPQLvw2gAf+PN3uEiln
TLSH
T11D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 de3c9f82d0b9f8176ac5860d3738223b123ab3f83f2a0f13b8c612b6a75190f2
MD5 d34c90e35536f730cb1417643ba8b9af
SHA1 c56609a4d5c8fbd2868875773a6ab6dad91ed64a
SHA512 c7cc98869cc29ba0a4462bc3156f549cfb3570350e043e6a0906cb128f77de19afaad7db6d8641ebc474181348f23d5b4bdec1ce44a22caf7fe5336cbc7e3099
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0b8qZ5xpHEilpQJ:168Qg55nhheWu7PNU3/YEilpQJSPYG
TLSH
T129B55933B2F200A9D44DE1769F4A973196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f160bdad32d00026d96016760696f69b3d0777e8f1f5f9f056f5ad1381427cef
MD5 e7d69457281a59ad2884db5f11ebb0c6
SHA1 659267cdbbc3326c224dd43e378ba920737bf814
SHA512 03c1df519ebcc3c3c728aee073e54bf8c1aa26e712ce1e672c2b5616b776b37c96253c2325cf79aa6b2c1d86485a5da2de2d3e92a9358d73b856dc513440f14f
SSDEEP 49152:u3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99M:Py5112gYy5azzVvL69nLKnhZtEiln
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 51e74e08863af5818f157638952838c52440a4e860c00de9c966d3b18681ef54
MD5 71d7874a0cd04de377551d0bfd94400e
SHA1 140a4026f5b098c66e87a9f44b26758ebe45a4fc
SHA512 2f84db08599fc2a1dcf416c026b15a196af4cdf4f07dc6ac67bf6aa414d3ed9cae5f6a648e9503f5036ddbe67076d7312546a675ef87437a81ec5ac5116ced55
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glBEilpQJSPYG:Su6JmVxd2dBEiln
TLSH
T15BD59D13F1DA01E8D06ED578974A9233FA62BC490B34B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b264233aa086dd343885d27303a31f2c436997c8b4c48a519572d29d76adca32
MD5 f7780e0d94a87272a58b9b1f881c9475
SHA1 bb96ae4c54fd012b9f4e5eb757576362473c95cf
SHA512 f74304374205c227d74422c3391bbfbb79aa0820e8b398836e9c1054ca5233515c4661f84d935d34de691153dbb2c9eb180cbaff5203616a1c9c7571167a0046
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4xiEilpQJSPYG:lmifPbRjEiln
TLSH
T10BB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B6961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6ef8a1691d1b221955b53e9399bc6f10f29d4883c84afabde044ef81fc5bd10f
MD5 3c724ca04768564aa85c947ad45dfa65
SHA1 0c1e43a7c39d942d1c0a3775829914f187e65bfd
SHA512 cf781f2921b06f176e478ef2d5d68b07af31fd7517b4463070ccc89971eb30902c2e3c49f7cd4e3cbe8f78712ba91509268c63a572af9b0768053d14a99a9874
SSDEEP 49152:cSuZQIY0Be2KRRVtOnks6NMHqxEilpQJSPYG:e5dKTi61xEiln
TLSH
T1E4C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c639258bfa8d5bd09da2a1dd6f4b7a9adbfee11962bfa2bb1e1af1645cefb07b
MD5 2424c8b34df11eeda542a42cef686dbb
SHA1 4dfb11e01aeb55da7f362b6a3b81587fa709711b
SHA512 d24d7677eff49bdbba84e6cd9a5707badfedec03190ca096836eebb9bc0e9fcfffd0edf6b33ecd0c5861eac9fa013483acca5313fa34f423586c70613fc127e6
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5wGEilpQJSPYG:tX2iyphvEiln
TLSH
T16195BE13F2D900E8D05ED178C7468632E962BC150B39BAEF0A90B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8e5561599a5512867894b3202ac10f752d4c98e691ced7a63867ac717e1643b8
MD5 3b45a93f6ab88604612b35166bf3b1c6
SHA1 172c334276d5a92fe2addc0d0e80c4573e07da26
SHA512 98cb74c7abced462b3c198b1570ca09b467a5e788a675963c254e69c1364e95a12638f124ccebc4253f789d7bdf38e02853fb8acc4e7281bfa698ef977ad79c5
SSDEEP 12288:k/8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:k/8qZ5xpHEilpQJSPYT8L
TLSH
T11945234C6964C1DAF74BA7F0C3C2E1DDE8AC5E1C54D8960FB5A438175A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 59f7e1ea36aa127d8d46f99d0a1a2b2e2212acf42a2cb0aff86f6c5a3e0fabde
MD5 11d12960c3590ccc8f28aae7b76480b7
SHA1 0ba42e2bbe5edd3f035f2eb0d3fc2eee42c16260
SHA512 cd02a1fe6ed7a4d795dd6aad85734261b63cb4e6da13b6661ed12bbe7fc4ff822ca491c2a539ae0d010289628a06c000e1ae450315e019bfef4de41df4dc64bc
SSDEEP 12288:IO8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:IO8qZ5xpHEilpQJSPYT8L
TLSH
T14A45234C6964C1DAF34BA7F0C3C1E1DDE8A89E1D54D8960FB5A078075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 71331dde1eee56a33ed731a6988e2ddde2d16bbee088880e88d90e77faa1b715
MD5 8906ffcfc3cb886ac5b41ffb482219f0
SHA1 c3e2c2b715060f6490e704577bcdee50dfc00b89
SHA512 31a52f2cc57b8b204a82c95e7cbfef217e513f1df971a4db18453b0782ce73660b8ca405579ff74d0fb8c9ad4c9a9df258905b8aa4e7c5e5c2a238a951fec1c4
SSDEEP 12288:1w8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:1w8qZ5xpHEilpQJSPYT8L
TLSH
T1AC45234C6964C1CAF34B67F0D3C2E1DDE8B85E1D54D89A0FF5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a939378966e85fc557272cb272b3bd2503adc0c182a7fd7a77ea966e20524eb4
MD5 2331c00934df4d11d3edf6415f35739e
SHA1 f829537bb39a5819c1d8d29883d9fe19978ecd0c
SHA512 92dd250d3eac49a960c137bed2ab2c4bc920b576444fd014698437b317584b453d0038f17103279992739faef3900bcb30a5978a222294f37c41390218f68cef
SSDEEP 12288:6VZ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:O8qZ5xpHEilpQJSPYT8L
TLSH
T16A4523082B6880C5F657E3B4C782E19DE5B8BD1895F5978FB5602C0B0E3A7B85C7CD62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5502fde80c19628a41c1d225dc3737f38f9f30567f6de58324799429310ed2a3
MD5 9413f3e8b5ba167d328a6607f5244bc0
SHA1 fd1302d5e3a89145e838a266bca8f99e018d178b
SHA512 13b7b32a62d528ffb0a8f2b4f2abe166d416343a4906fd57efd9ddb934c4fdd7843063b826d473d1e8e6b21819b6051812918536b13ad3def490beb0af740833
SSDEEP 12288:oB8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:oB8qZ5xpHEilpQJSPYT8L
TLSH
T19C45234C6964C1CAF34B67F0C3C2E1DDE8B85E1D54D89B4FB5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a949caab7dde50067864a512fe985c07460876b5de2ac2a729beca8f714643b7
MD5 d588a9003520450ad7b0aa42ef720f8a
SHA1 983e52d5385143a5052ce00a4f6c5cfb1fd769e8
SHA512 663f3a2b738e624a86a94d088643837ee4d7e006d15dc3f2a68219f12c8306dbeb8af318f1a7992e9ed69f8f7d7a092e3a2671f0e63ec649e1be25cd37a336f3
SSDEEP 12288:hC8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:hC8qZ5xpHEilpQJSPYT8L
TLSH
T1B345234C6964C1DAF34BA7F0D3C1E1DDE8A89E1D54D8970FB5A078075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9050dbe7e63683985ec33abe6621ed66b0e9c89f14b49cdbafc740149bd7b03f
MD5 1043b5e79522778a3ccfca3111766080
SHA1 cb0733fac9c4f039a00e589de7fe4c6aa95496a8
SHA512 445e2e3dc740a16d7eec18842013877e582e4362abc1abbbf632e5c7562172b7b40fbd543e00065bf0d0f103fe608228aca97f904f2a38609db8dd97b4b6a6ca
SSDEEP 12288:c28kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:c28qZ5xpHEilpQJSPYT8L
TLSH
T13A45234C6964C1DAF34B67F0D3C1E1DDA8A85E1C94D89B0FB5A078175A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f8b3d96bb16cd26648b3331dd556fdb59f6bf59536959a588cc7a8e8fec5d843
MD5 51b94944cf1022257c16e6c0dbb3d787
SHA1 17b788b1c222a043a2d689dc5e36936a9df85e28
SHA512 317257c4afe602e71bf2a6643f862869a3bd4aaf1750efe06ff7ce44e5177e15ea295dbdb6b68551c071a052aed35ff112cf23f300d1b5175aefb06f04f8d5ae
SSDEEP 12288:ciZwbQzzFEoS2cPvyu8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:/ZM4zFVSOu8qZ5xpHEilpQJSPYT8L
TLSH
T1BE650198B39048F8ED67827ECA55994AD6B27C1906A0C60F13F436275F373A11C3DFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 87d6db6aa29294e86aa816deb8b1efecb830ba85a373475ff9b23a7167eb59a7
MD5 6b5cb7ff9aea65feeb5bf657b6bf3c2c
SHA1 82770370a17f47f9a6ec49b622ccddfe74d1fd27
SHA512 9f582214acd0019653463e8f32acdd55d0fd16db13ababf42e23594e1fc32ac3671631d73e9cf704abe667b2f66bc921f858af509fc68153b0a4198f7122e9e9
SSDEEP 12288:878kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:878qZ5xpHEilpQJSPYT8L
TLSH
T15E45234C6964C1C9F34B67F0C3C2E1DDA8A89E1C54D89B4FF5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 69920cc148d0c8c5af800bc908f5a1a033570bb6263f587af72b69c771b218e1
MD5 f6e8e218507dbd84d42ef3a29a8083d3
SHA1 60815d25a1e942f167c627780be02d27534a9eab
SHA512 d8d0d212502da94836b1078fb9845e3e13b4c034deaea5c9995cde489af54060a8fc27b6f972db3869c5211c0ac6be5ed27e033712d133a05f8635cfb0f9abee
SSDEEP 12288:8X8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:8X8qZ5xpHEilpQJSPYT8L
TLSH
T17C45234C6964C1DAF34B67F0C3C1E1DDA8AC9E1C64D8974FB5A478075A3EA781C9C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 673cfce15005f5cbf7c692eaedc4c7bb24de9fd215081d83f6225ba13c9bd518
MD5 8b39ee08e5e4f9cece20181ca6f358e7
SHA1 cf59d905ef58caacc38d023bcaa8f29f5f08b8fc
SHA512 6a391e3756b1476ce1a1facf8f4bb858d46224f7649a4ff55aa9899a6731fcf004d82d41fa331e7d2b1f1a14b31a7cca32b1c814abed61a764c5a3e8aaab1f09
SSDEEP 12288:/yPz5L868kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:yzy68qZ5xpHEilpQJSPYT8L
TLSH
T1EC55120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 035c1709dd4b7ebc03ceaae5e6fca086b7d124a50f58d60c3356bcf7dc342a01
MD5 a920d8ae2a1c3b3eb6040cc6537c6b60
SHA1 a4e44b420847395ba436b63fc17c5e754a959d2e
SHA512 f679d42e1ec9be4ec216b31be418af169bfdf51b05b555877516fc7515b009157da10fc4fadf815a968c387d4019f559699c3f61d74415c8cf4a5311a50cebfd
SSDEEP 12288:A78kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:A78qZ5xpHEilpQJSPYT8L
TLSH
T1F845234C6964C1C9F34B67F0C382E1DDA8AC9E1D54D89B4FF5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 051c5626c4e3e7daf8ec0adab7973ece6be8837dfcd4c969e247e085e44d200c
MD5 f4909caa34b419e974f7eabf0a59a2b0
SHA1 5280b6b582569d91e09319bb91127fa592e28466
SHA512 ed20ee92b60afb7a93920554b90a317510961abc0dd350d36cd13eec472b6cab4bb027fe934bd8e9c843c197c3d07f8216d3281f0e74b4383b4b2078686058f1
SSDEEP 12288:P78kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:P78qZ5xpHEilpQJSPYT8L
TLSH
T1F145234C6964C1D9F34B67F0C3C1E1DDA8AC9E1C54D89B4FF4A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 f6ebcf915da3eec970755397ccb95e2ad71a375d2a2b5cd86084f76e58ac6cbf
MD5 e7b99314ab75ebdcc854bf1a171e3d68
SHA1 f6e1093892ed087dbd15a21bb3ae1253d8c79b08
SHA512 e48f629c86f753a9119a994814fb08cc01c53213680a0bcb97d8737595e15d312a28690e6bd9f548ad8299aba4dda275bb2c246737d259d69d51ef8a5d55e6d2
SSDEEP 12288:lyPz5L868kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:szy68qZ5xpHEilpQJSPYT8L
TLSH
T19A55120B73A020F9E2679274CA925646F775BC3507608B9F63A016372F376A09D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 08127b07a7b26ef730a129cb69fb744cf9612aa7bfe23d243cca5d3624fd1dba
MD5 c285165f858b84f2fa9662b8cfd1798f
SHA1 4fe36091e2e83e090cf542d67d1ccdb4f2ba73c5
SHA512 fa22d6ccd246a7b7d6d7bb0740612686178651147df73ab3d4195a1a045d15765c3c116ba8f153a77761e265136d3c04f115a12ea33f61e88f30acb643ec334d
SSDEEP 12288:SCd9wWYoaLHF3z0z04PDvhA8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:zTpaLl3z0zDA8qZ5xpHEilpQJSPYT8L
TLSH
T1A0650198B35058F8ED67827EC955994AD6B27C1A07B0C60F13F4362B5F373A01C2DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f69144d827aa8977a6b98121df6118d4fdebd2a3b674067fa4c3275bf006fea5
MD5 b11630027dc7ed0bf9b499438cc70e9a
SHA1 2382c7510534ed0f75781e768d1740ee393cb4d0
SHA512 0b3a5b681e50d076a5a17d86ee294e37898dd7b10eca538e4a9db6047f9728473cd802241cfc9780668adaaec70ce06ba825aa409c715e080a2aa7faa9501c01
SSDEEP 24576:U31d9CHKy7GZk8qZ5xpHEilpQJSPYT8L:e1d9CHKyaAEilpQJSPYG
TLSH
T1D575CF90F3E410E8F1B79A35C9669512DAB67C591B71CE8F13A4251A1F33BE18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 61825d89237631375d13b723cee6954204912456b86fad88d40d4a516bec4f40
MD5 071b94d2c3c6e899c77c93ee80f9579f
SHA1 740766a1d3cf3e301d41d4597c4655dcccd92cf6
SHA512 53dbd7f0c494d5a6122dd0e1b5a3017f321f5575750f47eac2d879f0432819a55cd514d280b82ef9b50111a2bdf8a437576dc8b0a77e1e9e6775db92e1dadb92
SSDEEP 12288:vQ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:vQ8qZ5xpHEilpQJSPYT8L
TLSH
T16F45234C6964C1CAF34B67F0D382E1DDE8B85E1D54D89B0FF5A438175A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d266b8a660e4e7d6b72754ed8bf1b91cdc410e2442ab93931e0fbb104d52d5d7
MD5 45deaa04aa99f2ca1d3c1824422593b9
SHA1 dbc4ef3362b2c7dfe7f6c9e5394ce144b0911888
SHA512 9023cc417a738704215d259e44bb8bc0e940107806d393639b2a2f26281b2d22fb48880384acc64184c97a60e9835305de3330214989b2682fa91a12a6713110
SSDEEP 12288:xa8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:xa8qZ5xpHEilpQJSPYT8L
TLSH
T1C545234C6964C1DAF34B67F0D3C2E2DDA8A85E1C54D89B0FB5E038175A3EA785C5C8A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1c1a30a7b2b0c92339ff538c6ef326911f3f9933cbeeea67cbd79aa820ebec57
MD5 662033adcd40d40f8db4b05e43e11a76
SHA1 ab08efdcf99cf8f82e3db0521bcc88dd6ec7d05d
SHA512 6d11da75c8f13a13b6ffef344e4e270751070f377e791eccf02ed35399e67dc0073ead04e226fd8d6d427997e63d1ca7f7e886975cea1ae3abf78f278950f685
SSDEEP 12288:m18kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:m18qZ5xpHEilpQJSPYT8L
TLSH
T1D145234C6964C1D9F74B67F0C3C2E2DDA8B85E1D54D89B4FB5A038075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 119d4a2d7b577ca65145f807cc27f5f6284093020a6f7d04ef47141c6bcd8174
MD5 442eb3356d2442eaffcbdbb891b64757
SHA1 40878b8bee033087a08296c798bb77e05e9fb673
SHA512 a4d0f25c8990fa72122cbde633c8cfc9a37ff22af79c06a20f39cd05f1c1482ae261069d666865efb8ba66936d66a289de971ed03dfb70b836b33be9bf5058ea
SSDEEP 12288:578kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:578qZ5xpHEilpQJSPYT8L
TLSH
T1A745234C6964C1D9F34B67F0D3C1E1DDA8AC9E1C54D89B4FF5A438075A3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a60195071e7710270faa0ae2f8176392104339e12eb7964b0e75825c4071b561
MD5 ef7b1584085e06e57d205780886fab09
SHA1 fec107256e3a19fd7a25930322b8c5d7f1afbd8a
SHA512 907377d54ea301fc6ee1fd7fef73caab9e03d10aa25e93f1589894554c0539c7d23a38cbe03180d9fa416dbd2dbc184cd7bdf2ab32417cbbfdbf6ebbd140eb92
SSDEEP 12288:PQ8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:PQ8qZ5xpHEilpQJSPYT8L
TLSH
T1A645234C6964C1CAF34B67F0D382E1DDE8B85E1D54D89A0FF5A438175E3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 137f1c4897cbce3dc0d64ac9623acbf87767122260c46cf901ddf965df8b955d
MD5 44e8dbeb5edd5b74b6f05c28501ff483
SHA1 bd7a886dfe10936df4be8cd8240f0faa68716089
SHA512 04c5d34f9b65de67aa5a8f5c509ab41ee7287d6e2c0730dec938a6bbe167dd1da16be3721282aace11d07d9b0fd21abf4bd985991f278cb30025b23b6b71c35d
SSDEEP 12288:Mj8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:Mj8qZ5xpHEilpQJSPYT8L
TLSH
T13F45234C6964C1C9F34BA7F0D3C2E1DDA8AC9E1C54D9970FF5A038075A3EA785C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 76689feecb4162ef011412167188b113d0bc649b15ff5c788a371c8a94776f34
MD5 0e4b711849ad0ab179774ac82b96083a
SHA1 168f1cf66444bfd4755d633796adb177e2b9368b
SHA512 3e671d0dcadb563dc64a03bad74efc474d1075e90fd89b6213ecc623433ea4e4d2089baba6f70d5af01f5e56bdc00151f42424971a4ec19e069d8f007b9fb2f3
SSDEEP 12288:lB8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:lB8qZ5xpHEilpQJSPYT8L
TLSH
T1C645234C6964C1CAF34B67F0C3C2E1DDE8B85E1D54D89A4FB5A438175E3EA781C9C8A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 4bf657eb8c622542ead6d23253399ea2ca72aa2b25fdcf65bce47c874b4904f6
MD5 b81ccefb08d77e5c2ea735c0efdc8b0a
SHA1 6d6c60c797bc27dcb1e4126cbdc2652d5a1e9184
SHA512 693a5254c07370ea19e4dfff1d2b8ee1508178db7238d6c7aff69e5e94fbecdcbdbb67837a884369a5b2d45b7df8055bc8b4361795ab37b16442a860e3ee575a
SSDEEP 24576:1fwvak9RX6wkyAIH8qZ5xpHEilpQJSPYT8L:pMnYINEilpQJSPYG
TLSH
T1A185D02DEBDC44E5E1B7923C89A3460AF6B178281B71C6CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a36eb3570598e804ae7665fdd02893517e400834bcda1ba6159fa9c1a2082564
MD5 f07088e7d1f092cf6d164f916c003a90
SHA1 38f3eabe6c0114c0699132df241a5ded4a130fc3
SHA512 e9eebccf457adfd3e9b3a54dadb066767e56bff6bae5e937a63eefcd31b5041a59996e51891345c5c2ddcf093c6593f6507cd0e5f0baa4a19726830ff4a8464e
SSDEEP 49152:jYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0mEilpQJSPYG:nySzPOEiln
TLSH
T176066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f9c501184520fcee1305a2c0efc34336a7a35b4d32099b3a4a7626dee6b4b8c8
MD5 7a4c3f05db5dc5e444cdd4309b5a6d61
SHA1 5234670d08999f027927a3f0057d84f73371b109
SHA512 c3da82279da30d265cdbf69ca1f866476abe5fb655ebdd11e9466862951383d93d8358844c3ba4640fbe901ef28433dc3b46d40a876817854aac47bd3af9f2b7
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYe8qZ5xpHEilpQJSPYT8L:i47JUQj1irIhCnDHUPfF/2EilpQJSPYG
TLSH
T1D865AE1DA3EC01E5E1BA927885158A5AEA71782D1F31CACF2270827D6F23ED45F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 b4822baa445ff91f8d417f3a5bc29b8140f86d0c8e300e41c4edbb1f0917250b
MD5 3a425b53c7baccf5d7eb826e4bf13575
SHA1 06e070e4703e0be01bdaaf1d0bdd5bb24eddafae
SHA512 a91d56059746609ddc02e4abe5627860fbe8b95985196972d1a4c493557a21d4eab9e765310ddbae8c67b2b709b9b269000c501a28c31ae4d46653e79473a422
SSDEEP 12288:cnsfL8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:fL8qZ5xpHEilpQJSPYT8L
TLSH
T1DE55F109D29842E8E16E6275C7829645F3377C2583E1D3CB62D0F83F1F3A6A45DE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 dbff5059478a9cc06e56c610638648102a9b82b7a7d5e63822759b3edde2472d
MD5 cef5ba80b54fa90431014f17b33cb57d
SHA1 611b89279256a1fccaf21c56412d2735055f4570
SHA512 59d375c85dfff3dac08cb8bd6fbf17eff4877a4ffd4847f9ec06b32df6645f9a28e78a8dd3caf7450c9de6f37c57e7049d515f7ea1b9a713469a382757b7c0f8
SSDEEP 12288:rcjmoqy5EaVWTVFVnL+ThZK32zBGKBnokGKARMPU8954z:rcXq7lTv9SO32tGwnoRKARMs2
TLSH
T1A6552850762BC75FC6A940325E33D2CCAB707D05EE456F0773C8873F9576668BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 2c634252aa6b66bd5865a875662b745aa2727d2ae0fa6963f8e920408004eddb
MD5 c87d399c89123b7ffc10e78b695974ff
SHA1 680ce99004187a0c67df7841da2bc04160baa1e8
SHA512 02f78a529f20d15a64f3d6edb9707d8a0ce5d962d56ca76bb96563682b95268d018cd0e30996f1a3e979bc9948aec6a776542e8dd5d3d447959d19aaaf15a142
SSDEEP 12288:pV0VUyViVFhV9kID+EVSuniF+VAnV9VTVM7V2V/Z8Q/G:nTD+tFre
TLSH
T1C665E9819137A38FD1FB6032073A9B4CA774EC02B7056E16B3C8053AD86A765B5F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bdbd459aa33e2f406e6a482332d2ba49cc832e9fedccef7ee390e567ce2afb05
MD5 7b6e9b5c6342a9b1bda2d0b39df9bf6a
SHA1 f85819c1433f1ff4e4a68dfa5be8ca514637bd17
SHA512 110139d188c0dba8ea4dfef67383b359e63702d1d1a6bd38a95180f1fb5d929917512174b2a609c3c329475588528daf999f9cc5344f32ef14d66f58a5868bfb
SSDEEP 12288:bH7z8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:fz8qZ5xpHEilpQJSPYT8L
TLSH
T10C4523089758C189F76B67B08386E16DB46DBE284BD4C6CFF450380B593EAE84CBC853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0bea489366a150fd15bc1d4eeec6e9b44d42c71ef5952231d89a8b9814ab098e
MD5 17ad00a87ca5e26d9df584d4c9162c61
SHA1 228aa7724bf6855afed6b4499cbcab24e0d564b7
SHA512 abd52e6ec34df497d97d453f7611d4fd17fad0095726d7c3fa3f47041ab016dc9bc55a5c7673d49aabbc7b0d25907b5f4d24f7adadcfafcd935f7e164e7e1db7
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYN8qZ5xpHEilpQJSPYT8L:egb4mBIBhGF8EilpQJSPYG
TLSH
T12E65AE1E22EC02F5E1FAE2B8DDA64417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 497515d83b6d1353a2bd114b8c1ddaed9d227f5fa5886ad967cf904e5ac48db8
MD5 142fc0ca5745fddaf38ccfb33e8dae59
SHA1 620ebda6a954b45b34752aa498469fb802c494da
SHA512 73351c942a4ccd2d03a7eca78e42423590221838ad98ed1efc381362e5a367e0fc20dda920e81012e28ac32378c06aeacf090f569344d5528c12b0218684f81c
SSDEEP 24576:FG88u8FpJqH1Nzria7/mu8qZ5xpHEilpQJSPYT8L:o7ZFPqV0a7/fEilpQJSPYG
TLSH
T1EB85F26577E001F0E477D1388A824667F6B1B8250364EFDF06A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4c0852896e58af2e7a80f0aee06cab2fcf657ae551c78164fc9f80bcf22df829
MD5 1516a4283c74d2bb254864d66c3df5c2
SHA1 dd01fc063d0eb74d9c72676c29ca482cd008a71d
SHA512 a713d0677091f0d777134a374be89a6362c505011064d66caf4734169ab737adef267055aaf2f0b7c2a95f54be380936d68725f3f165d22c4d39ea156520b9e3
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwEilpQJSPYG:2G05lO43blEiln
TLSH
T1C8D5CF6E62EC11F9D1BBD17CDAC6460BEBB23815032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 46360b6bad464349741a27c821ce05b4eef5d54ce63dde054f0df7488272ade8
MD5 a1d3fd5ad4f662c52dba276d29b8d921
SHA1 ef02e84661cdbdc2557fada4596c5fad5dde8280
SHA512 083264e3ec3d20b85525f0cc679a096c8ed3f61f7127911ee9841131cdcc6e71777b05b946c8c9d853f80e4067f870f98cac1a113ddf40e798955baea51b8887
SSDEEP 24576:4fa5POZ3dpFWVM50JicR2hG0lasx2+47eidns8qZ5xpHEilpQJSPYT8L:Aa5POZ3+Jt2pasx2+mYEilpQJSPYG
TLSH
T16D65AF5DA6F801D5E1B9D17CC683861AF5B1342553319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b4faa2f9523591911fef6966a76c87e58168107d9730ab13bcf68d7a4e041756
MD5 ba00bae9f628ba4ac442f00daeb9fb45
SHA1 4a68ebca9483251b6fb74b5e70ecddf9cb86436e
SHA512 4efd1caa84b1fece11c31261471d8319d488c2fcc6707bba9c0f432e6190933cd6e7052a0ec46bf7258968222941d8a0f51abdad88d0a24424b038e2b8c475bd
SSDEEP 24576:lNcwHdjbyQ4nLC18lb/EOjowL7FkG8qZ5xpHEilpQJSPYT8L:lNc/zEOVHF/EilpQJSPYG
TLSH
T1CB858C1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 36df84ac7de5597682c88eb209d812cd1954120a8e31fb4a10845bc70aaabbce
MD5 357cf83c4e8c566a18c7477abb5e01c9
SHA1 f7acd53b4b86dfaf83acbff6c57d575cee8e160f
SHA512 d1ee0405f2ed22c26e78fc3ba5f3b772ebf0e58cc1c47540d3eb720f96f7666e8bbdc7fd9b052bdfa825cb50ca8d5b8c8c3d40f551fdf9fea85496860aaadfa5
SSDEEP 24576:K8kNvNnaFeYhJNtmZBmP8qZ5xpHEilpQJSPYT8L:K8MwBtOmFEilpQJSPYG
TLSH
T13655AF6EB6B845E4E1FEC6B4CE238516E6727861073293CB5290C13F0E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3b48a2548fa15e257444828fe82fa030a325fb34ff0d8467e12b9574663acc97
MD5 aedb27374ee27b1eec5c79f951276ab2
SHA1 7297727a856da0b64310bd11471aa00fcde562d8
SHA512 b372f606fa8507cc4189b3a3adec0eb924ec740920df676fb8e38a5f1cd9db14f73d2cace85f7655c87b48f4a288bd31c017d40739b3a5ff72fbfd1aeb125029
SSDEEP 12288:0HvUrBFrEjwaQy8kUMZln7b06LAufpHTIq4ClpXgPhyDPYkFE8MxHM5:0PUr+NQy8qZ5xpHEilpQJSPYT8L
TLSH
T1AA65E11E26A818E5F676A17D8682861DF771B8660751D2CF02E0813F4F27EE8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8dfa626e7b8052fdc5b96d8593a9c1f0b0e920106f467ac0b45317e6b8a2cff4
MD5 3c8c430e44ee1fb3f16623910d8eb1d3
SHA1 6ec3437f6cf26f84fbea7750bfd2cf68e957b0f0
SHA512 aa5467a9ea830189ae5982120d48b71dc901ef7fdc7168d7fa7c0b88f87b0c81f1baf3f6aa0092e8dd167eb80f04b1f52fa27b40b8bb1e1acd7c58e72cb4fd3d
SSDEEP 24576:bD3FHshBIYQgAf8qZ5xpHEilpQJSPYT8L:bDVHeBIAA1EilpQJSPYG
TLSH
T1EE75E17DEA9C00E4E57BD2BCD6938606E67138AD036156CB12D481BA1F2BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-14-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/916-7-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/916-6-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/916-1-0x00000000023F0000-0x0000000002457000-memory.dmp

Download

memory/916-0-0x0000000000400000-0x0000000000574000-memory.dmp

Download

memory/2364-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2364-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2364-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2364-137-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2364-139-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3060-123-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3060-316-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3060-126-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3060-117-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3348-54-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3348-51-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3348-43-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3348-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3348-56-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3348-42-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/3404-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3404-31-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3404-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3580-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3580-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3580-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3580-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3716-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3716-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-317-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3716-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3716-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4068-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4068-98-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4068-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4068-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4068-92-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4068-332-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4172-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4172-311-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4172-77-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4172-71-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4436-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4436-25-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4436-17-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4436-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4540-59-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4540-65-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4540-288-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4540-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/6068-82-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/6068-81-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6068-87-0x0000000000940000-0x00000000009A7000-memory.dmp

Download

memory/6068-313-0x0000000000400000-0x0000000000535000-memory.dmp

Download