916e9c52b37d099f06b54126827b6ac1ad0f3e279f7854f6c2802adcfb4a0e83

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Size 1.5MB
Sample260809-vhsf2san5v
SHA256 916e9c52b37d099f06b54126827b6ac1ad0f3e279f7854f6c2802adcfb4a0e83
MD5 38f8eeb4550b0dae584573213e711ad6
SHA1 f3c08b62936eaad19e53395fd3780233289e6e49
SHA512 307ed3c1571330a73d0dac53cfcc3f0f8bd54c5c66a1b937cda5e322fd82f3a1f0d038132f574b330b1bca6686ceccbcc82a25bc58dbfaa64e1903d50639777c
SSDEEP 12288:xLC/r42uHzCFxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:x2/r4zzCTnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1E675F1203A62C436E96705768D79C76A563EBB201F6352C7B3D82A3D9EB42C24F35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1844	elevation_service.exe
5444	elevation_service.exe
1344	maintenanceservice.exe
2920	OSE.EXE
1084	PerceptionSimulationService.exe
4492	perfhost.exe
616	ReFsDedupSvc.exe
4944	SensorDataService.exe
912	ssh-agent.exe
4064	AgentService.exe
2280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\32ce4573e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ff4b35882028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6ab22882028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef3262c82028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000139531882028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000092d94f882028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006d558892028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af458ec82028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe\""	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
1844	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4612	2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
Token: SeTakeOwnershipPrivilege	1844	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4064	AgentService.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: 33	2280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2280	SearchIndexer.exe
Token: SeDebugPrivilege	1844	elevation_service.exe
Token: SeDebugPrivilege	5444	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1744	2280	SearchIndexer.exe	100
PID 2280 wrote to memory of 5700	2280	SearchIndexer.exe	101
PID 2280 wrote to memory of 3084	2280	SearchIndexer.exe	102
PID 2280 wrote to memory of 2112	2280	SearchIndexer.exe	103
PID 2280 wrote to memory of 3536	2280	SearchIndexer.exe	105
PID 2280 wrote to memory of 1168	2280	SearchIndexer.exe	106
PID 2280 wrote to memory of 3664	2280	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_38f8eeb4550b0dae584573213e711ad6_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2920

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1084

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4944

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1744
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2856 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 86c657770a14afea78fe0a3a5e2410e10b771a96eeeedff5ed77f017afba55e1
MD5 9ba86984c89b7c2eb3c317a3fd8e0064
SHA1 bd0ed9e24edc481b9412875ee5ae759b3c08fb06
SHA512 1fc35879765cc309ea9efaf431f699ccdea8e07bedf82f6e9451dd7c0d3397a4cb0baa042b0c159b7bb03e22bd9659e12c855df4cca849034ec14ff11659dec3
SSDEEP 49152:+b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnfQ/lFTjN4:A3q6HjBrLm
TLSH
T128D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 719e48aa72b03d9f9a983d5d381548884dad27361ed343459523276dd3d603b5
MD5 41d0c54767fe013e3bdf66e9579eb5ec
SHA1 3cf3328f3a1b185b6494d40661ce0d89a8dd3fca
SHA512 8d53eeb3148ba4bc74227c721dbf2474e8e3a9bb7bcb8482c871f7dc92254e15b65cf30e33dbc36e64f90cb541fbe946ecd139801c02ef3dd7579790ca1b511c
SSDEEP 12288:Y1XLsswWkxy2lRq2czAsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:eXYfDtczAsnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T19565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b9b98b193b203eb25c9085828909603eabafdc77749209ef86117d88102654ee
MD5 68e8b2cfd5cec7b83db33699920a349c
SHA1 dcf01fc248ec9c810c462da43f3c0386b5af66df
SHA512 8d8c2bdde51de2d214f848cbcac993afc4c4e83a466f9aa34c604c2996dd474ee39d3abb9a748e4b4bebdb4e7527de957c3795a8c7f5e9656d93a5643f6fa0f9
SSDEEP 24576:m0Le5ji0hmxLrMHnQ/tbw/2Mkjy6Fr7g0oI:mPji0AlSQ/lFTjN4
TLSH
T122859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 be0cbae83baf35a085536a533d1c0b56a1d7ea466db8a528b33402234f4a9241
MD5 3f5b3d307c75653c09a0a123ab6fe6b6
SHA1 d2a77e2f89e7795b4a733d1bc9d5b749a92eaa67
SHA512 ff5cbe3ed224bcbfdcedb19e24bb76683b7faa910301622e60c8769cd3d473df47417b4a3b14a4974f9a229bafbc3cedd17b7d5aead35f91ed8d0b26eb2c57ca
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyuBnQ/tbw/2Mkjy6Fr7g0on:e/ezSC6vUzPvxHjymQ/lFTjN4
TLSH
T1FA755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4419d5289c4fdd16977d8c91a1f9b6b2e3aa697bbc3eba565f9d3b040fd4325f
MD5 fc05d660044e57a207c93f88919c6fca
SHA1 aee9161cfcf754e218ac03eab0f2f941f566a85d
SHA512 94ab79341133fd07cf0b7e062fd4725665e4ceb3252d887ce412c14334407ba007c959dece6202c7735960993ad0545002016b0add5557ff3ec42e414b3b644a
SSDEEP 24576:4VbqPb88hv/l+64nQ/tbw/2Mkjy6Fr7g0oY:4VO88hXl+bQ/lFTjN4
TLSH
T1DF559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1e1e035593948a71d064a0d770121a28b5f8a20a7542eac9fd277c5b1f225c75
MD5 ae48f186a79cd9d68345f95d44f79a9d
SHA1 159dc0c784f22a7bce3a78e65dcde11df1da5f07
SHA512 9f76d4fd5aecae20327fefddda20f5bbfa820583b027944ffe154563da9ca2e9212486760df79591adbf2be8bd4b900d8d872f699e6b193f6cf2dde7b6ad9f13
SSDEEP 12288:hzjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:hzTnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T11A5523796A24F897FF2B06B15C8284826B7B0EC1BFD4E74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 be849226166f63742a1d46fbe5d0295a260ed0a127dfec90cad00a9ac828d04a
MD5 20092d1982b1cf4cf1bee6169c0701ce
SHA1 a374ef2f82606d813664fb8ec4b6f17e8cee2dc7
SHA512 159decca7e00d3570762a2483d1537917afe40c2d4ca6e3f5020f91b772c7fb5bf6eed4fa5d6e911968a81bb28923a47440dd9d3d7161ff9c64ab240c8b74242
SSDEEP 12288:deBNUbTVO86UAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:dJIUgnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T17C75CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6bad3d4fe8e38c5d1fba5da69d53c40c59af4c24d9798480866ae23963188028
MD5 c9d2b753ad8215c04ddaa956b7fb600c
SHA1 2970dd0a181a0e62fdca67ea5fa4ba22eb33b832
SHA512 945114e62095aedf26edde7267952bc0d172f3f9d02152fd133869b7452160410f1ddd483a0d7c502059ccd063dd2bd4d7bce25ff7cee8bf8e4b4bcaf2b07e17
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THe:EQvGAdlCEL8c/yRNw5CWLm
TLSH
T1DB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e5018e84174500c6d540a366ea4b344e98b4c89ad4d334519fba5ecf2ab0bd07
MD5 4f70bebc09c0d9f52e975d21ffee4f1f
SHA1 849735772eca408bc149b5110af848a8e934c725
SHA512 0eb79e095b035a5e8c79c6d5e34bfc461fa552eb4374b5f02a5c58041768a0952f4af10f9e01f7c40af7cf1fa0f287c8129b81b4d24be7b449555a4ecfca5e0f
SSDEEP 12288:AAwSfxL/2Dc39DLLmt0LDQewsAjCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgI:VQewsAjCnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1B375E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f1c6d098e7e19c3c9402cf9d98074b6a1a0cf1559e0e81074c51c2969e7dd262
MD5 30b72bb58cff0fd3856f0447aaa94eac
SHA1 fe3b3acd9be784eac82af0dca1d862ea54129fab
SHA512 cd30fd0d41c9adbe2f709c66da8e099b3a9d8c060c51225e0a7f84941cde37312e540eb25b90339ff3c1afdbb2976825e3f89b5075d5218f9e147fe13929adfb
SSDEEP 196608:aUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:aUEtQevvqc2W1cpV2EI32
TLSH
T15E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 073af84137f76eef21fd21a4483691d0e0840181703b8f63fac3ddf88060da8f
MD5 e67c787804879ea294473749f15041e7
SHA1 6ae3f4b65b9bd751c3c0fa7369c5c3709b256b88
SHA512 2afdf8df785d73cbb10fecaaddfe3c966a293baaf4ec5b7ce7546a5b161c9dc9f00f5001e2716685ab17a672de4695508c2f6369011592f0ffbc695113877444
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/ziQ/lFTjN4:OoqtVjnmaLm
TLSH
T158D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 47c111b6cf6c428e25602bf4d7e5a91a8e6423c58235dac1387801a68e949fc2
MD5 6a7c04c4475a0a4234700981c7b2b137
SHA1 932625127000bc18555cd73d3cecc68df1472d82
SHA512 290c661ac145751b3653313eb6e08436e12a6b2a175a0a7966a8b43d46afdad0180b8296f8bb9522994ee70d153f2051a00bc633f169abe2be1d75a09e1ef176
SSDEEP 24576:EAhGLJIFoiwtA5l7S53VnQ/tbw/2Mkjy6Fr7g0oS:EAMyFoiq5lQ/lFTjN4
TLSH
T1DD35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4be0234e615cf24eaeb986fc3a9e918a24f044bf9ba397f9b5ccb46118633ca8
MD5 1e66c334f75cdf33824ecd61ef1024e3
SHA1 781bf15d9f90274092bfe68d552e895332de0104
SHA512 d6be3d16dad9339965b22988907e30edbb7a05dc42368e0522694e81dc4a8a59a2b33a59d6d689390e32b31f8597d8d890508fd4e513b3cdf8ab9f3eebcce655
SSDEEP 12288:Tmw5HEjsChN2BFgl0WDm+CRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMV:ywuHOWGnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1EB65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 b631beeebd0493abacdd243fb902c7cd84378f758ce1c6c4a61f6a4bee8ae5cb
MD5 db00cf14ee0a22c333fe73e5adfad6b6
SHA1 2e0ddb5cf9287329ad909b550d5b2d2339c40a33
SHA512 16612af84d4123445dc456c0891f33655f8579bbaef99d7fe11a232db13eb2fd6f6c03b09ee6bf43829525dca3cb9ea01c623065df2f5a80df725cdbaaaa4360
SSDEEP 12288:0XZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:0ZuPnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1D255126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 625f8d694e5c4b7e9800c48346a403276268e9230fd4c679e8988135717f2c1a
MD5 51bbf4f17e25d3d2f6e1400f2eca2c33
SHA1 d6c3bbb8e51c9e6281c6e3e2b377c05173dfbdab
SHA512 8d3de4abe982910c2d44df9ce410dcde14fd29f1936f988046e3d83a558efdaaa442c757e89cc1016836eac0a02092ff037c2bbad91ba0aee04e2515c464819b
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:PQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T13E667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 fc361bb39a2d2c170fe0b1544b06c1dbe547a02a86c5786ece07e44d16ec5be5
MD5 1b98dcdb7277ab7c569e0945e45f1330
SHA1 6d3ffc6553717251b99fafd3a1b4999a5be2c575
SHA512 a6e89c11d1ba530a73851e025e671ca8b80df8894f9d9845401d8f21f66148bfe4cf091faa6d526c97039ad03def4e0caba395df57e9eec276dbce4c4b1e2823
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uy:GQRQyi36YOcPQLvw2gAf+PN3nLm
TLSH
T112667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e753e713c3afbbe91ea68aaa06bb9acbc32be99a96f04b876d160816c71a87d3
MD5 0e97c229d2a2ae956d2e57027312e1ad
SHA1 35ae594cac90dc9359896971d775de937b6c53eb
SHA512 807327c0c45d85313f582d9eac61c31427dcf9fb0332a42a5ca5df3a47253c6d28c52726bc62cb8fdb984ad94e83b55383cf971d969f1f85e16d581493a1574e
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0fnQ/tbw/2Mkjy6j:M68Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T10AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 70c2e77f65f9c82e9b7cfc4847b4316e91fc04118b5d2750338ea8518990124a
MD5 55f9c59f056f85e88cf3e7a20163f67a
SHA1 8846f6dd0e7df974a0677dce3d037b2a79028628
SHA512 f04d90fefcdb46fdb25f82891f02862600b864a146e5faf267f89dd763259782262dc6342802cef5973451c560fad379d2515bf1538549320067a308b40bdfa2
SSDEEP 49152:Q3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:dy5112gYy5azzVvL69nLKnhZ4Lm
TLSH
T1D1167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 242fc2e805fcde8963a49776773027406bb09c1dfd379a7b75bf8be891c6d8ad
MD5 ee60f8abe800c666311b7031dc80948d
SHA1 2d41cfbac752a340e8c4f1a04a0d8cdd946fd37b
SHA512 32fe2f4b8719ec2b37b1399d4e31086f47eb21eb177cdbd22001baeddcf88d696e1278f470e2d15578f0a24f4cf5d81e1d0b9d6ccd7b9b6554fa503b573b781a
SSDEEP 49152:KB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnQ/lFTjN4:Yu6JmVxd2dMLm
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b3a0daa3cd69940696c6382507737471429076f038fb649229921b1363e7d2e4
MD5 dc61d5e1e6b5e7c520829228db4f6b20
SHA1 aa30d27f0d55322e7daf17697dbbf70a94761987
SHA512 f536ec5adc57550369fb8dc6a6d92f5516938f1c3bd9eb3ceaea7889d1c4f1ef6b8f748b628c169cae0656f0c19e27d15e7ea47d3a6b36ac023181ffc34a0f44
SSDEEP 49152:01hpsNoJpF1A6UU44CwH7R4xAQ/lFTjN4:0mifPbRaLm
TLSH
T109B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2ac5fca451ba3dca858b6abb4e7ffdcdc41f8164a4ea0e762f9c752f32d468d5
MD5 fb95965be3d8755bc39843141b35eeb3
SHA1 840d2fb4deb7798fcc1ea7ed2f916c080e0a34e0
SHA512 163da02a8416cb05263c8d8887dd0900b15192f5f5a34c83292656e7b74603cd1df074a900c4e4a802468d7593d8cac4cb7b5b64a6216450edd5752475baa7f8
SSDEEP 49152:tSuZQIY0Be2KRRVtOnks6NMHqPQ/lFTjN4:j5dKTi61ELm
TLSH
T1E3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 c8168eb908356f8939e719683c5ba6e2b13e5f03b92cff62dd0eb509c5f23b35
MD5 5f784b9c6670ad0122d2533be24056e7
SHA1 671180b7b6d94072e45c6ec489801eaedb9e4710
SHA512 ab3ff8cbd581a0473f2cefe7c176046e3130493ccd3d6030ddbdd86e59d15f5ff2e0c2ffdda6f90ea21045a0a893b10c0aa0d7dfca11052fb8b0015b4b0f73f7
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wsQ/lFTjN4:3X2iyph+Lm
TLSH
T1AA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4e2ac5f8a8fcf20befe672e0fea5a46c24a3daa76c88f07684024b6354d2638f
MD5 a0d49265f96fd07f747ecc75859055f2
SHA1 cbd4daa2f90aeccbea07374f4b551befa940b6e8
SHA512 da0cc8ac4878f3c596750350e65d60af0545115573a914664e14c313d853152a75079c610baa895c29c2147877d425212d52385a6a2dffcd4b9210aa2e69e6c5
SSDEEP 12288:nrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:nbnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1985523697965F98BFB1706F18C828182A77F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a69249676c883641d29e644895288c98a6c3a805c05fb84551516acb4cb42c13
MD5 fb5441879d5fb22d021cb74882708898
SHA1 c179db644073894286248684f65e11c6b1cf9c02
SHA512 4ac2ae51a78aded7d8f9e3f5771847e56d5f09c4a159738747ad3e9aa9be6be1443bdce8a97b27dec3acf3b34b719e08ca8f9f1adf0bfeedea3bb755535afa46
SSDEEP 12288:MeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:MenQ/tbw/2Mkjy6Fr7g0oK
TLSH
T11A5523797965F98BFA1706F14C828182A73B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 cc2feddd944ebfafcae11c343d112bd0704bedb208586b5c38ea908d145202c2
MD5 c54a8bb1e3559bdf6e2669343fdc71af
SHA1 0cf4fb9d01b768a3c9d94ab2fce2587e4793e3f8
SHA512 f4d9741c963884e2fd84615f22be1ab68400577310e799bb287ba5f858035bc5b28723316741f8a0a9295e836feeb3232f2907167f1e7cd97f2c816c81da862a
SSDEEP 12288:xIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:xInQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1C55523687965F98BFA1706F14C838182A77B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3145f7c09b65900ce065e92963b0d6d3be4a2e8579b2de63d579b3326d4ce398
MD5 f2fcde3561335e8ef76f3a00431c98a0
SHA1 2e9ad3e0b085bf46a07b063bce12f232ac1aefe2
SHA512 3314c8a265dea1b983ef5d52f91d7578cd1fdc84b71b8e8f7e0af36d1f833bc5da0088179355e7f1f1c3c3c91a304e3d03910aadca4aaaa3030f61b8e56c8c46
SSDEEP 12288:5VVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:5nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1AB5523693A69F4C7FD2742B4CC928142E77B3DC6BBB1A38F6B04111D4E793D419A5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 af59b54c19999e4f899de80d4d6271c2e7b167181ebb781cd0024a64e8e8613c
MD5 5b94e08065d7e03e4df48c209a2c37db
SHA1 4384d669955b72e0945896075dfa99ef0c2746aa
SHA512 a859a0d3292a1d78abc7238712194d79547027e5e3d00132b84ac0ad9233de53f89aa79480ab91c09e046f83c6c49303896bb8a58d9d6245e5d368377761ca67
SSDEEP 12288:6NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:6tnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T11C5523697965F98BFB1706F14C838182AB3B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 38b463c8fe3b3595a941ab158377625f9028c2b72c36f87f5234a9b94126c0db
MD5 b36c0e606144766aaadcacef17586ed4
SHA1 fef7f83dfb109b42525fc52f105e44f5908ca788
SHA512 1f89de07f8275b690428b34e317c89384105a164e225e7e65d7045b0a44907b9ab136c87b8c328978cddd92710f76bbea0212360b86c3859188965bfce9f8655
SSDEEP 12288:GKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:GKnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T10D5523797964F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 056b3f60390a26326fa929d67d081419840542c54377ca2188d0978d0940295d
MD5 24a2bb0e1e2d99670fa48d0aeb416c3a
SHA1 cbe2f1f26fbaa3f45cfdd73312ae92655c4b339d
SHA512 3b093be26b1ba3bb4b5ca98d5f2a3fc3a3502e5ab1de30904bd651a58e778aa9e9a0c211507ade6b3020f3dbd1c0bd943b61023b4f82c3dc58285c12da14ffee
SSDEEP 12288:b2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:bWnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1535523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 63f7e2997e5c3b67b0826f40c9c09ab805f3a079b277efbd3fe95b199b17e077
MD5 6ac72c50c12f9c1195cf3137e7f06768
SHA1 562d45b5e3219fb18a14b12a4de0c280a7f04c08
SHA512 e84d0187d658327fd7a1e74284d3e05cad5c85308a5bf5fbb734997d294f2961e96f66e6303ba13d77656536b5345b81568d3b8cb262798f30586d8caf729a37
SSDEEP 12288:biZwbDzzFEoS2cPvy+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:GZM3zFVSO+nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T14F7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C70F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 6678dfa089cef0779c003349950cfce2541c36afc7fadb4badd6c125beffcdc2
MD5 c4f132267f51b0df3563b77dee35d1ec
SHA1 639d28b82a9d571844444a343c5c8c17629dbb90
SHA512 ae1c8404768786e7b98577cf554e4c676b20a31f805e367668cec220307a7a1796d0725666f08e992edef4ed5d43c2d6bb5b9921f6069abe94ab3fc3b6427011
SSDEEP 12288:efGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:e/nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1C35523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9d5b3e4725598af5436cc76cc446aac4348c3cac88fefe3ed7dc0fc921b3a316
MD5 e72e3ce251ae4db4cf25467046a9b6a8
SHA1 511ac66d6ff85f5233b009e6e7cfcc5640dac15b
SHA512 bb24741e15447544fafdf5acafebc91609603d082f96edf610496eff46ff9844ff19500c3553f2802619034d85674ec01efc0df553dcba3e8872bd5c10b13fcf
SSDEEP 12288:HTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:HDnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1F65523797964F98BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 1deda4949fd9d8f38db211178ce0e4b22a21f398d402b23ff5377be5e59caa93
MD5 0617b8f6f0696990fd55d5072c1c30f2
SHA1 a0759219ecdbab720738d7d32fe7e7923abe99b1
SHA512 de20a3c7b16bfc0c42524bdfdde60eeb10d58db13931815ff146103641e36cdd6c952f31dae09a17fd47e9678ea845ac1d69d0028774a8bcfb8839d831e419af
SSDEEP 12288:lyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:szyynQ/tbw/2Mkjy6Fr7g0oc
TLSH
T18965021773A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ca75a4780f05b87458ffe9f28d4e20e4877cff0775109d36f320e6f2455c068b
MD5 9428c0ef237f0b5467f95453ae40e73d
SHA1 b8b0928de8f23b70f7c6a694c31024f5d7ab6a0b
SHA512 464fd6b4ed3a22a22a204ecb899ed374fe470f0c2dcd9469258e2274e3331b6100a51dba5872aabfa6cb2cb34b9ca925ea468f7f7bed0c46da0a0f0c025370a6
SSDEEP 12288:wfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:w/nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1215523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce4e4391f2829fb6bd6aae453a8cadbd070552d78323e8a745c363c93baf3e6d
MD5 9bc74e4a65087401fd880fdd047f3161
SHA1 431543b97dfce286ab5334f920431dc488cc00a1
SHA512 47afcc800c050fc5addd451c6cc2220b973db38f63a33476907d1b0fe0ed537d1923ef7d07e43c4b4c1f2267f42cd8ae865f899e2bfa39eec6d32aa8782c4e72
SSDEEP 12288:MfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:M/nQ/tbw/2Mkjy6Fr7g0o1
TLSH
T17B5523697924F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ee075aff07ad645467137453fa74b129f75877568c9fd44d140d0b0254af60c0
MD5 fc30f7a49bc98e22f76ca81d2c396db2
SHA1 4819a8e0672c1d0aaeab7f847651f816ccc725bf
SHA512 eef88c98f29fb1c5ea88211cad9290f3694e0511c4a7877fa2fe5753bc8918b6b86566f7cb89df5b4eb7ee96185309d150d5b303c7f4a62fcfe44a3f678bddfd
SSDEEP 12288:xyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:gzyynQ/tbw/2Mkjy6Fr7g0of
TLSH
T19D65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 78d799f1fb3ad8e5b52aeceab96937e56186c85a3e415fcd362eb8ccaac5e27d
MD5 16298fcee23830a9f923d4509cedf18c
SHA1 b6da877c83807edb880ba4217ab7dfb01517d087
SHA512 8900e1162fab2f55bfa4797eefe66235df781e7ed56b4af796789f675e9f1f86e7636e3e49c21c804a0182443dbd46eb77dabc476bbaf566afd645cb95788415
SSDEEP 24576:bT0aLl3z0zDYnQ/tbw/2Mkjy6Fr7g0or:bTDLljBQ/lFTjN4
TLSH
T1167502A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5e3f8b0bd621b3793ff042219aed12d942089aa7d3af43d060647feacd2dff50
MD5 1cc5cb1856c3c91d2f0a9d78f39eb4ca
SHA1 04cdbac0b9310cabe4f61de6868f305719439b63
SHA512 b472936feb022d68d17c10d60ddb83399861fa9b6afd7f62bb658ab7362a15e94680bafc23739879701628ccc4290c3a476ac00b2f891f86bed4d579483cfe17
SSDEEP 24576:F31d9CHKy7GZUnQ/tbw/2Mkjy6Fr7g0or:l1d9CHKya6Q/lFTjN4
TLSH
T1F685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 14e6b2421c9b5c827849b2309822aa0ad829071880c7d31bcbb9f41022cda91b
MD5 06c1e680e6c8ac3248d6cbd53aeed8ea
SHA1 6b35d191150caaf8e97a6da65c37401d6475f506
SHA512 d7095d23b70263b800be62cef1782dd906cb7dfdb34f64ff447c99cac0af8a465eb9549abd3f597a3405e66f791e9744e61964db836b9fc68b14f21858e69cdc
SSDEEP 12288:AoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:AonQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1265523697925F98BFA1706F14C838182A77B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6c17c8d675e58af878ed9d406af0ac319c9f38f9d19fd4f4be9f83264e62d420
MD5 a63e2dc24858242d564399af4880c78d
SHA1 02ad5aefd49c1095c4bcab178b12fe4f22a99cd6
SHA512 c86ebff129d2497dec0b05c766c3b5b4fa4e7912082aba93c3188afce2dab6aee7e3fa10002328cd1e68bc1ca6c55effeeecf1e25d5fd291bc4d83553cbf4980
SSDEEP 12288:kSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:kSnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T15F5523783964F99BFA1B06F15C838182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 167e597c9788b541ad2e212a89e5320189bf05aff38410bbe7870e909b041ef8
MD5 ec0336592827c88a9a11498da8a23682
SHA1 cfa194235365c3f7adb9718145cdbeeb0d6a6175
SHA512 7f1521d06410868bcf6ad3968b712c3b1899e0a8ee617f91397f30baea38dd3696c765d9bed217f408b6d1d743c0cd11942444a6426caedd23bf3d93fb465035
SSDEEP 12288:NpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:N5nQ/tbw/2Mkjy6Fr7g0om
TLSH
T18E5523697924F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8c5123b705a4daa99f5e510facc27c1cb41ff553980a3543e840198e42e44b01
MD5 1683d42a5db871bf23881baa8707bf5e
SHA1 b262bfa752d6c8c1f668396ea56bf870219d4128
SHA512 653332fe8cbb8abab30ce19804acd5298c6d23adb88f2650debd67df6f1f6ca5eebbefcbc9e19720bee16a9d546e1446ffd521a22099103216428711bc119be5
SSDEEP 12288:hfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:h/nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1215523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0e96785855944a9d304482efd3b97e9114b182c452af5c603c55f9f19e592311
MD5 40df33ab4716a20544c6273c47e4dd14
SHA1 4913ee5bbcb435a3bbd5e7c5427762571ead7562
SHA512 dfc0dac67f682bb5146491a3c374ad74b59682999eeecff70d273f0a22388a7d6fb557f9451020abeeede06c3b0054c3eaf981a3b30e7dd7eb80dc2db444d720
SSDEEP 12288:doGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:donQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1895523697925F98BFA1706F14C838182A77B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2e96283743a5537b665b1970b3267d18cc5c6977dd5c8c80af991855ac543152
MD5 5203bcc6e182494b6b7d1263c76fd6d9
SHA1 1434fbab772cac9ddb6c36b2ec2922abbe8bdbb4
SHA512 3f3c239226f43a0ea8a8d0ffbeece51f12ef19f203675d43ba638613a81e8fcece4e00bd45ef0059ee349d6dd664d45d88f3085c900d27c99578b9ff3465d56c
SSDEEP 12288:F3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:FXnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1295523797965F98BFB1706F14C8281429B7F0EC6BFD2A38F7B481128967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 bd42332819480411f94725b76fe7b7d99dcd04f5820927dd65cd08f2030176f4
MD5 5dd82fdfddac2c51c554c2b382173263
SHA1 52cbd2b2d800d1bf921ab2ae0ab7dde7026461a6
SHA512 5cd5940ed66f55453f13f0c0af5cacd20940301b19c7ef9e0c350ed32a884e01d3a277f39d6f75b8917d5f3a6661478892645c2d6d38827e8d936aa5765ddb2c
SSDEEP 12288:ONGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:OtnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1085523697925F98BFA1706F14C838182AB7F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 195f748291fb6ebdccc625606692fdeea57c01cae5d8bf489a886bd4f2856861
MD5 3e6078ba881b53c9420a58d41fd775a5
SHA1 322a08732c4480f4842a01d501a05a404fb80dfc
SHA512 de47de8c7f09cb1cc382ddac7970e085e6d8ac39ab32a295dcf436a9f90e5a4d6a12e16b23ab6eb509ff3ed27e429731fa34e3905789ba293285c8d71ab7ede1
SSDEEP 24576:ufwv/k9RX6wkyAIznQ/tbw/2Mkjy6Fr7g0oY:lMnYIzQ/lFTjN4
TLSH
T12485DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a353e26d1f9be16db946c96f1b9719118f0038e7350cf1e2d610c1c8eb07eff6
MD5 8c3204bf472cafa349e0f59aa6957b6b
SHA1 0cfad442e6db9c81eb4ed8d77430342e9c127c07
SHA512 17ba70fea42c150a352159da17a3619c147f5faa7cc50ddcad22ae9da2ce34a111068612d848e7c4dc8231c9076dea4f2eda1303962973352639ecb12b3697ac
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MQ/lFTjN4:kySzPHLm
TLSH
T1CC066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 56ae88afc532d653f8a29623989b54bccd90659073817bcfa0de7b4ef89a96b1
MD5 f9b0bc80d44c62109b2f7bcaf26cc457
SHA1 00226d0e61a2e1ded5a445a9552773b8fc6b02d8
SHA512 f751d26a35b6e0411abd1576f3fa9919cc55cc45c8389d74e3eac31d9003a4e1d46bf3437af688c53f79f166ecf412777296d13790d432c182943fe6aadb6be6
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYunQ/tbw/2Mkjy6Fr7g0oN:o47JUQj1irIhCnDHUPfF/8Q/lFTjN4
TLSH
T15565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 cb1f8912c475ebd51ef5b095635e342a9663cb9f22ee9f19ce009981f37a80c9
MD5 160c0436ce02599123197ae16929f63e
SHA1 75075a6420afb509903ba6ec6d40a4c01bd2f88d
SHA512 eb668c7a3b0fdd580dbf8e45c62348ed9cb74cbf9859c067e7a1390b5e8fe46690bf422aa2780d12c64ff7d3778ecf7120f3b3c1c18c902474034699ac16e1a5
SSDEEP 12288:TssfvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:/PnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T14F65F119E29852E9D02E5279CB824641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1024KB
SHA256 e1d8f2356226f1dcc16422ba6d90449718681660283a29badfae780bafe7e672
MD5 8417fade05f0a2f8232b6eb3cc706fb1
SHA1 51fa8febd4a5008b4e7b9c6bfd3b2f745a0a86e7
SHA512 65bfcc1da6c5e6f529df2dd6e794eb36fa5b393d110139f4fdebe80556df31272221c6124c64809d81beeed292631e15c94c4e50a53afa1a201a77a3c412f4e3
SSDEEP 12288:i0Nd+5U3fSIrritnpb2dN/iNgiShyFD0uMTN7rS1:i0/iUPK52dNcn4yFD0BRC1
TLSH
T1FB253910766AD75FC5AC40326E33C2CCAB707D41EE059B0372C8972FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 374KB
SHA256 7b3e34f5f84a0d6beee44a7cf2a0ea1bc107da55f4584a81e1d76647e54249aa
MD5 39499ed123377a29258adb368238d9ee
SHA1 1607c89a98c75bfd1a504c96cd6aacb2ba71571e
SHA512 cd345526e9a73549dfd0d8dd991dbc6fab4038a498b889fd019df615d50c740146175aab2023fa150a3bf587f3b818a8cc9a53eaed1772392c55a8414441e061
SSDEEP 1536:FHgk+UP2yr2s08ZjnWxRYo9lGjTo97yLYIpvMZJf:tNpeDsYD9lUoMDpkn
TLSH
T17B84F9017765F31EC4F68073593092DFEB3CB4229F5266023BD80D95DCB225A7AB6B92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e772a28649112e60aa0a7394bcacb61abb6f54faae842f96e459b9ddc0ee8b9d
MD5 e0526760494e0882973e2a32ebb166f8
SHA1 7ed206510b8de03d41f97bb7c816b3518ab21ac5
SHA512 ca39e1c0d160bf45c92d41a2ec7c720fa10d316e5ba4062aee66b5e4090779487a4f0d71cc8b5548690798cc4ff041e938fc186f2a4781c1648b8a76dd88e7a6
SSDEEP 12288:b67HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:CnnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1CE5523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c743d74fb6ba07928d3de5807ae8c419d3e96c419e75d720e9095077517446d0
MD5 db434858ac1b773272a533af1f6ce667
SHA1 d654e1fad6ac351961926e7efbc92c36aaf25632
SHA512 3e7c6d564a389c92bbc9a88bfda6efdf42d4ef35d41c0ce916ae690a373fc7c864b7d8b0027d42d12f3b0ff99212195e9124748240599470f93b77e8a13fa5e0
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYBnQ/tbw/2Mkjy6Fr7g0oe:Cgb4mBIBhGFuQ/lFTjN4
TLSH
T11465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 06c6acee82d095c9500baa82b1f89ea14d4cfebb69e001f9e7b4cd72d6a671d7
MD5 381a57f29ddf34645c1f52ad143e8f78
SHA1 d83871379a3e6f5263d1a785715c7faa0a0cf7d7
SHA512 ff627f3cc92fced643e0e1eb430c1835812b804a3cdea308c872ba955fd51553ea5818db9aa1a601e2ddbf78f880b64b7153792c55bc929a4c2fdbbd7ba662ae
SSDEEP 24576:YG88u8FpJqH1Qzria7/m+nQ/tbw/2Mkjy6Fr7g0os:b7ZFPqVva7/ZQ/lFTjN4
TLSH
T10D85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c81bfc783cb4277666db6f291460f8fc2e8c4e1c09640a104efdd9df6e5a468a
MD5 5e6b76608c63f2e04275ef864fab8b4e
SHA1 e3076ba6fb26359a5ea505a769deb8f3978ad4b0
SHA512 7049d67aadf6bd62f679fa01ac9a8d17f2ccbf9e5aafd3ad8dbab4f352f2f0fc179ef37d6fdab658c3dea9a80971959f052de6e957cef144d11729e0e17a70d0
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKQ/lFTjN4:aG05lO43bALm
TLSH
T176D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6ffa904ab764f82a3bebd9d8eb461114eb67295eb67a192662ff6ff12986b32e
MD5 24dd7c5c1c9da18df13bd208fc2487f6
SHA1 5b71ab0259dd44ee165f91ba7f6a153c88e8285a
SHA512 dfc134ffddf7ed69c2baf83a184e45c9047c0f2fee6d89c815b02208fa329358c1b84d2c0119ef0dd3975d7db88d8cd93d3f8ee31a4d81d9e1dc43b989d13714
SSDEEP 24576:Yfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMnQ/tbw/2Mkjy6Fr7g0oJ:ga5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T1B965AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5e578de80a64bc92a93bbd07fbaaa5ebb5c44ca1b3ff2d8391d0c1f827f35c65
MD5 1d2effe42a43bea4c61c6b02ac72bf5c
SHA1 d3e3fbdddc21eb5af4153d034fd0573c517e510d
SHA512 4f9152e7b92d96e162c47eba84a410a9447bf200fabb9bbec43db5274619826c9f8bca03ea88dad5f064386122908c723c2e3ad3f3ff71ec87bb47fbfb3efd9e
SSDEEP 24576:/NcwHdjbyQ4nLC18lb/EOjowL7FkmnQ/tbw/2Mkjy6Fr7g0o2:/Nc/zEOVHF5Q/lFTjN4
TLSH
T134858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f08b7250ea9c660823788ed09c9c1888da1169feb2d1a596b0e59af0dccd3d8a
MD5 c51e350263cf2881a9018c8faa9c7cc3
SHA1 e87dfa0c8fa27e78ef0d291231654bd211094e37
SHA512 2760cafd461229b2504183152c763a3fd87e3e53ca5a35a8e8edcc487299c0d54788e5fd3dd0e66501fa022499642bdcdc1d834504445daceaba067664f13597
SSDEEP 24576:38kNvNnaFeYhJNtmZBmjnQ/tbw/2Mkjy6Fr7g0oV:38MwBtOmjQ/lFTjN4
TLSH
T16555AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 df30865af2ee5ba4aeabbb7e5c61daae2c8f64c243bb1738a33608a8907fa1b1
MD5 ee25ef9b3cdd559bce6b659d4a6ca4ef
SHA1 11dd193fd8baf037031e59767e48852e60ac8081
SHA512 0699ea0ccdd51705b3915bf6d88a9293b52b0b2f729484b3f010090c3d28c0e600f17d58bd679def1c3c600f052c94ab9749ab05e7cf2e7870a88eff4114bc94
SSDEEP 12288:7HvUrBFrEjwaQ6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:7PUr+NQ6nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T10F65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 1357349d0ddad8bfb59fdfcdce9f063d27e3f3b1a251de5f462abd7d17214961
MD5 eb33eacba74b132b1eb17f90744d2a3d
SHA1 fca7c9d93b5483a04f7654cf8bd14fe97e230b39
SHA512 23726bab7802b65696b79e2eb552f518bbadde41867a659278c5e95480e30bfaa516113b1cd4639b2acda0fc214fbd53b9ec04576aa54209c88b42b642a7bbb2
SSDEEP 24576:YD3FHshBIYQgA7nQ/tbw/2Mkjy6Fr7g0ox:YDVHeBIAA7Q/lFTjN4
TLSH
T1F375E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-99-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/616-93-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/616-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-340-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-338-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/616-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/912-128-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/912-123-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/912-117-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1084-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1084-77-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1084-71-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1084-311-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1344-49-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1344-42-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1344-43-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1344-51-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1344-54-0x0000000001B30000-0x0000000001B90000-memory.dmp

Download

memory/1344-57-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1844-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1844-25-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1844-17-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/1844-91-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1844-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2280-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2280-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2280-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2280-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2920-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2920-296-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2920-65-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2920-59-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4064-137-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4064-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4064-131-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4064-139-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4064-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4492-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4492-87-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4492-82-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4492-312-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4612-15-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/4612-1-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/4612-6-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/4612-0-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/4612-7-0x0000000002430000-0x0000000002496000-memory.dmp

Download

memory/4944-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-105-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4944-315-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4944-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4944-111-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5444-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5444-39-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5444-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5444-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download