131263385126d043cd7f422aa591389759b6b98f3a9fd99c6de66ddebee34244

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Size 2.1MB
Sample260928-dslb2sterb
SHA256 131263385126d043cd7f422aa591389759b6b98f3a9fd99c6de66ddebee34244
MD5 8c9e274ef24215a382e80014870287d7
SHA1 e6f5afbd9029a653a39534cf5ef7186c1a99ce80
SHA512 320d56464042f11b8042a9c2bd87736c50fecee0223f889b6284f463be78c00df1ec7ad2d1db54a1fb53c5f4e1775739fe470bce9525684009559831b42dfda9
SSDEEP 49152:3/0tm9oItE1oXYnQwzGarSj8RoTCCIoItE1oXYnQw:v1oIRXY3GJT0oIRXY
TLSH
T159A523207B86C432E45329B69EB8C71B686FBF601F5751CBE3D02A2D8EF56C25734206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2716	elevation_service.exe
2300	elevation_service.exe
4956	maintenanceservice.exe
5156	OSE.EXE
5816	PerceptionSimulationService.exe
3756	perfhost.exe
2916	ReFsDedupSvc.exe
4700	SensorDataService.exe
3708	ssh-agent.exe
3880	AgentService.exe
3392	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a128d9717465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5960-0-0x0000000000400000-0x0000000000620000-memory.dmp	upx
behavioral2/memory/5960-68-0x0000000000400000-0x0000000000620000-memory.dmp	upx
behavioral2/memory/5960-193-0x0000000000400000-0x0000000000620000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009413d4c3f74edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0c339c4f74edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b2e8c607f84edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef7f1c5f74edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052cf3ec4f74edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe\""	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014806400000074000000140000003000000002001c000100000011001400040000000101000000000010001000000200340002000000000014000b000000010100000000000100000000000018000b000000010200000000000f02000000010000000102000000000005200000002002000001020000000000052000000020020000	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2716	elevation_service.exe
2300	elevation_service.exe
2300	elevation_service.exe
2300	elevation_service.exe
2300	elevation_service.exe
2300	elevation_service.exe
2300	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5960	2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
Token: SeBackupPrivilege	2916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2916	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2916	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2916	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3880	AgentService.exe
Token: SeTakeOwnershipPrivilege	2716	elevation_service.exe
Token: 33	3392	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3392	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3392	SearchIndexer.exe
Token: SeDebugPrivilege	2716	elevation_service.exe
Token: SeDebugPrivilege	2300	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4696	3392	SearchIndexer.exe	100
PID 3392 wrote to memory of 2260	3392	SearchIndexer.exe	101
PID 3392 wrote to memory of 4312	3392	SearchIndexer.exe	102
PID 3392 wrote to memory of 4348	3392	SearchIndexer.exe	103
PID 3392 wrote to memory of 5360	3392	SearchIndexer.exe	105
PID 3392 wrote to memory of 5804	3392	SearchIndexer.exe	106
PID 3392 wrote to memory of 5104	3392	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_8c9e274ef24215a382e80014870287d7_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3756

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1700 2472 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1700 2472 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1640 1688 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8923ead1fee7615a21dc96cde2b88e05b0f3d574dc70480b82183bfc7c3b1fa7
MD5 e3c7cc6b737422a67823b224d2891948
SHA1 0af3aa0e5f4c7ac5765b52d7dd9e59f835538ef6
SHA512 99302c385ad81916bd0bee5217e71fca63860850c746e9525134e48a931a8644cd3245eae36e5fd99dafc54de05242bf84a1460339e1f434977f20bfb2b691db
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYoItE1oXYnQw:t3q6HjBvoIRXY
TLSH
T13DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 868bad3f6c30941be9b94d9fa7a1154d2444298e38caf67e43a446255cdcb693
MD5 91c232a6c85e5b937c2f2db004db3613
SHA1 31efe505a7cbfe9d33e861f162bbdce4dc17cefe
SHA512 9841002239cf5461ce8e886d8253fdebcb7039357633c128519eddc9282536ecdf1bcfbd5cb49e080d6f4f281cad100310d03fcd8c87f3c8761a45d79b3377df
SSDEEP 12288:C1XLsswWkxy2lRq2czAV3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:IXYfDtczAMMoItEr5o6AYnazKLr
TLSH
T18705F128B7D408FAED67C179C8A18412EA73BC954760E79F03E499290F337D85A3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 e0cac02ea73e787a76d251c534a3f2db9958761c90d27fed66682a4d0514c0a5
MD5 61ac71f25fce7c5cf876f66720c8b228
SHA1 131a73bad21f71c6b25d0495d2e51b490fdef055
SHA512 56524f33b63e50d1c7f3e263dfcff4a606a21c072f3c1f3573062294ef3c7dd94cea10fb225a878e884d06a47a403af83d1d0541ae7c037449ce149a0015173d
SSDEEP 24576:U0Le5ji0hmxirMyMoItEr5o6AYnazKLr:UPji0AckoItE1oXYnQw
TLSH
T19F35AE15F6748731D073C0B9C5D2A69AED7230865B308ACB4286D77C2F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 16c6423c9e51f0fcd4b811a276ed1b11a151f01e5b8d116cca552a8c9d2d79b3
MD5 bc4336c79ec554b1ed2a4a44eacf06cf
SHA1 245191e9a1f2472b9cca33b2f0d250e0a29c8f5a
SHA512 b32a6b797daa446eb5b14a6b6b26a60e6c8f488af7793f4472adc4ec03538fd5f07e7a8e6ad6d22c81604de17bb44c1a6c27a869d1fc426c8613efc6954bcf60
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyuwMoItEr5o6AYnazKLr:+/ezSC6vUzPvxHjyAoItE1oXYnQw
TLSH
T124756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ab9a67fbe6eddc6471afa8a62d7a16d2ce4b4bf44e715e7162a8962868b888fe
MD5 be063bccf5de97e009be55fa116dbb41
SHA1 3539319dd9d0b2c8b3f3a68224a0262eb1851673
SHA512 4d04e71fc4d93d94053a5ac3fd9051cbf377e7fd3bb3380f4e1fc37564559baf93e659fd4f2d1193ee67715d5bb3221a20d592ee90c7eaed3ddc234f6a05f11b
SSDEEP 24576:GVbqPb88hv/l+6JMoItEr5o6AYnazKLr:GVO88hXl+1oItE1oXYnQw
TLSH
T1F7559E65F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E67BD6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 ba62c09f2145e490395d3945658c739ccce7cd50f1a921b0eacd7aad9a38275d
MD5 c1191cfb2ee64c840fa6667310fc3dd9
SHA1 07819185309ed18d2c82e2a96fcc84be1f5d74f3
SHA512 9dbd5b8c7585741bcb15b717d803c36f281b8576e78d96194d3251bdf5771a4206aa49dc62cdb37ba2152264f1329634220ea1e472ce71038044a7d8518d25be
SSDEEP 12288:MRD3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:MRGMoItEr5o6AYnazKLr
TLSH
T110C42304DA4CB8C3F643ECB1A8F08423AD5B8EF57585327FD0A1765D06BEAC9E10A567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 1c2b76a2c5f45655a76e4a93e40052ff32331779c7d7d3e2b82e95b7e1cf0ccb
MD5 c7730d15c3e45f2bbab081df24592fb2
SHA1 8787925d7f7ec213c2940d804d5c2ec48a5b754d
SHA512 e963ec5fe6dd9e5af768e059934811d103b914fbc6d00708bd1831ca4cdd1e1ee93f2a3edb984a3eb932b97f35d1882ec6268ba4507f462ff6f78f4df2ad7796
SSDEEP 12288:QeBNUbTVO86UW3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:QJIUxMoItEr5o6AYnazKLr
TLSH
T1C105CF3BEE28FCD2C27A9DB85A91C600D77278704B52A3CBD175820ECE235D55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8567896a8e76162a32a346b8c1b37f0b2cb2d1adb9b2ad46029d613cb363b6e5
MD5 322d387e916471653fa82f11b00f8609
SHA1 7d1c08de9bf5d15c5e59cc8a5afee7fb5e1095b7
SHA512 ffd0c4b7839e01d92e012cbde852c0e0800177b6c40b3c6d98b485c7e909fc8f09b8498cd569fe18ee8d74fa924930f551a48dd8448454b98a8d4da862c540ca
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THD:HQvGAdlCEL8c/yRNw5CXoIRXY
TLSH
T1CA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 1e596f2ef30e7316b1233818e477bba4e51f7708025b3efe6597a15a9f5f0169
MD5 6553acf015a637875a687b69fb61d642
SHA1 e9e226a9206926a5c1e59ac411752691b1647756
SHA512 d9026e806253acc10b386d54fe6251a1f0c010e0461e89bb755b654359941293c230cba01ff8d73cdd40c299f2e7e90613dc807144d58de8a128bfd61a82f39d
SSDEEP 12288:JAwSfxL/2Dc34DLLmt0LDQewsAjw3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1r:6dewsAjfMoItEr5o6AYnazKLr
TLSH
T19315E030FE74E432C27B0DB21B35C716587DBA604B512AC7E3E89E9D49742D22376A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 04106a34f819244a6aa56b5cd5d9c85b67f32ce032d4ca844e3b905dc7ac6879
MD5 e23d7c5f24dba0398ef2806ddf2e9d7c
SHA1 87206ddb524154cdd34ff7ef9f3f6b0d40d45872
SHA512 0b715eea79623eb210ae9114fcebae1056234475b6747afa190a213dd1bf90c52901968f15d15433075c99c0bf7c49867013862cd7525199b0195b93a3cee629
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH8oIRX:OUEtQevvqc2W1cpV2EI328n
TLSH
T1E9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 21d77bdcbefc1b26efb9a69c2d86250ea3508c4b48ab46d961517869a6222113
MD5 5731a9055af8a5567b0fb989b0f58818
SHA1 a6372df655f6604e81bd3b5daa9ace84ce4e188f
SHA512 4c2f6ea0752fa10e4fef188d13d4fd261a6c4471f85a81a91f56c01fba0ba2c2e9308e3c6877383527fd4f51424fcc9b89ae3d99751ac6bc7ae62881c405d04a
SSDEEP 49152:YCbRquA/m2yL5zifFiV+XenmE3/zUoItE1oXYnQw:RoqHVjnmjoIRXY
TLSH
T18CD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 04f50eba48b3c569dce8b2fde8cf9e56decc9d0bf4092b5ae07f7c629fbc67da
MD5 6226146561dbab185376f76f4341a3fa
SHA1 550640df93fc0409b705f736da4af558bc839035
SHA512 dca1bbde2c0f3e9420a1d6bc6363659163c01682718dc5b64592db7d41e1dd15bf7717ca86187347685a15c498e42bc603b3c1bfff31fffa0a24e034cfcba5bd
SSDEEP 24576:yAhGLJIFoiwtA5l7S53sMoItEr5o6AYnazKLr:yAMyFoiq5zoItE1oXYnQw
TLSH
T1D0359D80E7F955D4F5B3AAB899B68071EA76BCA65E31D21F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 6aa894e4132a7e0162740cb39e87e779768bc1a6a9cfa5f1fc978050fdd1ac86
MD5 9aaddfdd45291edab091042117c4e07a
SHA1 357fbc7d8a0db9b99569003afbe08c7934ba7e61
SHA512 1dc16b947d6633f5bd6394147ddfcf6cd7ecea331d28134031da71a087472fb3fe3476561f203ac31a6be9f7818db51efbac0c0babf410351f61f86a7c7555f3
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+Cu3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:KwuoOWiMoItEr5o6AYnazKLr
TLSH
T17405F14576A81CFAE96395388597C032FBB3BC522A21D72F4360C65B5F37351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c447e291bbba269b3b0c38f9d9ee7e06de73e81ee71987d4de4da7e1a0ca6bbc
MD5 74516d2053658b0a9e5d0688cb499e47
SHA1 38e972a436c59a9c19d1fefe556b511adef1cc96
SHA512 e9e6616ef33a98e46829531c7558fa625799d55ad01f7a4f0932cf8900eeb4b55aaad42b92fdd66f7d335cf29ef9d49d1f4ce86dd6c94c7d44af97a510b7a4cc
SSDEEP 12288:OBZ1Iyg3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:IZuaMoItEr5o6AYnazKLr
TLSH
T11AE4124823D870F7E193D578D8E08402EB73B8A6677653DF51A0426A0F77AC56E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d91b3f6ad7cba2eeddc2fd3beacdf1464333545dd8ff6b7367b38f2054cec2e
MD5 1544412fe3d0149aea7d1ded4e2ddf30
SHA1 c08b5779d4c60fd2d1e4fe9fba474065b80c7fdf
SHA512 bc3b1c24ae198c95740c1779780718d51bf2feb7e340979faa27cbb9890415ed7f3946f041522ce57f62f58e3611c30d6e1d16d5fd544be8b8a3a98fdbdb1966
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:eQRQyi36YOcPQLvw2gAf+PN3SoIRXY
TLSH
T17B667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9c1030503ac6728d8fca5f6c529298849a9c1266f64b053f0da3b3f0ebd0c947
MD5 71eb86b497236e72677eb8cc81a58bc9
SHA1 19c260176b08913f306c550fe6bb0eb7439c058f
SHA512 130b8f0973003abe3f5b6251aa24c0953e4745042d47140cc2cfb147eb0a307630616ac1b0f84b1ddab7cfb6356fd9f8b58cea2d40b6e7c1d86b41f5b82533f3
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:mQRQyi36YOcPQLvw2gAf+PN3SoIRXY
TLSH
T177667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5163a09022bc32f2eb277df006acece4be721cc668cc46c32756e127ea1ccc6b
MD5 df36f7c95b4c6126aa0d48495d53dc02
SHA1 f550204a4ee950bfd0cea68b2109eec955c2d253
SHA512 91092b3e5c465c4aa50e11781aa45d39a7adea89c5ffaed6fadc3aa0edb35dc350670c498f27abecf3bcab9dd8b828b64e5aeb29cb9700f5e5305033718aba54
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0qMoItEr5o6AYna0:+68Qg55nhheWu7PNU3/koItE1oXYnQw
TLSH
T110B55933B2F60099C44DE1769F4A873196D27C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 af467eaa0a7f6e41376e6a67a430560f2f82ed1b901ba895726b1945eeb49762
MD5 fe12756fbfc8218910ea0dcb7dcb70e0
SHA1 906760ebaf9bb149ec0b97ce5d92cc10a0dc305a
SHA512 ddbc0fcbc49e46bd18a98b699c500f5eedda873a084fba3cb256124bb1942dc3c671bdcb3a088f599d4419ffd6bf5468cf79bda5aaeff560bdf43a309f0696ee
SSDEEP 49152:N3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk999:cy5112gYy5azzVvL69nLKnhZ9oIRXY
TLSH
T10F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f0c80be00cbb9e5ad198644a7ad9048f6e00c4a6cdcb866003e1cc21d75e780e
MD5 1b6f99352e8d0510c14190bee7dbd287
SHA1 f015bd7ee7e6c828b0c4b5e5dd7766dc17b2f88a
SHA512 8f05f887d7bf860801e1a57d81f0a1711956681dc8d1e99c0e48cca349dba984694b914ae7305daf7a0aa4bc307928900bc54a80962647ab41610cd3f37f1844
SSDEEP 49152:DB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glToItE1oXYnQw:1u6JmVxd2dToIRXY
TLSH
T164D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1fbb430ecbe50f0d7fafe91e0c7058b437dc0f1d1ac2522c727fa396853f3881
MD5 8b19d984262b6b701e46a920476f3358
SHA1 0353ed20b7e34de2ae6b831e280b4f41a5d73bf1
SHA512 ab13aff4e1c7e56bc338639bcb54962ae0083b875ae3693e1eaae828712045dcecca32dd7bcb5615becb9d44aff7dd79d7f33c9e4f29d274fae472576c9eb430
SSDEEP 49152:61hpsNoJpF1A6UU44CwH7R4xGoItE1oXYnQw:6mifPbRjoIRXY
TLSH
T140B5BE13F2D900E8D05ED17887569232EA62BC460B35B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c9a236269bcf8c994ce83d2599b8de5854d4b1c284b0221b7e6d02c5a246c438
MD5 f4e7a5aed9171f02097392530475d46f
SHA1 1d4ba5823d25708ab68dabadd05b383e6edf6a0a
SHA512 b746b3ed7c813adefe35d54b2ce1241b444644b20c16db0ae1ad1133c4653ad9b91d5377a4e88e6d127801dbd7509ae6ad7370385753b68d71218a897b07f479
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqhoItE1oXYnQw:g5dKTi61hoIRXY
TLSH
T12DC5BF13F2E940E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a86f9b7c1e330171e26a53fd8c38ef0a9cdaa8262a3008b3276a78f9d3b8da00
MD5 03cdb0f017bb753dc722e42681799ae0
SHA1 68b777aa8a9b531f9fda10aa8a70d94bbe84efa2
SHA512 c1b7955b42eaf7cc04fb6845ecced70486410d1290a07ab20a7a5ded0fc42ead390b59c2f27320172a4f6b86ebc5cea2a465f32e4562f3ef5dbf5461eba86824
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w6oItE1oXYnQw:LX2iyph/oIRXY
TLSH
T1ED95BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a2a2b8b33d03a650516abb73658f6a0e2fa4c60f26a4b25ab8144938f878b015
MD5 c227d5f04b2b246bcf05fda662f637a0
SHA1 a4aa9b36060690b60adf1b96fa6625dbe621dfca
SHA512 cdb040ee37cf70d95712053558fce3b4ae3bd04e372e8511eaea0e8a66874ce712dd5416617478a1614e1f0e31061006a14c4a948002dd61d5e2fd94c0a65f08
SSDEEP 12288:ir3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:iuMoItEr5o6AYnazKLr
TLSH
T12BC42304D98DA8C3F103ECF1D9A08013ED5B9EFBB686227FE191651907FBACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 846c285ee8894117734fa8ca2c3b9472eb282650449bd1dff8e918903e351db7
MD5 7fa27a5cda4179ecfaf539b296580c05
SHA1 aa076c05166939579596d891816933de84f23f55
SHA512 4abd48b1d72aec9310eb283681303aad258edb974439d2a9e1d18e4176dfb49ea5037614b0d9270c0947e2dffe6456389323805c33aaffec157b2a4a8edfc37d
SSDEEP 12288:bM3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:bjMoItEr5o6AYnazKLr
TLSH
T132C42304D98DACC3F102ECF195A08013ED5B9EFBB686227FE191651907FBACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 73d8d5e7b6dc9e522d635d5dbf1c59ef34929fefe2bfdaf5ca4b9c936b1025f9
MD5 2a95f3e8dffbe3df0332c47f9f4dca59
SHA1 69e5ad06ae20293c63cccb3c78da2f95e60027bd
SHA512 32d76358bc2c4c32d343fb9efe5c20977d7bd6af8c9522b7fa06c568e9d34597220a7dd461a0a85707f42a8bff737ef2552cbaf14952891b0ed5c8086caf8468
SSDEEP 12288:8+3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:8ZMoItEr5o6AYnazKLr
TLSH
T1A9C42304D98DACC3F102ECF195A08013ED5B9EFBB68632BFE191651907FBACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ab05eafdbfe00937482e3eb67659094a2e7ea05f6ca44c971974c752a84755e0
MD5 e832f09947f6d80086c1b02b24a8caa4
SHA1 98e4e5114ea04651ceecd5c992b851a802898b2e
SHA512 a6210a14217c1331a08872d25eb6fe10e585249951b5cd17e0f0b6aa6586aa87d6539a656a7a543e4fb95cb6ce8a3bbb3534e0e92cb111aac486f9ef6ff5e696
SSDEEP 12288:EVV3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:NMoItEr5o6AYnazKLr
TLSH
T164D42304AA8D54C3E453E9B4C8B08013EEBBBDF6B76223BFD550151D0BB77C86129B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 a1e72924c477ab9a9cae306a311f297bd7a64186584021c8e1ac03ee2a397ed6
MD5 cb8b6b56d4d1042cba0de0e90a619c0c
SHA1 a6994ce328f5bda5a285a1ed470616f5081ddcc3
SHA512 e1cd551b311ef59e4816b5cb552d93e825ed19380e69315b965f04f9273db61d31e4a3556bee13f6d11766ee517f1f5e9d6755717076cb88475f5fdabed98cae
SSDEEP 12288:Qt3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:QEMoItEr5o6AYnazKLr
TLSH
T1ACC42304D98DA8C3F103ECF199A08013ED5B9EFBB686327FE191611907FBACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 92937f9638c6cd7e12ebba7de657df218fb1aa90be2fa3725dcdc71202a459d8
MD5 c6a1c447b0f8f072653199336cbf2135
SHA1 6ee219d128b7fc1d045fc69a9b14802f17d89e6d
SHA512 024a1c4505eb5caf8c400330d59b6793d7e12d07ee6f38821a89aba83e664a608749d6a0fa5d7d72747049e7131be9341836202f04325c5d9f9906b80a600546
SSDEEP 12288:zY3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:znMoItEr5o6AYnazKLr
TLSH
T10AC42304D98DA8C3F103ECF199A08013ED5B9EFBB686327FE191611907FBADD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 bf647090247d7d0cc39b7bdddf0c2e05983348ec249ded1848a9a8c77003dd2b
MD5 20635e396cf57d4836258e5bbfc50162
SHA1 799b4a956e5d60296f6f8d52ac98eec3c66440a4
SHA512 42593d5026983a8dfe5971183b5269ea507a0f0b3e258577ab1452e6a9a5958399498f1c84060508cf531252746892ae79e1b4f093abdda0dfe1ed2f8added56
SSDEEP 12288:oE3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:o7MoItEr5o6AYnazKLr
TLSH
T138C42304D98DACC3F103ECF195A08022DD5B9FFBB686327FE1A1651903FBA9D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 76fca76910cc6879875cd6fd167abc2eb034c0d1ee2ecdb9555a9b086c89f51e
MD5 8a920da8498020fce4c682a1e82ac769
SHA1 debe147737d31e93aefb8748cb0bba3d1ec5d8c7
SHA512 f2c76904233eb0e8cfc7bca25af3ea4c6e4f38d842540c16cd4b38e930b1aa0657a27e608f72db3cde5ab1a364e464ca94f7af668e0d09fdff0e2482f707803a
SSDEEP 12288:WiZwb6zzFEoS2cPvys3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:ZZMSzFVSODMoItEr5o6AYnazKLr
TLSH
T13B050194B3941CF5EC63857EC9658816D6B37C6A1B60C61F03E4362B0F733A11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a786f59cc385eb58f5d9a1b27b48fbd06824e16686f0b85f4274d2a95d5ae0f6
MD5 30b1467298a6c749869cc9a8b07c3ad5
SHA1 371daced142ebf413bf0afaac1a204ab18842909
SHA512 042c95e595ab178aa9f20c973eec382cd022214fd27b85c07700ccb623f3dec25622a24db659bc742aaa09efe31f20ec77c5268a5aa231909abc42ef9525c5a5
SSDEEP 12288:Yf3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:YKMoItEr5o6AYnazKLr
TLSH
T119C42304D98DA8C3F103ECF195A08013DD5B9EFBB68632BFE191651907FFA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 e14fa1e64af0567c889805225f904a54e21539daf2e37366657ff496b7d85353
MD5 fe83626069c99e569ac96c8018ac5a81
SHA1 0dd4911cc18d71b410ab7399264d600c24a89145
SHA512 d2085b4e355651343af44bef9cc3ed833183f58350dd9b740f59e136bcf9f88b87c8f6255f75a2d0b206e3f8b3b0c1fa111b69414f2efc64784188d4efabfe0a
SSDEEP 12288:Cz3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:C2MoItEr5o6AYnazKLr
TLSH
T1F9C42304D98DA8C3F103ECF195A08013DD5B9FFBB68632BFE1A1651907BFA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 4934e7fdface72cb836aafae1f4703d7f4d22df2144e420a9e076d2f655c6ef9
MD5 20655f03a6490cbd3c77d91adf5b30e3
SHA1 93f3381aba3ff5fe885c1757a95bfa72c612923d
SHA512 d2870953ffa936e63f66b393c12b534e9c18bd41b54aacd7c2cdb555fdcd2a00f29765274324ee45b4a60a52065ce1552c4b8043554af977412e559b879abcd2
SSDEEP 12288:7yPz5L8g3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:2zyPMoItEr5o6AYnazKLr
TLSH
T154F4020673A530FAE123D174C8A10902FB76B87657619BAF53A0067A0F776D09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 e5248ac633677073a8223c4bb9cc20949da503ff6879ab7ed816aae34e0dccb2
MD5 05785d27b7e612c36c01b2aea4b63d22
SHA1 52680aea74a12976893ac40606232b9573356984
SHA512 a9ef39bfc699f56ed71fba111ac961d91a99d7ce1f55874a9b97e9b6712f9744bd184b5b5fdf2f0d280f2c01127e6b93b83c8c88b0c6ca91b2b4a0b00f8a283e
SSDEEP 12288:Rf3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:RKMoItEr5o6AYnazKLr
TLSH
T198C42304D98DACC3F103ECF199A08013DD5B9EFBB68632BFE191651907BBA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5824f3366cd797d288ede7aff37274aec9350bc4ee6f564767dd053be6cb80b0
MD5 c647d6325830eb99c094b5ca01f5619d
SHA1 39b771c71afe84d31e414cbe9bf30663a9c82fbc
SHA512 d2d921c504fc3fe5dc9811516338bc8756322a0551b4a297982d798a0cffa4c071adfb41980f039d2d33420d2a215fa617ce1517be56df7a57ea24180cbf56d7
SSDEEP 12288:nf3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:nKMoItEr5o6AYnazKLr
TLSH
T11DC42304D98DACC3F103ECF199A08013DD5B9EFBB68632BFE191651907FBA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b6a1b8fb7d4a74beaaaf5375a5088016e2032d2120f2020aeb9fa601eb6b0c2d
MD5 e471c9e91989714983fc606db9fdbd5e
SHA1 55a10000742b66cacbda64d9da46f32cc7e03641
SHA512 cd96a48f535542995fbab3e30f94e71444c6832a2162e44299e99f7d908caa067e7f8ab859d6f7e7cf7a0acc780697dde47f9b5d8ef6153668b110ea19c9abcf
SSDEEP 12288:kyPz5L8g3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:9zyPMoItEr5o6AYnazKLr
TLSH
T19AF4020673A530FAE123D174C8A10902FB76B87657619AAF53A0067A0F776D09E3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 80d3e3f187061e8514d10f8f86434955a77557cf4b171dabb5132fe0807642cd
MD5 7de4d00587cf3a4bc3a72cc2627c5f63
SHA1 10fcc88c6c113b5db52e26c27a63b5f636240d84
SHA512 2a62f53057a3d7f0eb8003c9b42e046dd5532ae0bcc4ab059033e4cac077152d5901eb33ecfe78ba3defaaa507016a9c27594e19f25c7a851bc6869c3394c7ff
SSDEEP 12288:rCd9eWYoaLHF3z0z04PDvhO3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:GTHaLl3z0zDpMoItEr5o6AYnazKLr
TLSH
T1E6050194B3901CF9EC63857EC8658816D6B37C6A1760C61F43E4362B4F733A11D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 4fd750d27b50ca903a12509d81014d495b7b317b7da2731faa1390d8ff0ea4b5
MD5 555fb1db2bacec97be7314de3cfbc5b7
SHA1 b154ff862d8b24b5f009055c2ba102c0966cd94a
SHA512 5a9ec3b0cf83918c72856e4e253f802eb4cc58bf8273f1df7d525f43e6e5beb7141428f3d940dbbde003bc5e22620a99b5c24459910a96a00ab6993d15198e32
SSDEEP 12288:ai4e7+RdTfgwCHKy7GLbbdIvZ3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:a37d9CHKy7GZ9MoItEr5o6AYnazKLr
TLSH
T1B025CF90F3E814E5F0B3DA35C9754512DAB67C9A1B61DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9d28e28ff6561fc62f10f22da867a5063c8a42160ee1de9e52882a0fe9d2c8fc
MD5 8bea67860bdc6894da4d85fb290cd114
SHA1 557b55ac680026af5d470a054e4b51c5de772204
SHA512 03edbe71e17ddde7ed8ebc8b8f709b9abe7af51903af90fa18f28c10960edf0cedb9b45566683038c8d7a4cf9343bf2df0aec3765f8db789c1c79ca69b5b7f71
SSDEEP 12288:Pe3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:P5MoItEr5o6AYnazKLr
TLSH
T19EC42304D98DA8C3F102ECF199A08013ED5B9EFBB686327FE191651907FFACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 22cad476090f504f6a966a34a5ec0f516f8ed003a3d16e2131976ee3934bb95c
MD5 249670b476fa0c9bd11c5ba1894e02e0
SHA1 c2985c5378893e70cae57224ce23663f95bf1b31
SHA512 984ecafa7cce10cd2688e150b65f626a9980490637e55aff2e2d60139f194de6e9418365a04606aec2e765b7b06343692d82848496fa9f331a9927f194a72807
SSDEEP 12288:DA3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:DvMoItEr5o6AYnazKLr
TLSH
T131C42304998DA8C3F103ECF195E08013ED5B9FFBB686327FE1A1651907FFA89610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 d740cd94afc4a7fff22739653cf3fcce09311a5790e9508f42e15a4ae7e20bcf
MD5 d72fb9fa3f0ba01ed9e3df842fafc474
SHA1 420edca97badb106f91593219ec9a95caaddf691
SHA512 1ea249bd21ff63dbe6e145ce7c2b04bd8a713fb05349b37454e90aacd30da02b835a701e6012176a36517476af6cdbbbf0eebdef21c624d582a392a0f9c7e824
SSDEEP 12288:FZ3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:FoMoItEr5o6AYnazKLr
TLSH
T144C42304D98DA8C3F102ECF195A08023ED5B9EFBB686327FE191651907FFACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 15ebccbb86680e876eb969cedb470289810fa40a9142c649a8014204db6c8864
MD5 48ed39b938f2ee5800456dbddf045753
SHA1 9e0d58b096db5b78947bf421957b6f26d4217778
SHA512 5dcb6b3e14159f20d6e318d25bd3c1bdab6e09cf9139fc861816ae21e4584ebd9f3883de5fbaff3e55788a1771101df8eef2c8a0b7ca0a2e00a685e594d86675
SSDEEP 12288:Tf3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:TKMoItEr5o6AYnazKLr
TLSH
T19DC42304D98DA8C3F103ECF195A08013DD5B9EFBB68632BFE1A1651907BFA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8c3f9833fa5a4180da26f7b081b59e89d609f29970ae208e45fc1ba44ae683ea
MD5 55f5b78cdc1918bc4288c6a25b02316f
SHA1 cf20949d07a1169daa644bb4d3ce70823d7afdf4
SHA512 da77cf8571bda6b11df2c1e6b33cc94b4afd8b5ec6b978a8f33b88857bdff4efcc8b0b3c6644a0a2a7d68ea0150226104f566b1010d965c3e0c0059d3331c848
SSDEEP 12288:se3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:s5MoItEr5o6AYnazKLr
TLSH
T1D1C42304D98DA8C3F103ECF199A08013ED5B9EFBB686327FE191611907FBACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 9c03ae330d47ffc6a0134c860daee5e0f55c5bb6499ff3908080ac85621f5088
MD5 a0a70d78d9ecb7fc09b5832a03a37405
SHA1 44fb8a146b0f8fcdf6e1c10b18db53bc0ea722ea
SHA512 3f3290a8470db9ec63dbde3e477a0b19478819120256d63aadfb9361e960bc1bcbb87f4b465a1c52f590eba2ac2b615afa7afcb386007b93ca5c19c3f837fd79
SSDEEP 12288:l33CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:lCMoItEr5o6AYnazKLr
TLSH
T14FC42304D98DA8C3E102ECF199E08023DD5F9FFBB687327FE191651907BBA8D610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 db125ca268f5cf4e777e5a6e2f8a38cb6f7c9153d1df6db523a3c791100b95b2
MD5 4e93e756acf18cb5dda549bc0337fb7e
SHA1 53b21fba035accdb94af860491b1c9e0f583e5dd
SHA512 ff30b59d69522df3d8d7a898befb95a9332e5b65c40f9d9b260f9ddc4af95d45f7ff3888c412823cf42f6172021e3d7ef19d1be4d2bbb1cd5c39d19fb05611d2
SSDEEP 12288:Vt3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:VEMoItEr5o6AYnazKLr
TLSH
T139C42304D98DA8C3F102ECF195A08013ED5B9EFBB686327FE191611907FFACD610A576
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 bc23fe2f994f2135df939a5aa7f4b81efdb2826012eac70eff7dbce6754e8956
MD5 a5cd10e61205325e1741aed52acf577c
SHA1 bb88833d1cc0fac8db89f79681d9e13d486b11b0
SHA512 03906e991353def4374d828bbcb10a5814f1b9d1bff1bde97a4284b99590b090316c6e2ef9e16464a215d69dd3ec914889a53f31df390e55be62d87f22ae5f5e
SSDEEP 24576:1fwvok9RX6wkyAIHMoItEr5o6AYnazKLr:zMnYIsoItE1oXYnQw
TLSH
T16335CF29EBDC44E6E177913C99B3460AF6B278691B31C2CF029A536D0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8a3cc8b3af75537ddf095eec7c71c6806a6f3286f9206d326f285117bb7349ad
MD5 ef2a24a482b7c356b61f5cefa55e5e72
SHA1 d6ac63d72adea4c337c4eb515c8418882f21d934
SHA512 86f2c4f29d92bed720a0b42dcea876a505616670a6abc1cadffa16b8ed66a6ba6d8626b4f38210ed999c6c4ddff186b82a2dc9d72e71be2ced6a631ef2a69e0b
SSDEEP 49152:xYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aoItE1oXYnQw:ZySzPyoIRXY
TLSH
T11F067C56A1A801D5C1B9C1B98F1BCC1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 407befe20d105f00ed1b45acf099e1277ca11da3e89a2df0024df82ce535d597
MD5 733dc4eeed196c0fda1e822f7e669d4c
SHA1 0074dd197d2d6cf4784a1ce115b0241698eaf85b
SHA512 f7869c87ac6e8839b86fa4a3bffa021d4a53b2da76c4690eb0c6447cb3dec8fd9cbf88d5ed3ea77d37bdf0fb6883f92da6c068fe6b31a2ff2e3c400740614eac
SSDEEP 24576:l47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYzMoItEr5o6AYnazKLr:l47JUQj1irIhCnDHUPfF/qoItE1oXYnb
TLSH
T15365AE1DA3EC01D6E1BAD27885154A1AEA71782E1B31CACF1270837D6F63ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 76376c46b83dd43dd4b5e5283e7f5c088d3be438cac20b19d938870ac58b87cf
MD5 21b3bfc094bc2e4bcb140445240f56a8
SHA1 0302c66297a81fc89efd9a50d519c645cee42dce
SHA512 24eee3c1817f38224e157051aea91e2c86b4dbb96c4d4e9e1ca924a3a0427c953773f28fd9f85bb0541fa58065625178f2c0d2504281bd0fb82f3c8c829c06c0
SSDEEP 12288:5Nsfv3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:+aMoItEr5o6AYnazKLr
TLSH
T1A9E4F108D28811DAD06EA175CB918501F7377C6697E2A3CF92D0F53E0F7A6849DEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0214ef0ea365ee787c64142c843a436fcf89144611b495b1dee03ed2975cefb4
MD5 21a7694d4939d2310a36fc9c4c966205
SHA1 bc725e35934eb9cd2e06fa796b84456f7e00a634
SHA512 b771ac30c7ba3dd4d7d7834e652583813786a482db260196b1712e1e1751dc1747f26cf69e0627a95507c9aba52afebb47de783507b3a0f07d0e6027c27fe6bd
SSDEEP 24576:iqEViUPlq+FVi/h/mLTYO5VgXjcWxS4IdmFNxlVnF:4ViUNr2/h/sTYO5VgTcCS4YmFNxlX
TLSH
T1784538017626CB4FC66940326E33D6CCAB707D41EE05AF0373C9873F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 cdd3ad2ee63bb675153112a7e1da756f60b228387fa451675adbaa3a932e7703
MD5 87aeba338ae1ed817bfd23e96a097e4f
SHA1 92354852b4525ca6ba7195e0e7abb4bcebb03917
SHA512 4a0847296171718164e7769503d5c605174e850f942102f841c7c1562389d66587675019d640931e0967de437c819c8a73e3f83f0068de39386308e00286cdc8
SSDEEP 24576:hcKOWvNf1APjyHZ5TTYO5Vq5/TYO5V9rLIcuhracO:KWvNfayHZ5TTYO5Vq5/TYO5VicVV
TLSH
T18B7508819136E78FD0FB6032032A5B8C67A4EC07B7095F6773C9453AD86AB51A0F97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 5cb2ffb7cdd787bbf6d6bfa5ce88e8f2e63584b151a727ec2f2520f5ecdc05e9
MD5 151faec0fdd82c4c98f2dc15e25a9f78
SHA1 8dab7015f03b66afff456778187fde1fd9f7bf20
SHA512 ad0dc9bdd24415d2d84c97fca3aff8bba0e4bbef48334ed6e8fbcf87b2bfc3f45d3eda4059f40175353396b352593cf381e9bae60fd4a7d9aa8998dc1d743cee
SSDEEP 12288:Fz703CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:drMoItEr5o6AYnazKLr
TLSH
T159D42300D68CACC3F463ECB094A4C032AD1FAEFA7B4561FFE451615907BAEC99536627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b67cb9f6af21915da5140e8fb624b3642f118009bce173b4d648f08d946e7e8a
MD5 61f7622e108979ee1ca48a236fd7b6a6
SHA1 41517bf66001c9adc68377af57a4d32b4e35f66c
SHA512 53b8f32cdc375ae6355a906a5882adb5463d1fc8873b58c269d6d8d4a27f1db32ce314fa30a207e8a95651af11ca493391d948764dc822e9f7ce09dbdc4a8e20
SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYpMoItEr5o6AYnazKLr:9gb4mBIBhGFBoItE1oXYnQw
TLSH
T158659E1E22EC02F5E0F6E2B8DDA64417D6B278161732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 38ebe776b4275131a690106628e3ccfb468c57e038dc6109386224c916478a40
MD5 d8c1ade7a623f60ab731e3f87c1f4e68
SHA1 cec2d2c81f6c01e1ae90e26628619ce13cb51d59
SHA512 a56ed3c6a6a6b07c5ffdd05477d508e0c0acfc00f06edf34d934696d2a87f26a475825bd9a6e40e9da36a78a07c848016b2ce9efea317b047b75b1e945ac8421
SSDEEP 24576:fG88u8FpJqH1bzria7/mKMoItEr5o6AYnazKLr:u7ZFPqVea7/moItE1oXYnQw
TLSH
T19935F164B7E501F1D477D13889824663F6B2B8251364EBEF06A88B550F33AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 278d43cb3f145432b32f31d56a044d8b0eacc71b743e2effde11bcd5964e7c1f
MD5 c5a74fa3ca8773ce09d5f9cb75112075
SHA1 cb9a03c52c7bd4cebc63bde80873900dce9422a7
SHA512 baf945e1eeb1107447c031c431c2d9c616f3750d1fcf858cf18ad53b02aca66303e0c49b82e20507f02c644792ae4a705878cf379d9a032bed9a965958af70f9
SSDEEP 12288:YHvUrBFrEjwaQj3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:YPUr+NQmMoItEr5o6AYnazKLr
TLSH
T1FE05E11E629C1CD5E676E17D85818619F772B862171292DF02E0817E0F77ED8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a00b26acc20dc7147b7183ee3c74df0037daea236e5336b76fb46ecb54501d37
MD5 8a9f637c3855600680be27ecb3670952
SHA1 e5b80c7bfca3db8d69c7d7a8a46854b9c43131bf
SHA512 343faf3eaadaa90befcf3624829b8ed9f3f8ff7144cdb7f719bf0ebfc77ef6c1dab65e2c0a84a59e26fe3fae81a0825df9be6043a106b01f62ebfe8fb8e7815a
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjNoItE1oXYnQw:9G05lO43bkoIRXY
TLSH
T185D5CF6E62EC11F9D1BBD07CD9C6860BEBB23825032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f7faad1d137991ba72a3548c33bdd762ae597491d8b4cb6949565c1bc6798d04
MD5 24ebecd7b8d469d9e9ff282da6b9715b
SHA1 aa0168ee5ef889db9177e7ca1db97620ee6c484f
SHA512 f17239e3e90592e5a700302c3fa5628322a08115fbefad08e0c835a06c153dee70a681061f7b41c5818765e8d18a8278e625ee2aa9e3abdf200932cfd33432a5
SSDEEP 24576:efa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVMoItEr5o6AYnazKLr:Ga5POZ3+Jt2pasx2+mkoItE1oXYnQw
TLSH
T19765AF5DA6EC00D5D179D17DC583861AF5B2346653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e07f69c16a360aeb6b6a79689420890048b14b02ef2ee31a7695f79a7f00abb2
MD5 0e78b89f68b52b3646e673a7abc0b362
SHA1 95b6e9c8e084cea068f4a5a7a3cfed5552a65d0d
SHA512 373a7cd411401ea86f70060774a4a1d7e7f3e6f8defd4b052523e1381a035d95fe51112029c4306d5d00567a9a069503aaf4b2a02e20c3e3cf2fc4f048378913
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkCMoItEr5o6AYnazKLr:nNc/zEOVHFGoItE1oXYnQw
TLSH
T15B857B1622E901E4F1BBE1BE89779546FAB17869533086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 079734628200d40c76f0cc8e9ba6435311d4e931be796b0cf84df5e5ca33a639
MD5 f288fb2875967232789621d08a958457
SHA1 3f902af883fb89b5877b9476973cd498bae7de13
SHA512 fcc775af37847b38be01ec923c65a2323358d05c33c7fab5fd0064563a01383e52cf9c62f493c14f0d6b31482a352f74b272a584fe2b30f16ba862cb04f94c92
SSDEEP 24576:X8kNvNnaFeYhJNtmZBmgMoItEr5o6AYnazKLr:X8MwBtOmXoItE1oXYnQw
TLSH
T14455AF2EBAB845E4D1FAC6B5CD238512EA727461173253CF9290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 00a0d0dbb42f1cf76f8a6a9fcd4bdd58d43de1e668d99390edb193b6cebf5e8a
MD5 cd4443285657402d7a73d4d25e3cf1ab
SHA1 fcae0343d4f1602eec7bf60c98f8d6ee06a7a4dc
SHA512 e7de3bd4877114c6e6d8ba855290f83070e6df0cee981a3953ae01847577c7af55d6e3fd8c67360519ab572552302d6622be2f2f96d4b88b72e416770888775d
SSDEEP 12288:hQcMxWDXN1Dp/fshBItT1IQgAw3CMiqy6wItErVCdVYoH0pAYn7ap+kTuJfN1bH:dD3FHshBIYQgAfMoItEr5o6AYnazKLr
TLSH
T16425E13DE69C04E5E57BD1BCDA638506E77238A9032266DB01D081BA1F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2300-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2300-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2300-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2300-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2716-21-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2716-103-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2716-28-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2716-27-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2716-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2916-357-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2916-359-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2916-92-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2916-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2916-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2916-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3392-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3392-172-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3392-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3392-345-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3708-341-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3708-117-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3708-127-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3708-119-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3756-338-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3756-87-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3756-81-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3756-82-0x00000000006B0000-0x0000000000717000-memory.dmp

Download

memory/3880-152-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3880-145-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3880-165-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3880-146-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3880-167-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-342-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4700-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4700-105-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4700-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4700-111-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4700-344-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4956-52-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4956-125-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4956-129-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4956-45-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4956-46-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4956-53-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/5156-307-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5156-64-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5156-58-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5156-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5816-69-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5816-77-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5816-71-0x0000000000BA0000-0x0000000000C00000-memory.dmp

Download

memory/5816-324-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5960-141-0x0000000003D20000-0x0000000003D87000-memory.dmp

Download

memory/5960-68-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/5960-135-0x0000000003D20000-0x0000000003D87000-memory.dmp

Download

memory/5960-193-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/5960-0-0x0000000000400000-0x0000000000620000-memory.dmp

Download

memory/5960-14-0x0000000002D50000-0x0000000002DD5000-memory.dmp

Download

memory/5960-7-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/5960-9-0x0000000002D50000-0x0000000002DD5000-memory.dmp

Download

memory/5960-6-0x00000000024A0000-0x0000000002507000-memory.dmp

Download

memory/5960-1-0x00000000024A0000-0x0000000002507000-memory.dmp

Download