fb6b32ed06d4268d551b51df475f5cdb21c2b20268bcd8ef69e38a1d06176917

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Size 1.6MB
Sample261102-mzzyfssxe1
SHA256 fb6b32ed06d4268d551b51df475f5cdb21c2b20268bcd8ef69e38a1d06176917
MD5 b6b5d3ea33c74299d66a878d3eb1f760
SHA1 7cf3d92faef30182ac213e5931048da898682b0d
SHA512 1f6ae42fe6668d4a5fdb9bf3aac68da00de438fd703fd5b29273714a1ca79222a5a5494246a4df6ae22a2d63ada15ff1d27227bc87280f0f288f67fd287c8a6f
SSDEEP 24576:LRVjptU3Fzayi0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/OFtd7mPuI7cpctubZf:dVbUVzayh4p7012GuSzfFWPuIw
TLSH
T1AE7513203BA7C435E85711368E798B66693DBB240F2781D7B3D52B7E5EB01D24B39382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
3292	alg.exe
4768	DiagnosticsHub.StandardCollector.Service.exe
2368	fxssvc.exe
4908	elevation_service.exe
3908	elevation_service.exe
612	maintenanceservice.exe
4148	msdtc.exe
1800	OSE.EXE
2620	PerceptionSimulationService.exe
1832	perfhost.exe
788	locator.exe
3916	SensorDataService.exe
4632	snmptrap.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9359d2b2a26b1277.bin	alg.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	alg.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5112-0-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral1/memory/5112-59-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral1/memory/5112-185-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral1/files/0x000100000001704d-181.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	alg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe\""	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4768	DiagnosticsHub.StandardCollector.Service.exe
4768	DiagnosticsHub.StandardCollector.Service.exe
4768	DiagnosticsHub.StandardCollector.Service.exe
4768	DiagnosticsHub.StandardCollector.Service.exe
4768	DiagnosticsHub.StandardCollector.Service.exe
4768	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
640	Process not Found
640	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5112	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Token: SeAuditPrivilege	2368	fxssvc.exe
Token: SeDebugPrivilege	3292	alg.exe
Token: SeDebugPrivilege	3292	alg.exe
Token: SeDebugPrivilege	3292	alg.exe
Token: SeDebugPrivilege	4768	DiagnosticsHub.StandardCollector.Service.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3292

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2900

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3908

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:612

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4148

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3916

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d4b23c34a8078b9e60624ffffd96cab897c035a4a1603842c6ee3afbbc755ffa
MD5 f40c45ca2e83d90a17170824314dc3bc
SHA1 923dfa81d270c5c703873899c4a81fb7257d6fc4
SHA512 340667282b34c7a7dbf1247fe69e98cfb5f215cb156a999a51b5543a86761dc145640a05dc5a890925f31d9fedcbaa59d8f5bae47edba9012c0fa76918c6d0f7
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnqWPuIw:j3q6HjBCPuIw
TLSH
T1FFD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 22e94cfee5e05bb6f942b62fa5b12369e2baa0d8b817db36da9854a92333026f
MD5 847a3a33b099fe98604ee7343ba4b5c0
SHA1 dcf230466003bb00a4e049aa77cced09aca10fb7
SHA512 4de6e413a1c1b6b66f08eb3f68c44dce449feb1ef9b01f0f9c829c589f4d2b85ce0aebfea8ca178f72b16173fc2da1d5b711ac95487e54889f71b15629cc3ba5
SSDEEP 12288:y1XLsswWkxy2lRq2czAlkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDW:YXYfDtczAvtd7mPuI7cpctubZa
TLSH
T107750128A7E408F9ED67827CC8B2C541EA3378554764E78B03E496661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 e9445d6702ada5349243fe6d3558a4dd621d47b9bcda6d3ab1dce968a3d0e56d
MD5 d23f78671aba97aa158719496949e4b9
SHA1 63454d7f354104ca0fc0268308d147d7840e56eb
SHA512 4d56e092b7cc5937bdc08fcbf2bcb670f288aae5bb8be930c8e7de3f5a6aaaf167b0e8b1398b128890f0a0bd1857a7e5f3d0e895b0bb184cdfbd43027e3ab46d
SSDEEP 12288:hXZNYVLeyUji0h90ZD0wxpGZIVuprHsBkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWU:n0Le5ji0hmx2rMDtd7mPuI7cpctubZu
TLSH
T14A959E15F6788735D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d0ea478e07942e86fe3ed271ab8890511afb2402d510b107cd9a93b07621c8ed
MD5 cbf7c59550a07c80e61dc11bc830945b
SHA1 53c975f4174a6c1190e522c27c07f438bea757b4
SHA512 9170931ce8e4407c31eabe62be35b38d3c8809f6fd21b71dc79a69505eb01704f97f26b48b8a640851667b491e11569f0227275a9b2b6226fac8d2fb52f71854
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuptd7mPuI7cpctubZv:i/ezSC6vUzPvxHjyYWPuIw
TLSH
T1B3755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ed4f2b3cfae5121d55ec5ea4936994443e716ff2cd689fa2407f4374792593c8
MD5 35eb61da6b39b54c5f1b34696cfb10a3
SHA1 8b4ecd3690bc39b27c0b7fc9da0c4149254c6461
SHA512 21068602e8ffe881a6c077a114ffdc7f73f8f89bd7bd0726dff8ec86592167d145fb27a9ea2985582315da0a46d8c946b7c114ae592cdff6530b585e56c84217
SSDEEP 12288:TVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98ikt2VtKqbUb4mNdonIwsI9Ec7tk:TVbqPb88hv/l+6Otd7mPuI7cpctubZW
TLSH
T1DD559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 63907e9e9dbb974770f7db3f287988d4ff19bd759b5f65db6bfe0a67f0160160
MD5 aefcbcb76cf2999250adee977e1b2b29
SHA1 199dd06f9eba4377c826d062748b0adad39b40af
SHA512 f02b3d1274f6e01e0dbf483db170866031d59919b442e557a20653795ff3e832e668810826c2395d3c457a76b6f1cdb3951262f8883b61a0050b756697957f7a
SSDEEP 12288:LQ9kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDy:LQHtd7mPuI7cpctubZu
TLSH
T1AA5523188B2DCCE4FBB7C1B0F4F2C9D27A174E5858AC5752C647F38A1A7913ADA32191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 edd238a69b93c4b75d93291fd8afa4449f26378627a3c1810f825c645914e2a9
MD5 4f3896241e41dc9b01023fadc473105b
SHA1 63e46d93fcd3369b5333ca55585590ab7005cd92
SHA512 5afb499d66abb7817ff9080ce9cb9beba2e0fe0fb8de4c845e84721f924e4408da6e8d084763b48b822615d54a35d302bd19ccfe65ca5c099314643091c2d9fb
SSDEEP 12288:/eBNUbTVO86UKkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDo:/JIUWtd7mPuI7cpctubZc
TLSH
T1B175CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3b8a700282c95fe71333786cfe082afee0bfa84261127a9d955b991b5e0f5a9d
MD5 2a149b8260185cc4640757f514af6f27
SHA1 59d3e12592fd07f98175d8ded618cc059efd9098
SHA512 ecad754d025a9fb58a8c243480ebfb41f4b837bc557931e14963eb6770952f7607b62c4336a7fd294605820d797f64ce6478b2ff2a605472e580634676558374
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:sQvGAdlCEL8c/yRNw5CEPuIw
TLSH
T1A1266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5f51569bbd54cf84196032ca507195451a8caea1c2477d890cf425e9304a5c3e
MD5 337c831ccfc839dd6c85d74670f7a249
SHA1 923ce081be5acd8019a45b2d2f02c592892a51f4
SHA512 23fb924f7b50e81971d6c77248ec38eb101ed5113bd287a05d5a758128f7f19068e8264af6c77a97253f52530cd7a5a36f7f8caeaa4786c997de120750a8b9c6
SSDEEP 12288:ZAwSfxL/2Dc30DLLmt0LDQewsAj0kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:KpewsAjMtd7mPuI7cpctubZo
TLSH
T11675E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 198687ac193b63ce62af5fb7b557bbae8ea9c7766815e1ab71578162b91b3ce9
MD5 cf50f9ccfaf74e390ee886ee220c392a
SHA1 d882d34847a46451252ffbfdc89506cae6ad23ea
SHA512 c68feb4d5698b2a35f0580cb6904085a111293fe9a6ecbc0b359f0ce80e2ce8a3e42e632ad1c12f1ca025b1f18e6011ee5f411123e47940a8bd4d709d055876c
SSDEEP 196608:kUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7bw:kUEtQevvqc2W1cpV2EI327
TLSH
T1BF474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3311c7930b2da8270e79d94edfc0c304dfa3ecb5144a87fe6fc175be391055ba
MD5 265dd05f58957db3d91accbea071972c
SHA1 5f21f2e67e83585f80d67fd367d23ddd67e2a0bf
SHA512 a400468a61b5b29dec92c5909d9d98dfda8971066629f1f3c19292bcc1d2d95a48963c2d69682ba7887acaf50f5636a3c73c3c7e0996fa0d20c6510a74d8eb9f
SSDEEP 49152:ECbRquA/m2yL5zifFiV+XenmE3/zsWPuIw:NoqHVjnmQPuIw
TLSH
T1C1D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 73050b7c255f19baf007643dcab05f35c342c54f9ae4607b59d6d7523d77da2c
MD5 1f04cd96334e797b9d7a636ccbced268
SHA1 6e98516b5bb277d27b26dde0229eb119c33e0e61
SHA512 1665329e8b4b5766c5a62c0d0387e2950d1d0521af616d7b32dfcbc623a3cc13a15d9cb57c7bed56a174ae7e6c3927f598eb18ef7f1b6b09850fa674aed970e9
SSDEEP 24576:uAhGLJIFoiwtA5l7S531td7mPuI7cpctubZH:uAMyFoiq5FWPuIw
TLSH
T134359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7208ab9d7a92dfec59468c6649063c82fb62d9da4c41d57bb2de39c1fc761c4c
MD5 5d2675e37db87f05c8ead82d00b90b36
SHA1 f41f5b7619cdbe37f9a7fc69ad2ebb44ca306481
SHA512 c882c5f1ab27ee522a3de37c5a412acd98b6721b80186ae34bc7b85228f583c576654ce9f01bf9bc0dd63deda03e9b8aac0d00599a0834d6474ee640c46a25ea
SSDEEP 12288:emw5HEjsChNJBFgl0WDm+Cskt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDc:3wukOWZtd7mPuI7cpctubZw
TLSH
T11C75F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 ba764b7b04def02c7fcae94c6df6790c5eb22faf124ac3d14dd200da10581ebc
MD5 33047f373e8dbe90704ea6b12e46335e
SHA1 de4d229d812ad9185acee8c1cf5269484ac52ab9
SHA512 2fcb7444cf71cfd42bc95f8d2b24f1b614dd7355bcd9fc3edadd9e868ceb7805bc370f4872098e8b74c6e4405b55a07779ef5a8cf68d19562cebe9474a9c08e7
SSDEEP 12288:lWZ1IyEkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDf:kZurtd7mPuI7cpctubZz
TLSH
T1BC65124823E864F9E2A3C278D8F1CA81E7337855277943CF4616935A2F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cecd3a19604e0b4f17fdaee0e075c0092c72e88357682c87dea05c795bb82e4a
MD5 e4f46f0135a5a48efa677484f76a598a
SHA1 19c053a8be2b3f2610152be9562ff9ee70df7257
SHA512 fb7f137498ef829915efd513836f2294a78a44d10980664e4035b78f68c9b14dd681c46ee964de8d8515d0be988c3c361e305ff505d7e537bc3d28106fcb4062
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:XQRQyi36YOcPQLvw2gAf+PN3NPuIw
TLSH
T102666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 380447f9194373733c585af5b3d86ff2f01d0760ca76592ddefe2ee9c364f360
MD5 8e2052e21083953296e070cd1ecf6157
SHA1 a71dee7606895cb70f5277f6a36ca6690408a35f
SHA512 beecd3499bb47aec1dc652e6bfb2b41b6e960d0cb46075b7aa1d144a8ec881dc54b8033c9e0ace9c923b2dc47e8b2e4dad6b6fa23e76223581a6eab7807eabc6
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UK:uQRQyi36YOcPQLvw2gAf+PN3NPuIw
TLSH
T1DE666C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e290407af1f4159d57a10027ccab41f76148bf9cfb772b0d2e555a2d33317b50
MD5 dbe6b4f5039951a28e7f100a59c3b544
SHA1 d7849a217502082acc6206ed9ac7084f6f768938
SHA512 2176c3dc6115935189d68b518ff4366813bad91b8cda58ba9a13ff7881f21f449ff354ce881b29c6a3626bc2f035498f93f6c31ceef5512bc6ae7e68dd31db21
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07td7mPuI7cpctuV:u68Qg55nhheWu7PNU3/cWPuIw
TLSH
T132B54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 022bedb03c97d691cbe9cc4c8498074c3e8a85fe7a558bfe8a9bb5d1449948a8
MD5 ddd34f5b7dc82a94cf7b9b19c2c1277e
SHA1 8c89987c53f25f780805e91fe4ef5147e7c546c4
SHA512 ee11718cf072d51fb09191aa884145c86c293727e03146ebc56ecf11e2305419e5587cd85e8777f7af5e675b38fad2b4c9fd0ca71c18066fe1e1a3333e6b113b
SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99g:Ty5112gYy5azzVvL69nLKnhZ2PuIw
TLSH
T11A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e287eb2c65765277b0a754fdee3bc525484cb0568fce32580cddc89c3cdab47
MD5 5a62cbbe9c2575c1b9e11805d837c156
SHA1 d07afd5c422efb390eaf11f8a4c69cd49759f790
SHA512 4f17f7e964ba5efbd21cc113bb6325af32a4e220447320b50998014bc3b471a3f197d0361c87a3daa2ac3d526ac6a9949582d0faafa9d5a277aea7e34415682e
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfWPuIw:Ru6JmVxd2dOPuIw
TLSH
T1E5D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 1a9a30f06ed7052f3b88a4f9dbd9ec175a5f6da7f21b505c97950f1d8aa89241
MD5 67efe1d20fbaabf9d8d07e1477aee62c
SHA1 e15ac7dffa34a38e5197d2667ef07d9b3b464f15
SHA512 5857af1164f75be8519da0dd8da28cb25a5652fbf7c45370caf45758d9047765c1336f654f698c1709da9801eb269edaec2667034f34bd022d9e0dd54c075d99
SSDEEP 24576:Dhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3mtd7mPuI7cpctuh:J1hpsNoJpF1A6UU44CwH7R4x2WPuIw
TLSH
T1FDB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 00335b2e2add81f287b991ca0409952a44a222e391637d2a1f74f21d7e288608
MD5 565cb6608e0d16a954ac656dc0bb9892
SHA1 a547b2431668043e4dba3cd3674c93992c3e07cc
SHA512 8e88d607486216e9f9cf23abe4fa28e77d7549979d7845724ea7b4626875c400b8d1c1d2cad29f2d2b868cd2cdc3c86e41c23733b76a205880e01a9541fe7a5d
SSDEEP 24576:o4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqrtd7mPu3:YSuZQIY0Be2KRRVtOnks6NMHqrWPuIw
TLSH
T15FC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4bbe2d2ae7653ef70a3acd227195991f4f835d2fa4e985ea489cd6caa5186a0f
MD5 1d1893866ff70bb4f9fae67ac20f3474
SHA1 85763afbb75ce9e5a4abe299707ce9395d42245c
SHA512 d91da81363918d4c93aee9cabb9b388d2b2f80ae1052f0145f6f0e4d004859bf109c8a921133632fb9980f8e41854baa6b9faa8fdb39b1c7b5151df36734849b
SSDEEP 24576:khiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLmtd7mPuI7cpctubZd:khtSn8EApI0figngiDn0AP5waWPuIw
TLSH
T15E95BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 a52244843b933ebc171d96d467c77214f41bcad2e910209df5eaf8a5031302d7
MD5 20b3883bb8f2f492193d4ee1ba66edc9
SHA1 9e1a8ae1ce5ce343f976f60a965fbaf6c4e5e5c9
SHA512 4899217765c79bca35f8287bc0ecd901e660eda78ca571254529c136b8655bce156ec0fc16223d89d292ff896fcb47b679becae1d781745220ebe3fa6fc544c7
SSDEEP 12288:GFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:GPtd7mPuI7cpctubZN
TLSH
T1615523189B5ECCD5EA67C1B1F0F1C9C1BA1B4E4DA8AD1352C74BF2072B7523EA6225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 abdc5170b51dfce607fdc5201c6fc0ec4c38437c23e2bad48c157a232a54b0a9
MD5 21162de147a16933ba2cd727bd0a9731
SHA1 a7b1c2870734fcf2945cd51b5ef5c9ef38fad9c2
SHA512 12edc46febd90dd3fc36280ee17fcaa0e4fc56347ff7c655d38f28ffac95521e6390c0a32546eb1ed8a97c12f0912ca968f2991d9af59f348452893f916530cb
SSDEEP 12288:DQkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:DQtd7mPuI7cpctubZN
TLSH
T1C65523189B6ECCD5E667C1B0F0F1C9C1BA1B4E4DA8AD1352C74BF2072B7523EA6225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 3e6e9ca90384d75388b0b512f6c9ede0263a9ee766cb1ccff89c1f1ed689d3a2
MD5 c96354ae4a2f04139f8b5af9060132f0
SHA1 1c22af94849103abb595333ed6a463f0c46f4b13
SHA512 26c068c655d1758927c1fd1d514d5b76656d3bd8161a6eaec8aa42e373900a48ce63c8f7f28af410d428ba8c170276ae54bcd8b9220e8ce1a4dc58c9cf2765f4
SSDEEP 12288:vSkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:vetd7mPuI7cpctubZN
TLSH
T1835523189B6ECCD5EA67C1B1F0F2C9C1BE1B4E4DA8AD1352C74BF2062B7513E96225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 e70b73a10276fa7829a97f0369eb75ab8bbda1aca47fe56a2de0838a717d057a
MD5 8afe49a1b1a2bad6140811a6e11c61bf
SHA1 2a352a15ef985e65c54787a9892fa1125c83f438
SHA512 c916d96571c175452cbcdd27f8c73a0fd4eef2b95e9ce3e8f453b4f6995544b3009175d0dafe4bd609e55b58bf5660956346fea4e18b774677d38c5ac8f30b49
SSDEEP 12288:MV/kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDE:Ktd7mPuI7cpctubZI
TLSH
T1F25523045B6E88D4E973C2B4E4F2C5C1F7377D98A939539BC702B24A1F71379A931A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 ddd1bf2404a54b9a6ee3c3100e325692d128ec3fb34e3bd35ae7ca3c883fc617
MD5 b3cc84321ccb1b834d7381fca392c06e
SHA1 cfd024a105eecefe8d6499c5890dd1e38b247b43
SHA512 3d77f592b917ee0e9f9a328311b13fa39757db4307159202dd299b59ffc521f361be656289e78b4e4923c2514e683ca69c480b8c52ed9b910b4ed99119ec85f7
SSDEEP 12288:tXkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDZ:tttd7mPuI7cpctubZl
TLSH
T16E5523189B6ECCD5E667C1B1F0F2C9C1BE1B4E4DA8AD1352C74BF2062B7523E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 825b2131afce9a478ffec29998093f96729f4a1ea81a5348d3b794d50b136d7a
MD5 8779d4562342f0d35c934a34c4295a35
SHA1 0dbb8c51a0bdc3548b4344bc850da9de56d9edfe
SHA512 07524d05493b0f6ca9ded5cc020d4fcc939feab70208075590f78115491fad03c5af191aa549cc101514cd914a74991770b72a75591b5c6c468a7b6932f50e32
SSDEEP 12288:5ckt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDZ:50td7mPuI7cpctubZl
TLSH
T1E25523189B6ECCD5E667C1B0F0F1C9C1BA1B4E4DA8AD1352C74BF2072B7523EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 6099b6ab5b056162d3af03eb505496d51c27f7ee6173afbb4af0333444b63825
MD5 9e3c74096af3b045d3d8759325d1935d
SHA1 195e3d8ebf7510d11f5435ccc963940f61661771
SHA512 b4258396286632e29055a3f7ab5a9e984b44b129c3a731cdae344ebaa6702b71644772227317ee04a816b616b6664bb1ebc32d5800b77b8a87ae1057eadddef7
SSDEEP 12288:lokt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:lItd7mPuI7cpctubZd
TLSH
T1915523189B6ECCD5EA67C1B0F0F1C9D1BA1B4E4DA8AD1352C74BF2472B7513EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 febb7fa40432fd8e9e456b3374261524e497713b0d79aa15777fd3f758ea5151
MD5 ea7278cdc42b884ee8773c1874f59359
SHA1 e70e3e7a87684475c1ef4f4cc31c147abf01ec1c
SHA512 a054c2477a4e4e3de0317c408a7c91131b8fe3aad9282fc406364eb7d387c896a61f0acc79f624ca929881fb2f5ef71ac3059d999e01bcc1fffbd7369cfe0bb9
SSDEEP 12288:BiZwbGzzFEoS2cPvywkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD6:EZMGzFVSOwtd7mPuI7cpctubZe
TLSH
T176750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 322c845200b908b1fa85bea3906a653d35b7a35e7e28d8513950efb892455d60
MD5 7f4f8f763b0601b2ce218804aac46e43
SHA1 41217079d55cc4e6ecbf8b69f5ea6dcf857b492f
SHA512 45a93055aef0c31c55888a0721d1bf22fe976576c964b9f13fa6781b034e210362fbef1dda6daaba7f574483315a98bf6b0acc411c4513a7ec8f732476d26053
SSDEEP 12288:P5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD+:Pbtd7mPuI7cpctubZK
TLSH
T1D75523189B6ECCD5EA67C1B0F0F1C9C1BE1B4E4DA8AD1352C74BF24A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 cd67b34e0433ce29c3cfb278f5c2048410f2c363828f8179e92fec606265a19b
MD5 1ba2e8be0891c3da0592d1b65f3c1295
SHA1 c8a7b05334203b12588a33a31a64d5800a620376
SHA512 7c146ae5901d2558b11df58f9192a67a764ef3aeded80dc6d75ac96bf37aabc564269a1e359a371557d2933936a2f4cbd73f8878952dabd2d6cf789e8f3ef2dd
SSDEEP 12288:MNkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDH:M3td7mPuI7cpctubZr
TLSH
T1CD5523189B6ECCD5EA67C1B0F0F1C9C17E1B4E4DA8AD1352C74BF24A2B7513E96225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 687148f38d52ede87bed1058eb4648b3ff826897d95fb2c1549e699b761191da
MD5 48bf487228305cca10782afdd31f0049
SHA1 9f70ac35c6e8f8c480cb2feea7a3176af99a4d85
SHA512 137d146dd886856364c3cb81d9eef526d356d80fc47eea7bf1722e18ba0617864273e730a2672213ab37020faab11af94a835ff83a99f3a8c239754516467398
SSDEEP 12288:PyPz5L8Ekt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDL:izy8td7mPuI7cpctubZf
TLSH
T1B965120777A520F8D177C274C8A24A82F77678354B248BAF479453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 9baa9d2fa149be4e44ed631b65362d88336df6ecbe992f00138996725299f9cc
MD5 1ea6553e71426e83f20b6e716f4503ce
SHA1 d95fe6858da6db3ecddf0a6eec1e45371576ac9b
SHA512 b5da26cbc98844d1e7297f1327d2b33b7e584795e99b1609bd5a89ec6ff402c23b9c8cd7b705affd182cb63a1e1c22f011516f01af6d678b3eaccbf5176f6433
SSDEEP 12288:45kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:4btd7mPuI7cpctubZ7
TLSH
T18D5523189B6ECCD5EA67C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF24A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 63d2043bc2a8fc01dfdbf7065828013a57c4311d7fdcb14dc1daefe13390374b
MD5 c86ac319a40ab118c6bec53778d61766
SHA1 d8a8678fcd42472670867d885ad5d29b05574613
SHA512 d50ac993a0b3ef5af08a9e70dd601e911695343ccbc59e7ba2c850abf2e81a1da21e36837b397fb36531a8192f405b79b902dd89dbf85feb0e19fa0a4f756edd
SSDEEP 12288:I5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD3:Ibtd7mPuI7cpctubZ7
TLSH
T11E5523189B6ECCD5EA67C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF24A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a6ce485951bedced338418e9851a50a4e4ecb3ec88ae6b23184a33fcce2bd5f2
MD5 00edcf3fc145da9d41f28263413f3f13
SHA1 02b86293e6552f63452776650cdb108a5a078850
SHA512 7e8b6d5c0fd516883ab6d14377fa795fd517799d11452ee7c79cc2f265a2339e5133f4357094b46fffc4ceb16d414ccb4049a5f0757438ff3774aa8571c9c459
SSDEEP 12288:5yPz5L8Ekt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDo:4zy8td7mPuI7cpctubZc
TLSH
T1CA65120777A520F8D177C274C8A24A82F77678354B248BAF479453772F372A19E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 0f8792dba25aa2afda78480e055e85916d4a92c79fc360d71900db5d0dd57081
MD5 520721a8d939a1b1798feedddb70c579
SHA1 209e3d6bae67777796b6bd2a2a5e209410c913dd
SHA512 3e49c763626d9dd1cf9c917f112e0da2b5c06fbb135c088950941fdad9206d74326f66763a5904f075010a887eb82e36e75325707963c569febfc7d6f8182eb3
SSDEEP 12288:tCd9SWYoaLHF3z0z04PDvhCkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDM:4TTaLl3z0zDutd7mPuI7cpctubZY
TLSH
T19D7501A4B3504CF8EC67817EC8658942E6B27C5A0B74C71F03A9366B1F333A15D3AB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 18e712dc8b452b4e74b9a126e18aba9a9a5c93ec5cf8478ee70809a1a25475b9
MD5 37bfbfb64a218bba444b45ad5fed753c
SHA1 f683862552868970f0fb1042d7c9a02e1d54ea02
SHA512 1dde9d84de005557d4d7d125fa1584c6c5fe7f67cc6c042ebaf7731633b2463177e6cf0abeea8aeafbfac8bbf985b5e18717af19a9c1b2bec1f8d72c64095598
SSDEEP 12288:3i4e7zRdTfgwCHKy7GLbbdIvjkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDI:334d9CHKy7GZCtd7mPuI7cpctubZ8
TLSH
T14185CF90F3E814E8F1B7CA35C9768511DA767C591B31DA8F03A8661A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 080c3c3fb5f2ab680f0285b6d4d1ad5e178ba5b546d53e40cf3f7c311f02ebf2
MD5 309892dc04fad635380552f4edfcb680
SHA1 c025c8eac89e4cedb55b4f6d3b983f4fa3d14da1
SHA512 18396e11ecbfeea423848b07601a1abf5b60deb673d785a26846a8269e78dc875b68433f3bbe1f1a8632bba8b7549f36608bdb43ccf3b4f9f7706aff4f94e158
SSDEEP 12288:Wykt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDK:W+td7mPuI7cpctubZe
TLSH
T15F5523189B6ECCD5EA67C1B1F0F1C9C1BA1B4E4DA8AD1352C74BF2062B7513EA6325D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 ed0e2b26727ae6024b94881703d1098418f6f8a9f3bc0f1456e699aaa2ff6da7
MD5 04b6d869db577edc8751468e240a5d0e
SHA1 c8eabaaecdd56eb22e62b217a6f56479a41e56f5
SHA512 8ab9538f968e44bb0fc604fa6136c3f973db6acef08f45984906c69a4fea9e3e6a581012995f30f713b24345888ea1f64513364ac8f96517878c80fd85cdacbd
SSDEEP 12288:gkkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDi:gctd7mPuI7cpctubZu
TLSH
T1A25523189B6ECCE5E667C1F1F0F2C9C17A1B4E4DA8AD1352C74BF2072B7513A9A225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 3b2d8a0a89dbdd4fc7961aae266b557ba1530b74ff110ae739ff296513d62e34
MD5 2dec4ba1d3938ac40585488de29eb643
SHA1 facf3e4f88241aa6dda854c45a16ad07ff0e6fe6
SHA512 c34d562de52d2ce02a0a8f42d6cf2c6a38f9d2dc0c92ec133455a45a331ffb3f0b33e87e50729b4ce9b1f843d10620da8ef09ff3a94ba57c6fa7f4895ff48f25
SSDEEP 12288:Ijkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDW:IBtd7mPuI7cpctubZK
TLSH
T1E45523589B6E8CD5EA67C1B1F0F1C9C1BD1B4E4DA8AD1352C74BF20A2B7513EA6224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 2b80849a1288996af56365b3dffcc695be2356ccb428f9da083f592b9b18a915
MD5 bc59336603fa560ad5a6d2fc19218d50
SHA1 0568ad5749c726bee65cf5f6a1b7163b82c404fe
SHA512 21d5f77303b551023d4d910a7498aeae8a6f64f8d0023823478113e305df728bf7eb38d88edfb015326ba12b3a33f43826e92b5c1ca5e96f24988457eafb1003
SSDEEP 12288:V5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDW:Vbtd7mPuI7cpctubZK
TLSH
T13E5523189B6ECCD5EA67C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF20A2B7513E96225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 de560fd1a840c23e0c7c0858ae1fb83a12fbc65884e6dd0d85080a24824d7f75
MD5 c55864ab3bac63879ff186c1d0316f3c
SHA1 920bed87eaa8fc12ba6f702c9a73e075c7e8faa3
SHA512 fa71ed7fa2cd52a609eba113694105ada885d6c78ab56e7da6673a124f151c3c59b09f10e75af9e9892541a30e28b8bc09c626ec12905712ccd85541e72a97bb
SSDEEP 12288:Fykt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD5:F+td7mPuI7cpctubZN
TLSH
T1FA5523189B6ECCD5E667C1B1F0F2C9C1BE1B4E4DA8AD1352C74BF20A2B7513E96225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 40afec52b18e67f5ed02933ebcb48b9a23addb3d29c6d7b801487c2785732fd2
MD5 75f38fe318deb589c583a17192cc38d0
SHA1 0c593677ad921917e9ecbdda3579f487b905a68c
SHA512 8a926a1954514288ec304e91b2c95f8c4b36909d2241a33eae1b2107bb099d7a4c9c75fd05f41fee8f4e581e515f00ffa95586d2571d03983704ee539fed9fb6
SSDEEP 12288:txkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD9:tTtd7mPuI7cpctubZJ
TLSH
T1E95523189B6E8CD9EA67C1F1F0F1C9C17E1B4E4DA8AD1352C74BF20A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 c973c75d6358094b96cafdff9e0c938b87e793ecbd53d682aeed8c1060fdfac0
MD5 0e4f2ce40f43273d3161ba8d781786d5
SHA1 f3512bec6beac5d44994c1b15f19fe9ba18df843
SHA512 92cf7855abd1cf3e786526eeffa83964153ddba8724d21ac898dde6e0d455f4c329b6f200f3403e23afd4a9736c456248dc0c941eee7eccb33f5aa2a6821a10b
SSDEEP 12288:NXkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD5:Nttd7mPuI7cpctubZN
TLSH
T1645523189B6ECCD5E667C1B0F0F2C9C1BE1B4E4DA8AD1352C74BF2062B7513EA6225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 d8e7359db5e65cceb3511a35d1fef0356c87dbbadc4426f9b70a49c6447321fd
MD5 483304d581682c618b51ba2b6f171464
SHA1 7a390a7fdc95b9a977dba3f38a3e6f56119bbbbf
SHA512 2839b06f2c2d427496bbbd041fb3eda4236c8f8c9dbbd231c5bf5c23ffc56ad2b95e98df2e114e5f25ae9e53c56c42fe9a6dc5337588c39a18bb8dc12b57fd25
SSDEEP 12288:Cakt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:CGtd7mPuI7cpctubZz
TLSH
T1C25523189B6E8CD5EA67C1F1F0F1C9D1BE1B4E4DA8AD1352C74BF20A2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.3MB
SHA256 cb7daa18748dbf1caaf6b10ba58e100b510fb7315c73f40b0145c974e24f8057
MD5 e7c50903cc703d6a76b375481a9a578a
SHA1 f8ff7164ed51d55676e27fb41387079e8cd4c08d
SHA512 b850bde339f72f923dbdb18bd284029d45afd82a118f74457571bf1094a0b5afe26a9fbde0e5b510a613ec12d1515e927299b2c855a2cd429fdb096b4059a94b
SSDEEP 12288:OXkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD7:Ottd7mPuI7cpctubZP
TLSH
T1255523189B6ECCD5E667C1B1F0F2C9C1BA1B4E4DA8AD1352C74BF2062B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 1.3MB
SHA256 ab138b39057ee1a4eb6d49de3f9bf652844b29e90612f6e4cd0ce662e476aefd
MD5 d1843a3f2ed26565676bb3a81b65ac70
SHA1 a1f6bc0f334c015d7c770b8174b9c457ff88a72a
SHA512 f2efbb04f34f7a2226297a0ffc0b9669d07bc3093e23490c59dd4af115f5225f8324bbd77bdfd49c51400634d854309911b1b414ceb79b1eebf6df6de7fbbf12
SSDEEP 12288:q7kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDb:qZtd7mPuI7cpctubZf
TLSH
T1B35523189B6ECCD9E667C1B1F0F1C9C1BA1B4E4DA8AD1352C74BF2072B7513E96225D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4a85ad87635f6bd1e6b1fa8debd30f177f13be6cc2996a88af64c31a918a5872
MD5 273c816ed54c8acb00cac1cb7492b04b
SHA1 97b27f8d2eb2604d3d3a6598147e1b68baa8736e
SHA512 10f2b91196c49d7fc5db95db3e08acee7a1ea1621a464756812405dbca3aa0d69703e20a411339a5ed2e7dc55e383252d76beeadf42bcc50ca98682d75d18d56
SSDEEP 12288:38sfpkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDt:Lrtd7mPuI7cpctubZZ
TLSH
T19965F109D39841E8D06F9275D7A28A81B7337C2597E193CB43C1F13E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 56e1b5e62523482c6610981e09def951f6a6127a4a3cd24b90a4a8e5851b0f4a
MD5 28e17e7cdf26173edd0f53a5e0a255cd
SHA1 a9c22651112d735f711d4ed062baac8b8d8465d1
SHA512 c66fdb0d82f4cd9726337cbbe1cdf0742f54f4e2e2ceba53cdd657a2d616f494e284f32522dee7456220e8e08c7fc1ccb9454f1b14040ed185153c94a447ff93
SSDEEP 12288:B2kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDA:Batd7mPuI7cpctubZk
TLSH
T12C552314CB6DCCD5FAB7C2B0F0F2C5E13A1F4A685D684293C607B35A2A7417ADE32651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 f50026f519f90830464d52eb496279acc61ef973e6edb159309ce4f6c3e4f66e
MD5 5b538b41eecd5dbfdff121339cb5c7de
SHA1 ac780e2ebf3c8147bfd85c9dbf698feffbbd8bcd
SHA512 ec32361df5b0edcf80c75755caa7df02d67f16772f2ff8faf18c649c583ec96d0eff02e259a6dc7574c0d32b003d0c9da9d9b89c79d409cccd4a415bc6760f53
SSDEEP 49152:1TDxR+N5YzTfjMLWPuIwf4p7012GuSzfi:hu5APuIwwp7012zS7i
TLSH
T148A5E12EA7F845E9D1BEC5789A23C502FA727861033193DB42A0C17E0E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.4MB
SHA256 e9a2f8520e17054fbcbb5a4750ad3d602ce99f2092ef38fd60706249606b67e8
MD5 3739b2b5357099c06fa8fb4679aca55b
SHA1 37ec517e9cdb2d0a45d4a91553228330fda99267
SHA512 a389d110d231d19384a225315a39297fdfd2f0cc2959fe66a6e55153aaa663c09bee8f21e1660c700e54c892e790af85f6117355dc78e59e1515aaf2915c1698
SSDEEP 12288:5hbHjfXDkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDg:5hbHjPhtd7mPuI7cpctubZ8
TLSH
T15665127D17AC14D8F572D2BC95A28582D732B8291B2593EF4382927E0F37AE85D31F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 cb00955b65b6691fc85957579980109d3d65c86e2b5cefa1d5ba846b388aad03
MD5 ea0af84530aa60159d5dea5989bc5a5d
SHA1 bbeb5b991da4d5259ee4e7f4764f4983402cab30
SHA512 093cef2bb34278c9c80f024700a6fd144be09b10289eb0d4c231e154391e8845b064367142316b85bdb8569ab336fba80f2e130a50823102b385d03e8cf5fc3c
SSDEEP 24576:N3YgnJcRTk4yti+R5dpR/Ztd7mPuI7cpctubZ+:NIgnaTk46ppR/ZWPuIw
TLSH
T19045BF2DF3B910B9D8A6D136850147B5FB71782D1F209ACB0170C638AF1AEE89E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.3MB
SHA256 7a1973ecf75b9b9ecb10913d1ce75f0d31857a493c8ba83b045017520972b107
MD5 83a745772e8d90d85855068ac6717cf7
SHA1 ea7563e1c8f6230a6217ec2e5d4bdae8b9bab55a
SHA512 0ce11a39ed7d3aad86aa925f3c33d9b1dcc10b84f7ad63a369dd2b1bc3bd8b30d2c16d551f063d938225db6a5c13a10000ae5d1d04cbb9b2f7876d41f2ad97c6
SSDEEP 12288:+akt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD5:+Gtd7mPuI7cpctubZd
TLSH
T1E75523088B1E8CD5EA77C2B0F0F2C9D17A174B485A7D13D38647F25A2B751BEAA325D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 28a10f5326a77e18262179d2fbb532f9b0d9e2af75d28fee9a078f7e519c59ee
MD5 f7397adf5f872fb1ab40ce12ca8a4409
SHA1 32505f6c3c73c23459d403de88d86ba02fe0acbc
SHA512 c6fd76a5759efd2a403b884327956801ae6422729a3b8f34fd21408784c494fc36b23f952738bc9f4e0116c7d440e4f54b075de65ac27aa4388a5f0607394512
SSDEEP 12288:qpFttOpkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDfD:MOrtd7mPuI7cpctubZLD
TLSH
T1D165121937ED00E4E576D17CD9928289E732B8650B2253EF4280D17E1F73BF8AC36A91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 f2563ed55f52d50a81ca8115425094ea673a9c3803feaf3f43ac72c22674d73a
MD5 f767a66386a8aff16a0c65fb13d5f73b
SHA1 6c47cbe8ede9ace2ae5c9e6b3d9023fe3691db01
SHA512 b699a9fb485b535753b1066386b3767a899f7f3efc85e6aff90f2bf8862a0c5a1ece29cd60c3727869cab9794a4325de6b38c99bf37612a24f951dd39a430d5f
SSDEEP 24576:NW6BApg2YuyuNDYTabvcRvNYf8km1ctd7mPuI7cpctubZe:NF2YuHNETovcvNYf8kmqWPuIw
TLSH
T12C858E2927ED80A4E0BBD27D45B7D286FAB2B8511B3056CF4255862E1F33AF44D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.4MB
SHA256 d06d7e3645968a4959f25614112604e73d091eaebb5a7fab55eea74b9caf36d3
MD5 2e04468f5c11014256349c79dfd8ac6b
SHA1 29f213d34d346cde3958da57ea542bd6a55888dd
SHA512 b98a7ae46b526e5a3e2033d458eee1ae8c300c2e62cf2227871c3f86d20a3f614b3fafc5ca3c64a831c5122e0cbff6ded915e99b28be4fd058e4d145f0862460
SSDEEP 12288:hEP3R/skt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD8:S/ktd7mPuI7cpctubZg
TLSH
T11E65125C67ADA0E9D127D17CD0A1C581E332F0642B6623EF4682D23E0F776F96E39A40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 ba6fbc89e9ffb13e1f8933f186c33d7c21ff545a853cb022418256a37cca8061
MD5 b0c4b436bf47e076493aaf00b9ea9899
SHA1 daeb7386767ec479b0b0d877e316aa6bdde76c25
SHA512 83ca821a476ede8bca86846ad0cc39ab320c313c8de653cea70821f4e10a7525667a10aa2eaad3d6c63f6c88fe01875f8082c646bac70f7348b5ffe30d393c92
SSDEEP 12288:zjkyzkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDb:zIyxtd7mPuI7cpctubZH
TLSH
T195651208539894D4EAB68278E9B3C1D1AA36BC205F2553DF8181F33E2F767E4AD31B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.3MB
SHA256 6e8453ea0885cf82583dbdc3095b96ee5a4c0761eb3e28ed589fcb4303ae9800
MD5 6b6e519ec6755fb8120e333ce856e5ea
SHA1 29adc350d2d4a5eba227f612d3f4bf26d28e7a18
SHA512 713c5fce9c6c253aecbc10861a86f3181974c9a76ebaca53de76e50428bd43d295d492dcd8b8fc57722bf94f2bdf1eadaa7c666558f8aa82770d515fcfe17716
SSDEEP 12288:CsZkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDr:h7td7mPuI7cpctubZ3
TLSH
T19455231C572E8CD8EA63C1B4E0F1C9C166274A686B6823F785C7F3761F751BAA5329C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 1327136976befb45d2a7d93de40bb1ce42ecaee545b901b11a8fade0209663e2
MD5 8d91206760347d4005d6920924a2b20b
SHA1 5a16760d60f0f79a2773cf87b7698623e0525e97
SHA512 e43cd396b11bfdbd24d591402e7ba59eb10e6eeaaa3d6faa2ec6d5380061ad0efde7dadbe910f39ffd0274e373408a3fd601638c6bd35ad5e3bdc5d59c84d0c1
SSDEEP 49152:2TDxR+N5YzTljMLWPuIwf4p7012GuSzfi:eu52PuIwwp7012zS7i
TLSH
T1EFA5E12EA7F845E9D1BEC5789A23C502FA727861033193DB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.6MB
SHA256 14c11756614b6c17e44f36a2734f563f4ce368cfe90be95750c1232db8d3c306
MD5 55ed0092ec0e6cd505c06042df7dbda8
SHA1 434da09bba8e54f1ceedd245819577e905eefa6c
SHA512 f49480acbbc320e1ac6a4fa0caaee7dfc1cbdf65896bd7537f61104f0d928534cdaea4e0dbdf5829ff960f5fd366a6683446a6b822d005708e6091ba104897bb
SSDEEP 24576:qTMdOz0FFS+mmSLQtd7mPuI7cpctubZT:m0K+mmSLQWPuIw
TLSH
T18E75E13EA36D04E5E57BC27CD653C906FA723465032166DB0690C17A3F6BEE47A3AB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 6437fa12e754ebb8066f7404a312b64101341efde0d0f02321f270145b587bdf
MD5 f66a975544161b1f1d8018e6d819c4b1
SHA1 54d84c492c2ac3c64184873b676f30d6013228bc
SHA512 fac5696def8521187a6f8083b7d51f6e458ed33b6690239527d0ce25ab8e1884287502f6e4dc89b8d2f14630603f8f275fb1888ec6bf768f695a256a60517cec
SSDEEP 12288:04Plkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDQ:3vtd7mPuI7cpctubZc
TLSH
T11E55120C57EC64D4F873D274E5B28581A632B829272823FF25C1E27E1F362E9D931B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-82-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/612-91-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/612-92-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/612-94-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/612-88-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/788-352-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/788-160-0x0000000140000000-0x000000014014D000-memory.dmp

Download

memory/788-158-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/788-152-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1800-349-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1800-121-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1800-125-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/1800-115-0x0000000000410000-0x0000000000470000-memory.dmp

Download

memory/1832-351-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1832-147-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/1832-149-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1832-142-0x0000000000750000-0x00000000007B7000-memory.dmp

Download

memory/2368-52-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2368-57-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2368-54-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2368-46-0x0000000000DB0000-0x0000000000E10000-memory.dmp

Download

memory/2368-45-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/2620-132-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/2620-350-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2620-131-0x0000000140000000-0x0000000140163000-memory.dmp

Download

memory/2620-138-0x00000000004F0000-0x0000000000550000-memory.dmp

Download

memory/3292-27-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3292-123-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3292-20-0x0000000140000000-0x0000000140162000-memory.dmp

Download

memory/3292-21-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3908-317-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3908-79-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3908-71-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3908-77-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3916-166-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3916-172-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3916-354-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/3916-356-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3916-353-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3916-174-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4148-104-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4148-98-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4148-97-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4148-348-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/4632-188-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4632-357-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4632-197-0x0000000140000000-0x000000014014E000-memory.dmp

Download

memory/4632-194-0x0000000000610000-0x0000000000670000-memory.dmp

Download

memory/4768-42-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4768-41-0x0000000140000000-0x0000000140161000-memory.dmp

Download

memory/4768-33-0x0000000000680000-0x00000000006E0000-memory.dmp

Download

memory/4908-60-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4908-68-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-215-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4908-66-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5112-59-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/5112-185-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/5112-0-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/5112-14-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/5112-15-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/5112-8-0x0000000002B30000-0x0000000002BB5000-memory.dmp

Download

memory/5112-1-0x0000000000900000-0x0000000000967000-memory.dmp

Download