fb6b32ed06d4268d551b51df475f5cdb21c2b20268bcd8ef69e38a1d06176917

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Size 1.6MB
Sample261102-mzzyfssxe1
SHA256 fb6b32ed06d4268d551b51df475f5cdb21c2b20268bcd8ef69e38a1d06176917
MD5 b6b5d3ea33c74299d66a878d3eb1f760
SHA1 7cf3d92faef30182ac213e5931048da898682b0d
SHA512 1f6ae42fe6668d4a5fdb9bf3aac68da00de438fd703fd5b29273714a1ca79222a5a5494246a4df6ae22a2d63ada15ff1d27227bc87280f0f288f67fd287c8a6f
SSDEEP 24576:LRVjptU3Fzayi0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/OFtd7mPuI7cpctubZf:dVbUVzayh4p7012GuSzfFWPuIw
TLSH
T1AE7513203BA7C435E85711368E798B66693DBB240F2781D7B3D52B7E5EB01D24B39382
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5116	elevation_service.exe
4960	elevation_service.exe
5912	maintenanceservice.exe
4692	OSE.EXE
800	PerceptionSimulationService.exe
1944	perfhost.exe
960	ReFsDedupSvc.exe
2600	SensorDataService.exe
4148	ssh-agent.exe
1728	AgentService.exe
1080	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\62702a37c17a6531.bin	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1580-0-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral2/memory/1580-72-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral2/memory/1580-134-0x0000000000400000-0x0000000000593000-memory.dmp	upx
behavioral2/files/0x000100000000932b-121.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001fec7aa5b86add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b55bb8a3b86add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe

Modifies registry class 52 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe\""	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
5116	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe
4960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1580	2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
Token: SeTakeOwnershipPrivilege	5116	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1728	AgentService.exe
Token: SeBackupPrivilege	960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	960	ReFsDedupSvc.exe
Token: SeBackupPrivilege	960	ReFsDedupSvc.exe
Token: SeRestorePrivilege	960	ReFsDedupSvc.exe
Token: 33	1080	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1080	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1080	SearchIndexer.exe
Token: SeDebugPrivilege	5116	elevation_service.exe
Token: SeDebugPrivilege	4960	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2764	1080	SearchIndexer.exe	100
PID 1080 wrote to memory of 4316	1080	SearchIndexer.exe	101
PID 1080 wrote to memory of 2504	1080	SearchIndexer.exe	102
PID 1080 wrote to memory of 5316	1080	SearchIndexer.exe	103
PID 1080 wrote to memory of 3900	1080	SearchIndexer.exe	105
PID 1080 wrote to memory of 5784	1080	SearchIndexer.exe	106
PID 1080 wrote to memory of 2772	1080	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_b6b5d3ea33c74299d66a878d3eb1f760_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5912

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4692

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:960

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4316
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1676 1644 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1548 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5316
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3900
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1548 1544 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5784
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1676 1644 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ac0fa7af2270a2a49d875be6bd7156299efd3c94fa596d8ad7cd1fe8a0195338
MD5 793a4f1e70959da031c0543561331fea
SHA1 3babe9f5f190ef7d294e5e57afcc3f4dfe7f91d6
SHA512 730e5ec2a6a40d566a029e748289e18b198ff5a9893d0a1d43a55dd574431e8ef090a782bd97e01ee6506354763bcd43a22993f2afa33f116b1d75d085d6ff31
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnAWPuIw:a3q6HjB0PuIw
TLSH
T18AD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 a5cb393d43d0d5cbb9ab6a4ece6524d5b9bc48d4380adacf4f9ca2fbc64df46d
MD5 c622849430f398c13eda36dfddbd1820
SHA1 681c9699bc34aae22f93c610298ccdd3d1301cfc
SHA512 6dbd87f7215ad072c8225796a907540dda06d89ad74b60a331e59224ad543d523f6eea90765c727c86cf68e466e8f7cdbdcce6f76afbf97f8b8869d2eb866d8b
SSDEEP 12288:h1XLsswWkxy2lRq2czAfkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDh:PXYfDtczA1td7mPuI7cpctubZt
TLSH
T11575012867E408F9ED67827CC8A2C541EA33785547A4E78B03E4D6661F333D85E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 d22f3916f874e342ec49897a9d4cc113feb079e2d2fd96035e481b4bdb30ca09
MD5 6bd0d92976b057fc4e7059f9bdaf3168
SHA1 0c95f5a843fa246105b187222d3753202fdfcf4d
SHA512 d5c9d53e1cadb8ab704121382b76510d3b09776f4a0086235ec20e04a7c40c15b4629d7aa49e21fe9042facf328d2b89633df2fdc045863eabb658d4ecfd40a9
SSDEEP 12288:rXZNYVLeyUji0h90ZD0wxpGZIVuprHsFkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWV:t0Le5ji0hmx2rMPtd7mPuI7cpctubZz
TLSH
T11A959E15F6788771D073C0B9C5D2A68AEE7230865B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 26a9c8caeaefbd2c65973879327889d8b768c5d89d8f57b59988c9f0f6554fec
MD5 e2947092e7afdee32aa90d9dbdd53ef9
SHA1 f0685d5247cf034e3838a1380cb86a9604c78244
SHA512 16fee3c4f63774071c9ee71e3729c4c04835f3f5f1e1fe48ff46ad5c4e6f63f78cc8562b2d40df0d347b4a78ac35a8683bb59e4b09a16fdd906647271650cb27
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWE6q8wyuJtd7mPuI7cpctubZM:v/ezSC6vUzPvxHjyUWPuIw
TLSH
T1DB755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 98e2f1a3efdcd2db6c7382445e2ad3a12c7b15796848a353f84754ec9f30a027
MD5 369f439ae9ac2921e4a8f321d6e1d302
SHA1 73bb79165cc2e09ef00f90e222e942343fc9459e
SHA512 e7383430b903fec90d63b30adfd13e9ab4260582a321aad459a7ecafe4f6805d8042dd2adf78175d598e1274e34eb65ac10a4c646293495fdc0be700b6a2d41d
SSDEEP 12288:qVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98Ckt2VtKqbUb4mNdonIwsI9Ec7tl:qVbqPb88hv/l+6utd7mPuI7cpctubZX
TLSH
T1EA559E65F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 77a024af4f87656342b37e54545e7a4ef88bc06ef6bf7acebcfe12d7a5888798
MD5 0469abe577466986ec7e221b4ebe5b0f
SHA1 4c8d6a68fc3781bbf08c5ea216196bbfdebd7ae1
SHA512 1d2280a52f64c659384027b742229d778a5ac1bb003712a8763c2be520f503c54c3c6b31506f8440c96e02dcb47ca3b5c41c979bcb36bd8d96da4d4fd7d64fda
SSDEEP 12288:VQ5kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDk:VQbtd7mPuI7cpctubZ4
TLSH
T1195523188B2D8CE4FBB7C1B0F0F1C9D27A174E5858AC5752C647F38A1A7913AEA32591
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 34be4855e782de466b55fdcda885a56353630b4b187a576302e2ddd04f76abba
MD5 625b9faab40292a6e5c1c0e42bdb77ae
SHA1 17a4ff1ed5171cb72f846537cde32656eec1f45b
SHA512 3e1b8ce7302bc673aa1038ad8dd339c8da9b31512fdf77d04554b38dfc9119450eab0cbb97c33e19559f7092d9c22c0c7134c6096b0c2b24eecb3a0b8a0d22c2
SSDEEP 12288:OeBNUbTVO86Uakt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDV:OJIUGtd7mPuI7cpctubZh
TLSH
T11775CF3BEE28ECD2C27A8DB85691C640E77278304F61A3CBD165C30E9E235E55E76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d83be3442de5620ef94a6e1bbc89f6146a4b57c0b9c62fc88475ec651dba9a52
MD5 843d1c7af9f1e75717c293664104b1f1
SHA1 eb50362f1cc951713490ced95a8dc230b11ce4bb
SHA512 81b5f61ad0c9ec0f4200162f8ebbbb9cbfa35959788e0981ac34706d8d3ca1b40d14fc5b3f4cb7bc8d45c94cf656e7b681563d7963d8063a9de151110cc8a356
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH2:fQvGAdlCEL8c/yRNw5CkPuIw
TLSH
T11E266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c20b1d14ca095c51c6643540cdb6c318ba32ef8f0ba60ff2b620583de5d83ea2
MD5 6c4b04a996fe971ed73907eae691025a
SHA1 7a660c23f8fccfc0065aa36062385e7f9dff17fc
SHA512 70cd1f50fb5543b6cc22073061283d6a31650037bc3c33ac5b8b34f64eb580ad538b467e5cf39cf073856a14f9c4c06f26d6725b1205e56de9728dfbc005c3c3
SSDEEP 12288:IAwSfxL/2Dc30DLLmt0LDQewsAjAkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDy:tpewsAjgtd7mPuI7cpctubZO
TLSH
T1E475E030FF74D436C7BB0DB22B76C716183D69204F611AC3E3A89A9E59302D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f9f476f171bc0c0e585b6716154e35d5de9c3e72809341cd5040fdb170b32142
MD5 0c5fb0d1ce3e8d56c5be5ecd65e91908
SHA1 4385c04d5eb8df40170236ddb55497ed323b3107
SHA512 3f3b4639cfb7b01d578ab0533138b4b6f2b76f7f8f9de6c4bf1baa631990fd84b9c221cc14739ab910fcfac066e949c74391c8c3e53649aea04bb00c46428d3f
SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHvbw:qUEtQevvqc2W1cpV2EI32v
TLSH
T1B4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ff34f57872ce170f4ff7766da864aa385b51627f029339f7eaa5025904fad718
MD5 425b3574ff47300d288de3ff9f4c0256
SHA1 db6ce60a63fbf9db4303819cf671bafface5d26f
SHA512 6d8816af48a8cbb5d5877bdb729ed95db874d93729f008967f6be848e27b692c2be9f1031962af5f172fe0b593f1fbda35021d8b77c41640f21e2fdd9634788a
SSDEEP 49152:FCbRquA/m2yL5zifFiV+XenmE3/zAWPuIw:SoqHVjnm4PuIw
TLSH
T173D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e0970e9725fe3e1dbbb52f6e2c58892ffc8a3b16fd2a7a2f2301ab85833891fc
MD5 e118c092b5f1fac34c69aba26d7e8e82
SHA1 aacdc9ab0da95e914521601bf30c45da65b3c25a
SHA512 dc45bcb9ef3905b347212e05b9100a48a5c49f9e7452b36e2c3982b449f96bc3b9c88e9d61ba91e277f46062e521d334a2b55b125311d6aba523340bfa1bf8e8
SSDEEP 24576:qAhGLJIFoiwtA5l7S539td7mPuI7cpctubZk:qAMyFoiq5NWPuIw
TLSH
T164359D80EBF945D4F5F3AAB899B68571EA76BCA95E31C20F1150D21F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cb076b76253b9661319d42e033b43b89317f5d739bf463e95ab17e168581f42d
MD5 c221edd6fc79c90b800f50ed3aec0c96
SHA1 acf3d4b66ecf1a89dd0a19b0c7ee2bd38b1df9cf
SHA512 15257ccac5e40bfdef1db7e8b183c7dd715b22151deaa5d93cbd02b6d3a0073c720af2941ac61bc580758580c24e9dd7755feb6ff12089a0bbb60e6273e44e5e
SSDEEP 12288:omw5HEjsChNJBFgl0WDm+Cakt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:FwukOWTtd7mPuI7cpctubZ9
TLSH
T1F575F14977A90CF9E9A78138C597C532F7B3BC052A25D71F4760C65B2F37221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 3c280ebce9696688cbf5344bc09a6e35133eb69f49a97be9e650bf1e0398313a
MD5 a8b0ec6d33a254800798e938d8a59215
SHA1 6615f11456936e197add81c9373eef818a75390a
SHA512 40d22cb99656065d077542acbdd7a938a54b489f69139ba86e383b1810c7da192781ba8e360d02264fff8655faddc7a4203d76e12a1d3ee60359d8e69cd1c1c7
SSDEEP 12288:eWZ1IyQkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDJ:PZuHtd7mPuI7cpctubZd
TLSH
T1B465134823E864F9E2A3C278D8F1CA81E7337855277943CF4616935A2F336E69E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 011cdf96640cb5495b0336766b88664d34c0410f281cb67e422f0cd5c8732ba2
MD5 989c5999b246797a823614987d63beaa
SHA1 689fc8eac65d65026f660fa1188111202ee7da42
SHA512 6654f39bbd873d6d8b1ecddb202bb7959e66379e0cd6f8fa83f40fccd27bc8a0d00ab5e784648c91398611298630b85281f0aa074f37fb0f68fd7e3047254e07
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:4QRQyi36YOcPQLvw2gAf+PN31PuIw
TLSH
T1A6666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 420c5331e2da9144ce1f09b346711702487133f0409ccf1febdc135b2ccbba56
MD5 c1c057dd01cb56ea817babfcc657fbad
SHA1 c4579b9813f39fa550c95adf13d8a2b4eac49cab
SHA512 139b08cc5c511dba93b6f9fe4983562eeab346840d56d1fc6a29484e04253de6a71a973f449b060663b2c02732a51acad9172079296a335f5b4e0dab1b12685d
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ui:6QRQyi36YOcPQLvw2gAf+PN31PuIw
TLSH
T167666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0c192622f020731ec6079e93c8c55c799119fe532c90a7eef5016ce82c0df561
MD5 57056b33cbec8c3fe72856300f89b555
SHA1 00bb3f10e4fd910ee3082b14258f6dcd4614ae11
SHA512 8e26bc1d5d5b0a6c57f9c432f167d67129e3c7ac869cb5f880ae4f5bfd33a07552ffe4fc51e404773c7023915bf10ef70a8d5e12fe981c81ba822a2b04653bda
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Xtd7mPuI7cpctuV:u68Qg55nhheWu7PNU3/wWPuIw
TLSH
T101B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB850572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 110c2fc61820a05fe7c9d1f63a0b806c65bffe1adf55b0cdb330a92739054866
MD5 5a0c09589d7b027844b66acc22378ab5
SHA1 8096f152a4bbe443c3b1dc9d3f998b3fdb5598d9
SHA512 a5e096bf6a1515f8ed0f980cab8b9e973cbee0fa27f61ca357a1dc4477c777f840b872d8a1aa84233f715ebc267a659f240129c94a7d0ce20e3405407dcdb4d7
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:Cy5112gYy5azzVvL69nLKnhZqPuIw
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba2aecf82643f4c317b82cd7be587f0482bef4b89be3021c9ffe7c2dc50ef8fc
MD5 e2195d684e5735ffa7206aef05c49c59
SHA1 0a1006a730d729e1b9cc610144336afdde582ea1
SHA512 aa21275cfb6a775601fd5888d905bf32255ea108fd96d74cc21792b90103d51ecea1abeac2b4c12d49f34e50eb4e8c4d354de711af104cb0519e66027d791700
SSDEEP 49152:xB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllWPuIw:nu6JmVxd2dgPuIw
TLSH
T1A8D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a02fc95f47bed584dbb05e25cd9a57e62ffafb2102352c30a3037426edf6bf3d
MD5 abd8d0d4674e5cf2d72a4737770309a5
SHA1 8c8bd770b18d6065a4b914f02c9ea48a71223bc7
SHA512 6462aac635cac31ed88793ce04750d98c83c668e717d766cbc35a9ce7fa41b53ad026ab5fbf6901d0cfe004c6cef5d4d00f6f4453e68239e01144efa6bf3b865
SSDEEP 24576:chv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3Wtd7mPuI7cpctuM:Q1hpsNoJpF1A6UU44CwH7R4xmWPuIw
TLSH
T1CEB5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e416f374ebe7aec9ee10374296e6f2d0b2160a87ba9d7c7f3d5700005dafa51f
MD5 efc2b9d5c9b09de8d3002f0eff1088ab
SHA1 2600e143f6f851e1cf68b10a1ebf0736df8db661
SHA512 97ebeea722b5548929c1c8efbadb7abfad9f713ca614935ab98fa99a29c97aae90546363280c9c2dd6a7c2350a59807805bc7f5f954f3b9e33f09328461b4544
SSDEEP 24576:O4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnqHtd7mPuY:SSuZQIY0Be2KRRVtOnks6NMHqHWPuIw
TLSH
T1E1C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b5e9749b1a72fb0554f4a85e1e5be1ad171dd7dc7937fce2617436961537c437
MD5 3dc3a773ca83473acb5d7a03c1c30f38
SHA1 ff154bb9dab3196574d4f91a77aca1a7ed19ee53
SHA512 9fa1fdc3bbc1b779a0b4e254429ea7264473186996f8f521387c003fa1436c7965ecc83651268387c35661c32e922f40c55e0701ea39e4203f2f1c846c5ef65b
SSDEEP 24576:ehiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLWtd7mPuI7cpctubZq:ehtSn8EApI0figngiDn0AP5wyWPuIw
TLSH
T1EB95BE13F2D900E8D05ED178C7568632EA62BC150B39A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 8b26330660e7d5754c92f329346ae60c4365707121dc23f737c7e52e7bf96609
MD5 920a82a11da3b80ce59170cc35e9ba40
SHA1 0e3977ea439c9421178fe8ac24020050f49042d8
SHA512 b8c00a9fe7ae726727b728828708b7a6e105beca6f5712dec4a969e1b6a36269649f9d005784166ee8b0ba311835b0f851b3ceccff3d42f1868bcefd5c8560a4
SSDEEP 12288:4xkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD7:4Ttd7mPuI7cpctubZn
TLSH
T1975523189B6E8CD5EA67C1B1F0F1C9C17A1B4E4DA8AD1352C74BF2072B7513EAA325D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 2ce2bc5d2de3f2032c0a9289f66a5e6d51a470a1062fdc9c2b1f51a1ceb0d963
MD5 c7b4760ab9cb394a173bbc053071fbfa
SHA1 140d465aa588f4be00b228f274c365bec599c894
SHA512 71add5f469391bd46e859f1d190427e660730129df7f0e799479269e9277913b8a5cca5250757d014744091c03d19594c7778bf8efbf807e6e537d03677f94fa
SSDEEP 12288:4kkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDF:4ctd7mPuI7cpctubZ5
TLSH
T1AA5523189B6E8CD5E667C1B1F0F1C9C1BE1B4E5DA86D1352C74BF2072B7523EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 7d6332edb50db97c676830ff5b0010bf4f9cd0bc74084e956c80360da16f5d2b
MD5 fa424124983eb4d472d7c70a5143ebd9
SHA1 74fd50a237eda3ba7ecafc62c82167a2fb855d38
SHA512 d028876312e5b017fe72f1e29adbe1167f3d744e6c235e3869d252ef7fd25f82f3a4f5fcb224bc0aad1ac8b003cc1ecc36640adc0054c40dd29109ac56317f24
SSDEEP 12288:bykt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD9:b+td7mPuI7cpctubZp
TLSH
T14E5523189B6E8CD5E667C1B1F0F1C9C1BE1B4E4DA8AD1352C74BF2062B7513E9A325D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0fbf025704ef1706edfd50540ce66b1b86def7f97a7df420fdca43f81d150a70
MD5 ab5e24f62c9e3a7210c536fba66b31d8
SHA1 35a91784352d362eba44a4d7f9632fd8e5a02681
SHA512 ca5c8e6dd031645a7fda8ee9704b7d7d267ddf9857a1bf26cb07ba9ba6d0c2223befa2add6066e08fbe0d928b69db80c1c12c50187d210e52d685ae0a4b4007d
SSDEEP 12288:iVnkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD0:Etd7mPuI7cpctubZI
TLSH
T1685523045B6E88D4E973C2B4E4F2C5C1FA377D98A939539BC702B24B1F71379A931A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 318df8e8d9f523a6603eb4c75ebfdfee2401fb4eff69994a3fa926bf9846ffa2
MD5 575a7da81161c8a71f1e473981931f28
SHA1 394dac74ad148ea771e0afc8931ac31668f9ab1b
SHA512 c476262ce73ef8585017ab9b7bdde141079ef84120625063b13dead446d765e090464451f51e35878914d9350ee36dfa08e91ab3f7ab6632e091ff18cbfa5b5b
SSDEEP 12288:Jvkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDe:Jltd7mPuI7cpctubZi
TLSH
T1E75523189B6E8CD5E667C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513DAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a819c048e2a999019dbb8fcfaac1710f006bde8431a9db14eff319f43cdc13ff
MD5 97f36a78dd3fde1b4c69015f48b82ffb
SHA1 4dadd735ce4011968853e7765665323724ddfca3
SHA512 8336025271f85616a940fc9f837e0f12d5f01c89a39df96b7061afcaa9ffba543def01d3d314f1c68a2f945406ea94cce14fe2e2ddad7da4525b9fed54a604cb
SSDEEP 12288:d4kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD0:d4td7mPuI7cpctubZo
TLSH
T1FC5523189B6E8CD5E667C1B1F0F1C9C1BA1B4E5DA8AD1352C74BF2072B7513EAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 2d73aa7d278084748b2552236b70fc634b1d16cd6c0cf650599993273df448a1
MD5 db307bfc6d88db6d7ca7ed1df693e29a
SHA1 3afac5ea17e74e8ed663080a0ee7e2ed8b6dafea
SHA512 6a9abb208ed9d40d9c737d2933c06583f28d9b615b14cb200dbd00787187b926a04f74386f4d9a90c8eef0b9089861b1a2a2575f4794b33502a73c7c582352be
SSDEEP 12288:HMkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD8:HEtd7mPuI7cpctubZw
TLSH
T1D85523189B6E8CD5EA67C1B0F0F1C9C17E1B4E4DA8AD1352C74BF2472B7513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 20aa443e60a7e913794e48843bc76808b27869ce0780de3f8ea38e94fcb4723f
MD5 eb726c600cd54450c5f9d1a20aedb835
SHA1 104b07906415e9b966e7232a02091ce08967992d
SHA512 435588414a0382e8b2adb8ece83ed8a1525e251f465cf9ec4e9541f5742ba294c95fbfd744a93077acbf9f229fc93cdb60a18f15913fa1b591e11d6abfc3cce8
SSDEEP 12288:oiZwbGzzFEoS2cPvyEkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDs:rZMGzFVSO8td7mPuI7cpctubZo
TLSH
T17D750194B3940CF8EC67823EC9658942E6B27C590A70C71F03A5366B1F733A15D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 88176e26ddad25e62c45b62ca2ed78e0ef4ca67ba4c9deb34b0dc15cf355c855
MD5 9200799c803976282c6a496fcaa12e4a
SHA1 23c49b0fb875fb8461a936c03aeb8e2281433ecf
SHA512 c755736ca7cb5d26e289bbefd2a4e82f1c4da43530d35c69acaeeb5677f88f54dd0cfe4364adbca286233760b3255ce706ef09ffd174192f760264451b894b7b
SSDEEP 12288:TNkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:T3td7mPuI7cpctubZk
TLSH
T1B65523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513E9A324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 601965dce907ae0412082508a6a6528b800ba51c531c8f0a367d50747770cd77
MD5 461b4a572d4d756bc50d6936347abafb
SHA1 516b5ded6d7bbb80d0a31745d85c15fe84ff3447
SHA512 a5cdc66591f53da0014e3b0ae0a8f944c75a188f1ad74c9c6e8c583c14945698ca4e9d6e487f0164a49940be4d160b5880c4f0b1395fa57c4751423e50bf878f
SSDEEP 12288:bJkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDe:bLtd7mPuI7cpctubZS
TLSH
T1FA5523189B6E8CD5EA67C1B0F0F1C9C17E1B4E5DA8AD1352C74BF2472B7513EAA224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 13c2370aa9315ade550ad966370a280a91763ed558d71771fd3c2f36888b9ad3
MD5 31d658cbed59b0d5db6929304e32deb3
SHA1 b2178288731b8384aac05e227696a6023ba64899
SHA512 9a911bfb2ee2b1573ab5a4503ac8b87f22a942f1b4e0aee84ef3480b62d040b3932cd60b95c43f8f2265085905f3c67cd2f1ad96a8dad0e7f149ec4a6e30b569
SSDEEP 12288:GyPz5L8Qkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDC:7zyQtd7mPuI7cpctubZW
TLSH
T1BC65020777A520F8D177C234C8A24A82F77678354B248BAF475453772F372A59E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 270eb79bbf3ef301dcd3ff731fb98b7a6d1218ddffd53419ee39ddcad6122ba0
MD5 433e09abfd7c141bca8f3f73ec2ca679
SHA1 d15427cd0c3fc4b7157fc94c12b1a20ef7428bd1
SHA512 84a8700e141bcd428f42b7a6102f73b585dc7773eeea9d0161c06a572951d655e4a375b34473956ce4ecb20b8235e6815adbed4e6f0912565481a47738d0ef5c
SSDEEP 12288:PNkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDz:P3td7mPuI7cpctubZf
TLSH
T1E65523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF20A2B7513E96324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 a8fff9165f2ea8f263a986b6a61813b156e9494560d62d580cb384932c177f22
MD5 958e6614e14c1b4d8711ab6d871a1c45
SHA1 51bd14cf127ada0760edb80d57cc923b8b0af485
SHA512 8e3235e02727b9f39406b938231f4864529b7ec1a398589d50c1c16f1a6daefb7320c676b539f50895d9eedb00268342bf7cce5e3ba63b28fea860085f259435
SSDEEP 12288:dNkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDX:d3td7mPuI7cpctubZr
TLSH
T1C75523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF20A2B7513E96324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ed184fd0272fb333ef4c1ea454b9b432696aacd82dfa0db8a67fa1228ed889a5
MD5 c0e8ecdb5d0f161fbcaa8525539cbc8c
SHA1 aa6f2ca7d0fc1793d91ad8f508f77a2a223c648c
SHA512 9537d3c4f3aaced43b32685a552e57b3ad87e59e4ebafcaec882b1e446a8c15cb7fcf6b68d30fd96da297b8dedd7aeb180cb1a4e9cd3ece241388e2f8a3fe29c
SSDEEP 12288:5yPz5L8Qkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDD:4zyQtd7mPuI7cpctubZH
TLSH
T1CF65020777A520F8D177C234C8A24A82F77678354B248BAF479453772F372A59E3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 f56869e2c51ee3b41e00ac15c0e1ec31accb475684e81582f51812774db880ed
MD5 b01580c37743118b5011f9fcad990555
SHA1 f5378447643729d3365acd687113b36b25babc91
SHA512 8f8069de5a526befe0d0ec4294b642213b51525d57cd4e9fbc051daa6b1c1ae0852983256d57527fa898be0f545a84a460227d7c42d1c1d2a97ed6e69e446671
SSDEEP 12288:yCd9SWYoaLHF3z0z04PDvhikt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDA:TTTaLl3z0zDOtd7mPuI7cpctubZs
TLSH
T19E7501A4B3504CF8ED67813EC8618946E6B27C5A0B74C71F03A9366B1F333A15D3AB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 0e75b29e3479f496e2c2360b69b5acf1ddd57b22c7781b6d5a16ff9c2151391f
MD5 143116ba642c329addfff14225128ee8
SHA1 2a5ecd9824c15192381d84757a0ab417df7d86bb
SHA512 a9fcb34289a8227dbbf9dacb4795c9d0855bd53997369e00eb682c4030eb69da2dc438b917ebeef445ababb98b17a716438cc5812cc67bc3d0cf4ecadeb7fe87
SSDEEP 12288:oi4e7zRdTfgwCHKy7GLbbdIvzkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDr:o34d9CHKy7GZKtd7mPuI7cpctubZ3
TLSH
T14385CF90F3E814E8F1B7CA35C9768512DA767C591B31DA8F03A4661A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 3cd69ef7462fbce55d74fb689198398783055ebe2b4090e326eef438ef1578e3
MD5 a0d630db8f36a48e8a3c7c1fba0e0df1
SHA1 422b9896d85fe6275b1c22a2b0ccf57c247158a5
SHA512 06b36294c705dd50552df1827391d6d3331639778cdc04e84573fefa45eb795263f0ce9d07abf035c0a6e1bc79a86701d1efb08c03afa6430602ed1202464b3b
SSDEEP 12288:ySkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD8:yetd7mPuI7cpctubZo
TLSH
T10B5523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513DAA324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 902ce2293873ee04784a6bca26abf83c974927dafb1f4b8b5a0e4c4360a6ac35
MD5 6e61d6c35a7e1d5fa3a65653bddb3436
SHA1 f3b8fa2aefdebabbb4c0ca73e11502828ac3c443
SHA512 7ae5e77f3daae51be8294ac000f13588c9b1887177e2eb89596daea8998d2445071505938f9bb965de80176e295ebbe787a88b13b317accfcdcf024045770a64
SSDEEP 12288:wwkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDR:wwtd7mPuI7cpctubZl
TLSH
T1DB5523189B6E8CE5EA67C1B1F0F1C9C17E1B4E5DA8AD1352C74BF2072B7513A9A324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 2b9b4755ed1503c67692c443145305403d971527acc3a8f54a228f23c1fdc28b
MD5 b62c41e57ba543cc3df8b22f93e5d2dd
SHA1 a9694d0a773602f048a9b61ff0c9de22253de509
SHA512 aff48266054851f15c97e18d23caf6a93abf98966bbda394de0dc09b0b1da5be38a531a0fe3ad11928057cd8e1b10a93b2625401e10791125e83eff699c727da
SSDEEP 12288:Gzkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:Gxtd7mPuI7cpctubZM
TLSH
T1A85523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513EA6324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 87024e00630b425e8d88b958b5244539f7833c0ab848b265d30031439790e630
MD5 4e1754209f56b0f8a9769c9001401623
SHA1 0db0fca7ae2172c0310ed1f6ed9f14a04a6ff011
SHA512 cf722d90cdc697f8a85ed7ba4b278345dba9ae79bd90b48ab0fe611c04ae79bbd3dfa7fbccbd43c33519dc464cfc1cc7d0e7ab8e3a38a1f385c3dbda4aa990f1
SSDEEP 12288:qNkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDw:q3td7mPuI7cpctubZM
TLSH
T1DE5523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF20A2B7513E96324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 78229cf57e996d1999f8832e1a41e663132fef43f534fed93f301c53b824cc4c
MD5 c16454269501131cadb2f732230860a6
SHA1 56f15dc5cec30858a0e906258b81dd26a2b7c71c
SHA512 9c24a82c2cded408e555121804757f582944f76a2dda59ba588762bf3361f6c45584afbe576635080fe5fc9052f0569b21fa09f79744b4ba15080c0613f7dffc
SSDEEP 12288:6Skt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDq:6etd7mPuI7cpctubZ2
TLSH
T1F35523189B6E8CD5EA67C1B1F0F1C9C1BE1B4E5DA8AD1352C74BF2062B7513D9A324D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 f2ce6279bb6d6da42e2f5edde8b0efbd49318342ef3fe5a60e709582ae2d858e
MD5 f186b59adbc4d14ba30083d0d563d9b0
SHA1 9a01caad4f835fdd2d3be608294a766bb1d75ac0
SHA512 f7eac93cae1bd45b7f9aba5870a5544b4fd6baccc857d00b9d46079ac21cf616c18936cbcd24fb4e1136c1e20d05a363e94315a1150e1d96594bacd8a0d497d0
SSDEEP 12288:j1kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD2:jftd7mPuI7cpctubZq
TLSH
T1325523189B6E8CD5EA67C1B1F0F1C9D17E1B4E8DA8AD1352C74BF20B2B7513E96224D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 befe9442f76d34818c92c717ff4de2ffb189df2f50df164aee83ccafea28b05b
MD5 f4ba769110867dc1a01e613313c6118a
SHA1 ca08967790f4d84e798d001d418a734f1fe2b0f9
SHA512 7ca46d24cd73c67e822991aa976ebdc581b720777cb27e1b2a39b71e17bea1e73384356558c2f80f864641d65ba2d9d80d960775488a23b56fced8537c09b5e1
SSDEEP 24576:8fwv0k9RX6wkyAI8td7mPuI7cpctubZV:QMnYI8WPuIw
TLSH
T14F85DF29EBDC44E5E1B7923C99B34646F6B178591B31C2CF025A536E0E33EE45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8595e5f7dfcd16f0eb71e4b95a8a6501c43f0b8bf3fb510ddb0c8f739eb07708
MD5 2735c1f15a6bd6c23c543b7f394ef080
SHA1 c1c5b5f2c4a6f0bcd288fe5c1e1c74efafcbaaea
SHA512 be387715d043a438ecbf754edbb782bb63ba551af248d130d50ccb9e7f292ae7dc2ce6604337d3fce393fa10772186e71a9d33c18c15cf649e698cd08e03c3ba
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SWPuIw:bySzPVPuIw
TLSH
T1F3066C96A16841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f239038ed3d99e62db961287052f2cff423a9830b071a3d8a1d5818b209505b4
MD5 e82a12368351df1ef453ec0a93ef9da2
SHA1 6ae6d991a3232a66eabb7011c02efde0a3b7f2ce
SHA512 ac8d3f5d3d637d92b392d303cee6ac6fcc7924ac8367fbc9229a598201e66c30edf8a5d80f174eb737b597a461e49f8c0c9f6a8e620e9985eb0e3053c754f65f
SSDEEP 24576:e47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYstd7mPuI7cpctubZo:e47JUQj1irIhCnDHUPfF/CWPuIw
TLSH
T178659D1DA3EC01E5E1BA827885558A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4df33af52a6a47cfa3820ff4bcbbc0d9a37781e6a37a68d65058457009eff329
MD5 9e68a3602a42eb1168a067683773d8ef
SHA1 42745958b2af26ce6155c2f50deda14f30830c48
SHA512 e381605ba1ca7c391f59518a0e61e3e382745349f3955c3de291874e1952574254d4dc2c434f48c2a17e4b844574b21f9820da505d11fd6b1b4397bc73ff06d5
SSDEEP 12288:W8sf9kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtD1:gHtd7mPuI7cpctubZx
TLSH
T16765F108D39841E8D06F9275C7A28A81B7337C6597E193CB43C1F53E1F762A49EE6A43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6edaa615ed4d80afc3dc6f8d0b153a773aab51bab81ebf83c7b5940bad41557c
MD5 167154d5fcfe2b4c2ace24dc781ca251
SHA1 cde5c528ccffcc4f1a53de9f8c19b674dfafdafc
SHA512 93aa6d3466800f7a310198bf191b3a8182395130956522d214e3cccef047da01d96d05a3d92344275dbbae03f53fb1aa58e0f5c86edde6c73a5c08a212d79a6a
SSDEEP 12288:IR1CbU3ffLQ6FrC3CadCxEwtfcCwiAVokvkLkCh5P+:I3oUPf5FodCxEwXVkvkLRh52
TLSH
T1363538107666DB4FC6A940325E33D2CCAB707D01EE45AB0372C9873FC576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 20e0250c6241605edc6e3fbf9017a3287041edadf35b68127d881667c49c7dec
MD5 7c2352a29ec319c96c17d20c7d3a0062
SHA1 33bbe5a75c705129f768d82c30025e1f1a1d7036
SHA512 6ca864657f54499a33af2ab826c3803f9f9ea4e37be1d01f630165f5594ccab45c3ca4db463a460f7ced73b3872cbabb93679738f692899f964622ea1d5f5a37
SSDEEP 24576:Sv8+g4dRB6fUBSBIpGzSBafUH6pG9pG5ETEa:5+g4dRB6fUBSBIpGzSBafUapG9pGc
TLSH
T1A255C7405537E6CFD1F72032072B9B4CA764ED06B709AF27A3C9557AD86AB11B0B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 196932173faa84434691dd856eafdfb09674026de0f4df8ff5bccf41770c78c5
MD5 de47a0c2cc2327d9658dea996ad2ecb2
SHA1 cfc18147afc01457c2b7f2efcd859ac5ef7dd648
SHA512 d5ad2c40ec77ecb41c93e397e127f67dcb761771dc2367ec6830ffc1c0728326a5a725234ce162f7f351789847107007ec09655886de30bc85588dd3f0aea54a
SSDEEP 12288:Gk7Ykt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDv:3Ytd7mPuI7cpctubZL
TLSH
T1AF5523148B5D8CD5F9B7C2B0F0F6C5E17A1B8A585F6842D3C607B38A2A711F9DE32681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0693f2b97939b8105f0c3e538f206f8c0093538001ec33501b624293ae81176
MD5 82aee5022a641f6d3505c606cfe78fcd
SHA1 f015810b52c5e6ac9a6d4948da1277f74b542e59
SHA512 13e94917fe898dc8a76098e861107e384e189e9d92662e31adc28028c75eeaa6289bf2bda288326276dff037330b15f6a63ef83229d57e447a9be04dc287b826
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYJtd7mPuI7cpctubZn:dgb4mBIBhGFsWPuIw
TLSH
T1D465AE1E22EC02F5E0FAD2B8DDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 9c4d8284cf127f9709e5ada8bf55a552f9c858e1c084da32d4d7186a496eb2f3
MD5 956c72e0a7452c1f6db5f70ae967b42f
SHA1 974bf26fd9bfbae4f33199979a2aecc63472a9b6
SHA512 68e75c89b3452fe1f507f04f66f7946f86df8f076f020fc4c0e55806764b469b11f521b9a9ab6664b1e916562f6df0ae252c007ac9eed1d13e62d6fd87598143
SSDEEP 24576:S8kNvNnaFeYhJNtmZBmBtd7mPuI7cpctubZQ:S8MwBtOmBWPuIw
TLSH
T18A55AF6EABB845E4D1FAC6B4DD238512EA727461173293CB4390C13F0E679D89E36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 83a37d6de5f2ba0c249414a7e34b77ed688961e115ff2dc7695acb4f21c4efeb
MD5 352952c3081aff5621f0da941b9ce32d
SHA1 55571837c31f07572726fdba8be2c5ac1b1a8cfb
SHA512 993edfdd1d01393ede8a1975a5419dc8b611a078ee53fc43cde3742ad94e549bace03457c197b84b74a204d5e40858dd4f516d70ac9006b21751407f98247fb2
SSDEEP 24576:DG88u8FpJqH13zria7/m8td7mPuI7cpctubZx:y7ZFPqVKa7/RWPuIw
TLSH
T16595F16567E501F0D47BD138C98286A3F6B2B8250364EBDF07988B561F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7199da7568df48529a7004ccf7c1fcee2c01a081607a65ebec4830efa256a765
MD5 a46b328e7013eebf083a126acc0033bd
SHA1 785cbfa99e9496c838a10c9be98b236d3bb72962
SHA512 0edf4794682886e97d3791487faf588680ce329a384edbb26f27e9b0cec46ee305ac5f9dd58a276f27822cdbead25ae9a917ead88fa2518dea860494507e760b
SSDEEP 12288:DHvUrBFrEjwaQ1kt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDk:DPUr+NQftd7mPuI7cpctubZQ
TLSH
T16475E12E63AD1CE5E676E17CC5828649F772B862171192CF02D1817E0F73AE8BD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 0d95170e296a5d1178d552ce196c8152ea186fd4a6dab9802e7a7e8a463073db
MD5 5affc1f82a85b95acaaa75b761914fc2
SHA1 51b4f6a76777707b3e91b8c869976a89947478f4
SHA512 5e608eb0afbd5bd36d0a4a23cbd12cda5454feb25adb9d2c25f9f1dea9b9e9eb449a9ec87e92a11ab4a3e8dcb6bb9c9f9d12ed3e31d282618cffddaf738b9809
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPWPuIw:ZG05lO43b7PuIw
TLSH
T1E1D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23415033556CB02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c9c9ebb822a57a124026dcab5c1206f29b65e918cdd89c6594735cba890c3176
MD5 b172aa76d1097224dd8645d507429785
SHA1 74b9d57ee610aabd06eb34047dc56c4e5fc29f03
SHA512 a7db20bf3f0bab5a81df9c0fe32af1c55d69b2c5a8d823031a19b10d84e7ad7f88d4f479a363574916e75b24f255a62de52048a66a55c48c7a6cd282fe75b51e
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnStd7mPuI7cpctubZH:xa5POZ3+Jt2pasx2+mwWPuIw
TLSH
T1A765AE5DA7FC00D5D5BAD17DC583861AE5B2342553319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d8e464bfc636dfecca786ff303e5967179a21a2be9c9f7c2b3f906e021414a13
MD5 de341e95d6e31cc34c4768d5a6ea47bf
SHA1 37173f2897760f971d5bbe8f88323f7b8ef4a942
SHA512 2da4b9b59ef7e3c8fe21d04452c6ad77b510fc19f991371f953661bc76c7085831be4de72faeb00f90b524fff556b6a7c8ebfb2fa162fe867af203fb7947bdb0
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7Fkztd7mPuI7cpctubZC:bNc/zEOVHFuWPuIw
TLSH
T104857B1623E901E4F5BBE1BE89779946FA717869133486CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 f99cbd521dbc39c91aa2cead798c2dcd80ab00649e89b722b232faacc3fbdd97
MD5 faed199d5b5163aad0fa7aed3fda04c0
SHA1 e53994d2a7d423cce5fe0484ee0539f3d1c09030
SHA512 a252cf22067982a923a4fa0a3236afa7d3cf20d1b550215cbe96d5dc0348f8df4ba88e4c8d3fe4ced56da61851f6891587da41c1011b63ad7b3b2e92f09b0bb8
SSDEEP 24576:I6DIz0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Oi:I6DI04p7012GuSzfi
TLSH
T18325025D63BA10F8D46BD03D82520602E6B2B1B4872296EF1794C5BD4EB3EC8B53DEC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 23871dee8b1fb8bb9784b1cced943242f8a4b77d48823c87c2db42b1c5994dee
MD5 77806c299e713a87f2ba47a121e37f94
SHA1 4d84968f03bfa8d24c284b204a724502f0c697d2
SHA512 ee9089e4a7d3f4fdb33fc8a98c5b5a77b5109d6f21d55825cd242252f3c0ec83aaff1598c4300f1d64a7f7fe4ee34e30f53d691db960b71ff1953e8c99acdc7b
SSDEEP 12288:cQcMxWDXN1Dp/fshBItT1IQgARkt2VtKqbUb4mNdonIwsI9Ec7tc4kuoWHjtDd:mD3FHshBIYQgAztd7mPuI7cpctubZZ
TLSH
T1FE85E13DE75C04E4E57BC1BCD6A38A06E77238A9032156CB0294D1BA1F6BEE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/800-74-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/800-328-0x0000000140000000-0x0000000140183000-memory.dmp

Download

memory/800-81-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/800-75-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/960-106-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/960-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/960-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/960-353-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/960-99-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/960-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1080-169-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1080-167-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1080-339-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/1080-340-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1080-174-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1580-6-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/1580-134-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/1580-9-0x0000000002CB0000-0x0000000002D35000-memory.dmp

Download

memory/1580-1-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/1580-7-0x0000000000C40000-0x0000000000CA7000-memory.dmp

Download

memory/1580-0-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/1580-14-0x0000000002CB0000-0x0000000002D35000-memory.dmp

Download

memory/1580-72-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/1728-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1728-159-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1728-151-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1728-157-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1728-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1944-91-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/1944-86-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/1944-85-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/1944-332-0x0000000000400000-0x000000000054F000-memory.dmp

Download

memory/2600-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2600-123-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2600-129-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2600-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2600-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2600-336-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4148-335-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/4148-146-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4148-140-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4148-137-0x0000000140000000-0x00000001401F7000-memory.dmp

Download

memory/4692-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4692-68-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4692-61-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4692-303-0x0000000140000000-0x0000000140188000-memory.dmp

Download

memory/4960-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-39-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4960-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-40-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4960-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5116-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5116-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5116-29-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5116-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5912-45-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/5912-46-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5912-54-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5912-57-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5912-59-0x0000000140000000-0x000000014018D000-memory.dmp

Download