6c3b8df595868b61c003a9301a272c0e463925a96dedeae6c505e09d1f6e5377

Analysis

max time kernel
130s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
Size 2.7MB
Sample260702-ntntnsfv8q
SHA256 6c3b8df595868b61c003a9301a272c0e463925a96dedeae6c505e09d1f6e5377
MD5 5002cf09bd2306b64941a3b74285a2b9
SHA1 227bee86f8c65ab5ffc4ad679d6efd4e8064d018
SHA512 81b64d008d6a70ec1977702a1e498e0c3f191f90b288ece54a2065e3f7e0decdc201d61621f8c593f559f3c378c89d4a48cb8e29f1e90b2d67591af33ac10189
SSDEEP 49152:06OM8Tg6ARo/5wMGLlK8WhvgheyPJNjbwjtLfiu7ixZHCRMDmg27RnWGj:0VVg6L5hGZK8CTSCCD527BWG
TLSH
T196D52612A381C41AE5620074D66E53FDA9152E73F724DCDB73C0BEAE35B16D1AA32723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5988	elevation_service.exe
3476	elevation_service.exe
4732	maintenanceservice.exe
2680	OSE.EXE
4664	PerceptionSimulationService.exe
5944	perfhost.exe
5216	ReFsDedupSvc.exe
5848	SensorDataService.exe
1240	ssh-agent.exe
1416	AgentService.exe
2524	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b1e050059cd5fa8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003aef89c6170add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f81a5108180add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008bb452c6170add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007594eac6170add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f55ff7c5170add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c48e0bc6170add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043acfc07180add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000124397c5170add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e47d3ac7170add01	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{0F46B1BF-F5AD-442F-8917-3CF71475A2CD}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{B7C84322-CA3E-4465-99DA-3FE3A581B806}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1480	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
1480	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
5988	elevation_service.exe
5988	elevation_service.exe
5988	elevation_service.exe
5988	elevation_service.exe
5988	elevation_service.exe
5988	elevation_service.exe
5988	elevation_service.exe
4912	explorer.exe
4912	explorer.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe
3476	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1480	2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5216	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5216	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1416	AgentService.exe
Token: 33	2524	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2524	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2524	SearchIndexer.exe
Token: SeDebugPrivilege	5988	elevation_service.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeShutdownPrivilege	4912	explorer.exe
Token: SeCreatePagefilePrivilege	4912	explorer.exe
Token: SeDebugPrivilege	3476	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
4236	sihost.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe
4912	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4588	StartMenuExperienceHost.exe
1048	SearchHost.exe
4912	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1268	2524	SearchIndexer.exe	99
PID 2524 wrote to memory of 3848	2524	SearchIndexer.exe	100
PID 2524 wrote to memory of 2472	2524	SearchIndexer.exe	101
PID 2524 wrote to memory of 2640	2524	SearchIndexer.exe	102
PID 4236 wrote to memory of 4912	4236	sihost.exe	108
PID 2524 wrote to memory of 2336	2524	SearchIndexer.exe	115
PID 2524 wrote to memory of 3224	2524	SearchIndexer.exe	116
PID 2524 wrote to memory of 3216	2524	SearchIndexer.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_5002cf09bd2306b64941a3b74285a2b9_darkgate_elex_remcos_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4732

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5216

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5848

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1240

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1416

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2828 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3216

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4912

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1048

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fbcf7aab1a725c6d86ff69eafdc2b205b5e2c3d854839668a97635b773e1639e
MD5 127975ad2ee8cb556edbb23516df0c17
SHA1 9ffde62bbada980ed5d9ef4fbb2ef752ad6d5d29
SHA512 657043983873716f8eb7254eed0138f5a16ea071fc5e0d15329faa89e7029578cad0344a969dee8221410204f9112edb1b15b14543e534d71ea89e9e5daa40f1
SSDEEP 49152:0b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnsDmg27RnWGj:u3q6sjBDD527BWG
TLSH
T1F9D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3a5d6b75839db62cb5e153d3fdd1d67225cadff1ce90f62d9c2f3dad15be5b35
MD5 d2b0ad3b18bc7dd3c8b8ea4212b15298
SHA1 688a405e058a64f000834254eecd5306fd5a6596
SHA512 66df72e2a4e02f44fb8a14e9921b4a7cf329ba0a1f892a1beb60e2cc381513e4eb86afbfdbd00b12f46d1efea0deb6213d6c5852f0751728174d10b97452348f
SSDEEP 24576:EXYfDtczA7sqjnhMgeiCl7G0nehbGZpbD:jtcKDmg27RnWGj
TLSH
T1E7650129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 bcdcd46b83590e6cc571645feb01d853805770aa3d9c3ea6d51f08a18efe9aa6
MD5 bccabfa5c76973521a143b38d95ce0af
SHA1 372582de4e3253ac4147ea2505d85199a3fd3a91
SHA512 6f5c30b48434abd7fcde68d6302ec56605b5b2c545c48b2903cb9f2f0000913f9ed0144b0a7c9563767515ece1dbf6463dabec693b3bb095510e9397ce7e34c1
SSDEEP 24576:p0Le5ji0hmxxrM4sqjnhMgeiCl7G0nehbGZpbD:pPji0AjhDmg27RnWGj
TLSH
T140859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b60f32177979923718d1250488e6654c435ea4ec61a8ba4fbaadc005313663e9
MD5 a51dcb60dd8d4018c6270a715df14637
SHA1 eb1deb4234cf82834743cf9fe1f31d06b9a8b5e1
SHA512 3a7b9bfc1c545d65024371a7675daf989e7c73cfe37cd1e1217b7d08fb0f6eee6f519f89b63fe1f7e214933440b5f672e0430306ed31a297e0f63247b6da6d4f
SSDEEP 24576:ra7/ezSC6vUyD/aqgrvWn6q8wyu2sqjnhMgeiCl7G0nehbGZpbD:G/ezSC6vUzPveHjy9Dmg27RnWGj
TLSH
T110755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 81aea468f52e373af3fdd93ffb0b9a351d1ec6a2f325b306a6a4df1c03844b55
MD5 3dfcf9a5a6ea845f6ba3df00788712f2
SHA1 b630787dbf958bbf0b98f585e40c01ee394286f0
SHA512 20ff405f99dc646562e915f2c110a2218750f08ff0d516629a7143b4f1636ec0d3f823b69275fc06146eeb6af078a7390331fd736d2b7a8529e407faccbfdcdc
SSDEEP 24576:WVbqPb88hv/l+YPsqjnhMgeiCl7G0nehbGZpbD:WVO88hXl+CDmg27RnWGj
TLSH
T12C559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2849692b0c2cda6730d48c0878ade7ad0c1b11221081c2a7eab95e5ab8b2d7ed
MD5 92559e0ea9a8b27263852a7613c6851f
SHA1 7dbd54ce4a359c96dd70149a1ca033e8dbcab7c7
SHA512 5907f02ebba25fd43289147bb8f96daf9c407a9658a39555716d4e6655fb7ee7899a9cb276bef1518bdfa95fee597f91b0069f402fe2efaef15f9f7ecf6d230f
SSDEEP 12288:cLMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cLMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BF865C50DAEB7608B5C3E9F11EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 d6b4b321b6159c13eb54703495c62f8ba38ca1bc45dee9fab4a35cbeff0e5086
MD5 58b24642a65fb8621e82257c0c5ec375
SHA1 16803b4b7841abf3a65a9f764d99af2bc708b21b
SHA512 25da231f81bdc5928caeddda5b529791384f3db51472dcfde019c3277c1176df4b9d15b481988ece178de2c67762f50cfb1fbf133d0e4e5524af0d5cad4c92c8
SSDEEP 12288:2eBNUbTVO86U3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:2JIU3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E465CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 be24e16a1b16267b8abee2ecc5a96910cc47b65d64b1e0c60f5e06130370992b
MD5 8284e06b0f91cd6350e1fb9ad7867982
SHA1 d64b32cccb536e55ac258114b80a6883a9ce438f
SHA512 6b0650d6404d3b3622f04d5941453785bd22f8aaf05bd94ebb60a3305a12921b7ce7008f11d62d99c5287d760c29b822ca8620dd2d9b4ee0fb8121c5529a80f6
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH6:jQvGAdlCEL8c/DRNw5CqD527BWG
TLSH
T1AE266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1201621533a221f7e54271e1c18ddaea0f85bf771aff69d3cc1ec12638f0e0e8
MD5 0cc03086023d7f901856b8b2b6d74d36
SHA1 22607560dcc2db71172951e79adda4122acada10
SHA512 752acedb5a72781f72a11a3945fee035f7f73191fdc4d0a4e3262b8b0a7bcd720aca7d696245e92e1f19a5abec63ee2e2cb057ccc263c9df7380dd35c05a7cb6
SSDEEP 12288:GAwSfxL/2Dc3RDLLmt0LDQewsAjtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:b0ewsAjtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F875E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3dd702466907a13a5dcb6b079573162a3d1430524c35f4a7123f29f7261e44bc
MD5 d2aafcb2fb7889fc1c24cb3ee3fbfb62
SHA1 a82cb31f9dff0d0c242410900d405b619828d171
SHA512 d675836ae369cf636d458d2b6dacafb01d6af06cdfc816c942b4578b871503f34a4d160d4da7afb88bbbecae612149c37c394e2f40f274e6a6b1a2cf1b9537a5
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH5VQBWG:EUEtQevvqc2W1cpV2tI32EB
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9488ed291f90a9b66fb0c60fcfe90503b080e9494d63075da8419603b03a212f
MD5 c77d088f138bb12bfdf5f879708a645f
SHA1 881976362e01cce015085e9453c3d7de5668f8df
SHA512 21e4c3463d764bdb8547c8d7f3a39aff6d411a3575a86b9d08252c2f1edef36edcc5167561dfb870f026ef90897b875b05b05fcbacb4ea9d228843249373f9ac
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zxDmg27RnWGj:qoquVjnmGD527BWG
TLSH
T1B1D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 01ea3e8a3012acf0f7901f7816b7ff80c0c43949ff4eb888d94fb208e04a5eb8
MD5 d769057722d1955cd9c7661b5ced09a1
SHA1 abbbc835414b4f276a226c12f8481249b82bbfd0
SHA512 9ca536abf1f41c7e755d65c9c223a937e92f5ffef4f3d66e58084f0b55fca7106b92d0afd25b1fc068ac2822d13e3f8f057dfc6bb0d77781dffa051872cd231a
SSDEEP 24576:PAhGL3IFoiwtA5l7S53isqjnhMgeiCl7G0nehbGZpbD:PAMUFoiq52Dmg27RnWGj
TLSH
T108359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 cfdb222123c109d6e46fb54c33a897c7d975e332f18756f68d57a5cbffcd8cd6
MD5 abc8c483c3b2f169f19072ee990c0638
SHA1 ec5a8092be96a77f432fbcc848dea23a8bc21d5f
SHA512 bbf51204ee098010dba1df4234e1dfa6d95b89fe1bce54086a20e1e3d8e10775ce1739f71e6859a6f06e43d2c613e33c5835348beb364a8e65eaac9b4423adbd
SSDEEP 12288:wmw5HEjsChNVBFgl0WDm+CWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:twu4OWZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D65F14A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F37260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9e808a3fb85b065f53e10faeecb6394ebe315749a9d2c6972c0832cb8908a5f0
MD5 35e87cbbc65ccbbc4ac8a29d78509d39
SHA1 5477edefc5b3571356a23763545d303cf2a53b12
SHA512 ecc3906f6b71f94254df0511451f0e2f058ab268730175391932e66c8b4108691a88a9b2e20fef30e929dfe57e7e16f5cafa541b3ad194266059c8258fa0ec09
SSDEEP 12288:WeZ1IydXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LZugsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1075512AA239820FAE163417CC5E5D609E7337C62673003CF166659AA6F739D44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 97a9ed99fae1b633fbb7cc116703786beffb002338f332f80b3cc486f26f66ca
MD5 557bc827a4197110e2eda892443f2f04
SHA1 7990778e0388df46058ea126bf2147f0e9d8d4af
SHA512 c971ab1c4f0b7d76e09bea3e1d2cdc09f9a7f68b2a8b11bae7633628d1e6e91ac50964a12d9ed302fcaa7d362e33ac302e0be4939c6d815ac37c017d04274953
SSDEEP 98304:2QRQyi36YOcPbLvw2gAf+PN3HD527BWG:9QyiKa/X+PNXVQBWG
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a53d249f1cb6ab06fad2946c12753381f5883873a91d1bea09e7e7458a862465
MD5 0fd62e6ef5ebfc8a1036cb601485482b
SHA1 bfd1afbbb56526117c88cb6e58bc07daae0a9141
SHA512 4cfea6c452b16da0848ceb6ec7208d16724ca24e4b62af891871fa8e44c5983f9f8115c1b38e2c4bb0c9c9ffee2df83473bd657a5d13499bc03deaf62bdc275a
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN3HD527BWG:TQyiKa/X+PNXVQBWG
TLSH
T10A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f3c39bca645f889c3523f0f9bfb98bb90c29cc88c394176e58b58f8a0afb1540
MD5 040b55f71a770a3edb47aa23357e644d
SHA1 28e41bdf09b54af99a50ba9594f622b784ba83c9
SHA512 026b4eb017f7e638e0eff810665792722d97af7e508c231b4906bbdf77dfb4c5087849cfb0072fdd130c120d7500ec9b9d9887f1bcc7aa94539b948063925306
SSDEEP 24576:HwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0wsqjnhMgeiCl7Ge:v68Qg55nhceWu7PNU3/hDmg27RnWGj
TLSH
T10FB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f02dec239284131b6d66132d853981fbe780d4aa40450ac95f0cb6c9d481852
MD5 06df17e0cbcf281b59bb32b0616916b6
SHA1 be09b2a4fb7ac69ff5c404d3f39a7a2b6b2af780
SHA512 5700a9435542ef348dd1d6cdb4a424bfc5f0bc9aee75c0411ac71a0832b018fe49488b4fe6e82ba3363c318453700e55ae5a9f43a84045b7feea3936a3ebf345
SSDEEP 98304:Qy5112gYy5azzVvt69nLKnhZ4D527BWG:pLIHEWhOVQBWG
TLSH
T1B7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 949cb78e61828cace8c9a86d0e8186e68fb4ddff1903c360bbc1eee236622af5
MD5 cc7090e9c2c13adad54575e908d13a27
SHA1 52c4f89c0d77d089de89c1e328c16062c7f1e226
SHA512 70a08ae45eb053aa989eb4411bac2e142a9184f7947300991fd66302fe06a75499732e2f26431fc4346e4888a833dca4f0484c2f5267234e800370072e1cc2c3
SSDEEP 49152:2B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl/Dmg27RnWGj:Eu6Jmdxd2d/D527BWG
TLSH
T1E9D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c200892146ab7c94d44b7c013059e18c0a53c137120939141e85fc7564997370
MD5 f66d0f80c97db6d720cb0b775042b51a
SHA1 16956fedf53261f13e40f8b374059e78044fa0aa
SHA512 5cdd92c924b02caf5592519d3da5538721ed673463447e02410397baaf6ed0f33023db37ccfbfb87f610eba42695f6430a440bb054536f402f11eef8a7ab13d8
SSDEEP 49152:61hpsNoJpF1A63U44CwH7R4xrDmg27RnWGj:6mifPWRGD527BWG
TLSH
T1DAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 51e9d294395759da1a062a54f655af36cb999e22b08891379640cb007228dc9b
MD5 20077dce222a5f504e5ad7dd19e951f4
SHA1 4b7a5fde135ff1d496f8778ce089627d84dc5d4f
SHA512 961d5abc752a8d868496a00e630b773fb848e8ff2ffcade9faab988a355bb53f7204d9729eea9a6fe6c93c5f6e304e1d51eb3be470841b15b2d708a6fa1a5a8a
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqcDmg27RnWGj:Q5dKii61cD527BWG
TLSH
T1DEC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0f1ccab5babd5f94bbf8a96177793027bcbd5686fc9310fbbc50231a519ead3a
MD5 12634b1198652e3fc7579d0c563ca5f5
SHA1 fde8cd14f24e289db3d8064b28bf1ee04a91a915
SHA512 3d7654a1481d7cd11b68a984839e9dd5f0ebf3a75be25ff2a10108811522094bb97c7ef8493ddd6ca537bf07c589f052f7b32f8b441ceb27110bd1f884133dc6
SSDEEP 49152:ThtSn8EApI0fig3giDn0AP5wvDmg27RnWGj:SX2imphyD527BWG
TLSH
T1DF95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 c5b4ee2a66cb8cab530ff4ab18edd3d15b7febe22c6e082af7002b12b2f2fcb6
MD5 836516a38afd95ded7e0068e2141885e
SHA1 0d7042abfc193b4ca9628e68e8b4a5b192b23a6e
SHA512 608128bab976ec1e9247fb87f96d4490b0d772483b7e880995c69dacc65ef8cbd376852f132c441dae20e0fbd4a27eb03fd922a9b1496d50575dbb3b4fd21c8e
SSDEEP 12288:q0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1654523BF965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e46007a870047c4a6ea592ad3260b380472b66f0052e6f98e56eb56b1b2b9963
MD5 337fd5d017c449bd515a1d6a6d59bd3b
SHA1 40fce5e9f92d7c61645324c29ce1c1097be3145b
SHA512 7d0b7361f99b465428ca7a8e6ef958a7dc44c7ec9e22ca3a8924313c95f278eec3a0e3fe568fa0258a34dcdd5e51367ad40e1769674a159b2d833168983499a5
SSDEEP 12288:oRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE955C41CAE52648B5C3E5F10DAC073E5BE92004937AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 c214d27958b2d62276a53f7a82047add92db3bd01e0fb46790bd2f9ae56b9871
MD5 29cbb4e31b03121ba2f10ca5db3822c0
SHA1 fc64c4d04a1888e245a05f3fa1122f6b205f6f6d
SHA512 6f6f8f7d37606ea10cba83a6dcf8dfb391f81bc8d47c8e04b63195f8e241a4da7def74b864512f9cc70c9ca54f9d010e23d2338ba677b5f3aad43171aa19822c
SSDEEP 12288:+fXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13D4523BE965C41CBE52608B5C3E5F10DAC073E5BE92004937A977CBDFBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 36f2aacca54c9d2ecd4c99bb7ae949e3d9fe86814832477b1e3f0039ff91ad34
MD5 8f2233de74a90cf63e4a68254732b6e1
SHA1 edfe988377485241318c2b398812b2c7855cca77
SHA512 85183c927876f35e07e17226d7e07c1278f3a33ce239d75e72d409518859fef46bbc6995cdc9beb6c1c715c98ce6438966c4745b648ccf1899a287aed92d9e03
SSDEEP 12288:qVCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F45236B635C01C6D83285B5C2F5E11DE8237D96EB3005DB6B532CBE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 044a64067424793ed5f4c8d0d57cddc5d402d591b46fbc8a825b5d72efb835fb
MD5 5b658b42d5cb4296722528572433d7a5
SHA1 74244b3a0f48460f33b4b5c049063136c76585e4
SHA512 97221a1df3d1e66f69a33ef41feb61d7079f961456a0f3c2be6998ad74584dd570d83f8310b67d631b13a4cd77fcf2cd9f380308de86a4e2847e27efc37af344
SSDEEP 12288:JaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BE965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 835fd424ed8a9c1c08cdd1a1b4b5dca889b183323892cea73bbc1f7778f8fc8b
MD5 84433a117fa549d1412ca304e158afb2
SHA1 4b093b66f3326672e509022f09150eb48a59afe3
SHA512 14bcf0f77876679cc1ede45f99bb00c4de9744c33ea2e8829c54c716a89f1c4410d63293dd0a885b91ec9e5d93f3a9fde2629a7d26c1f8c7ab3e04ae9bd8dae7
SSDEEP 12288:N1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE965C41CBE52644B5C3E5F10DAC073E6BE92004937A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8fd7b837cbb4f45a518e5c9dfadc8cdf98bbf747953eb3058603268f077f94d6
MD5 8ded4afcec62dc9f3ca03556b178faee
SHA1 0acf224a43400afdaaf48ef4fe0cc67348a3bdae
SHA512 547e7605092325faaa89462edc4206d8f2728f435e8c0251213aa3420f0ae07a23a32a34777b772248beecc93df038695c7281e071aed29acda319824b47b7f4
SSDEEP 12288:ZpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CBE52604B5C3E5F11DAC073E6BE92004937A67BCBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 93ad3370bbafc2765718ebb25fc411eaa2ff6e55dda3623572fd0075b15b50d4
MD5 024e9da113537750de2b96afc6383f61
SHA1 dee9c9ae7c1bfaa4154272e9a131c6628c76215c
SHA512 edce5fa4516eaf8b5b2e28eaa82feb37f8d1cb1058f6290ac3339b10c36ad08009eca771b13b462f4a215a066f0ab31ef277d06c0c6c7a1762a627bc560f2bbb
SSDEEP 24576:lZMRzFVSOxsqjnhMgeiCl7G0nehbGZpbD:lZMRzfZDmg27RnWGj
TLSH
T1F66501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5690ee111014c70511ab3666cef6c3f2aca031b5a31f8d5a6376310ba20c971c
MD5 501ff31b726c5d4e9ce807fa511f32e4
SHA1 8862a095371b535073a8cdd9233240382019ef59
SHA512 05e53cbc85e826fc067e80c0e88ca873a2d2a8a0f3d3c42eeb91b4535ae2fd8e49799ac08e64f57dcb9bc0b1318b358c2f26fd1e51ab79ae8a00d9e9eac10b28
SSDEEP 12288:fQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 90931d65557e6631da7d1eb610b036dace9531081855e6fa0d295a7a040f204b
MD5 75986481a84f0445cfaf2011f707f876
SHA1 f8a25f110e5e37ccf5523c1eb8bb586d4a9622d6
SHA512 c383d02e89889df045162c8ee843b714ded31896d5e85de666b20190bea1e0da990b6f8118ecd11b361f62a5037626eb63d61efa998cbd44ff31d155dac38571
SSDEEP 12288:A8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1164523BF965C41CAE52604B5C3E5F11DAC073E5BE92004937A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 aeceb3b4b08caf2b5fb88441df7c914d61ecc2268a663fa3dcb00f73f2ba9ed9
MD5 b1953f4260d07b74da44ae678fc25b15
SHA1 1266f096160276c0bfbed52f08d896249c5285d0
SHA512 25c150c3e90bdce7301cad5d379200b59d989ef64796edf3c971b8c78e8e065cb75dacef7d871edc489a90952f930e1a30ceb18abc8b74c6950e4074771fe3d0
SSDEEP 12288:2yPz5L8dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LzydsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B55125B73A530F9D1378178C5A29A06F7327C3647204A9F17A116BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0c753234e5eda7211445cf7cd8dbc7896a55f1c48037c417c5f17e6ff271c74b
MD5 e8a4765e5c82855969dd5403307877f7
SHA1 8580360c843bace7dfe2810848e3fd54b6a13e7f
SHA512 9e1a84809088ba16946ebd390cb818575d6677f7ee7603738804238ea840f55aa124d62f50a3591c6247eea9c385a9f8a8e1afc464202ec8a13779f05604841f
SSDEEP 12288:GQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1954523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 feb430944da6bca06fafcef861cb684ec846ec56e55f3d86b9e1369572235da0
MD5 f49b54077abc7a1a034f599ba568673f
SHA1 fefa9eec81179410eafa3d90e12c7b4652397113
SHA512 dcc4396213ff4ad31f51f82a5b338a07dffc0e94304e699f6d7d4e37f5dd2ebe895d379abadd054a7ed15bac76bc8924fc71e8861b6bd10ed2a286ed2c0e0ab1
SSDEEP 12288:iQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF955C41CAE52608B5C3E5F15DAC073E6BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ccdac8daddbf7166809eaf2b39b0c40c2744cd6d0d0efb54b2c46a27d78b1d4c
MD5 2c544b090dd07739f5be68ee3444678c
SHA1 2e41669894e1f818a964279e7c4c2605ef138d1c
SHA512 c984d7f6088ba8a53b4f4dfd716b5370daeb591888383822dffe1203bb44a7adf0fdb586b8008748216bda9751bab9124c3f87a4c65447cee494202ca50e16ac
SSDEEP 12288:nyPz5L8dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KzydsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A055125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0fa2399501ff93c3e666ceec8322f757761cee408f12a2bbdee004cb0d7ba80a
MD5 be54631c50f6cbb0ba04297139a9ca99
SHA1 cf0d48609d256eab371da8504fce044affbc3492
SHA512 6c2d410f672192d7ff02fe14bdc60debf0bf64a9eab8926dfa23f0d5cd2e3f9a9c5f197eb7487955567e5b0dc0c1c9ce7011a742757fe8849af15ddba1b070d6
SSDEEP 24576:sTDaLl3z0zDvsqjnhMgeiCl7G0nehbGZpbD:sTuLlj6Dmg27RnWGj
TLSH
T1F46501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 57ca5433edb0986aa0697dcfb09279adc42f76903700dc5a688b7324f34d2316
MD5 64a3f83014a1304f66939b99dff862af
SHA1 b0f4133f1d91822afa6857522197dd1b542fc11b
SHA512 bdbc80fa163d951a84dabc709dd6ea4c77c36093506a428404bbd562088666b72928076c7c86a0f980e7bbeedf66b6c51ad93a7b779f2f9219b941d29f8a1873
SSDEEP 24576:G3vd9CHKy7GZjsqjnhMgeiCl7G0nehbGZpbD:ovd9CHKyaZDmg27RnWGj
TLSH
T1BC75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e39e6d471cd37c8d6af03b439492a7d80b81155b077f43938cf6ffca3cf4af4c
MD5 4bb85a0fac71ad38000a2c904fc69118
SHA1 9f39ef457d5151085cbd2777fa14431d47ca0869
SHA512 db842fda7b732e11d5676459b16fe0fea202c46d47d6e98fe4aee0c81576f715b0c92eea580d91c8d0148082589cc87a646cdc7f359e13a0424fdbfc28945d78
SSDEEP 12288:n/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:n/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1494523BE965C41CBE52608B5C3E5F10DAC073E6BE92004937A977CBDFBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f8e6818eedf83eb52b2e09b73a0c6ea1b3b377649c89539422de9e8e44b93271
MD5 d0c5b9b95b6cc6a9d8c605d8ecf188d0
SHA1 509dbf5d303fa8124e842d5bc6aecaf2028994bd
SHA512 4c5adf695b798e6d87f5860e9a7f1fc03d998dfc4bc2f2b28dbfebb3fe64edd9e71cf1209f1faf56bb4fc4554235dd85ac3883ca35b8997197e4b71e2eb9d9b9
SSDEEP 12288:+9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1764523BE965C41CBE52644F5C3E9E10DAC073E5BE92004937B977CBAEBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c69ed8c0ff471b067b8af6d39e00841354914cf4fc3ec78082ee0783692ff5c4
MD5 5ce6815b4573c21efc2143749b8d9b15
SHA1 072ddf4424decf6a383664c6a9c3fa381e8b0919
SHA512 3c14625afbf0657cf64a1f6229f34b9b05807fe45403cd7b9953129544aebd44c14afcf3aca5afded2a37aa9f2ccb94f426ba2496f9d089751cf354485a13068
SSDEEP 12288:8OXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8OsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BF965C41CAE52608B5C3E5E15DAC073E5BE9200483BA977CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9b48eadfa3f197a7651bb1318e99a414634fa8226ed8d2904a6ba7f354d93c8f
MD5 22c1d2da681cfaca0edd926f48f995f4
SHA1 b4a2b9ef9c1cae220c405809b0e72bec190664ce
SHA512 c0086be844a7a527d9d9afc8bf11b19aee4c9d799ac88a1b4e11961226830da3adb8f6af4d72af47f4aa5e2592b8b2ab871668679cc255aecaa38eef66ca5235
SSDEEP 12288:HQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 9b5983041eead26fd231afb166fbf2d136954de1cf8bccf1f0ccdf8594f47f86
MD5 f9960fd5a419617753c049ff756780f3
SHA1 6cce237557ef8456cbccef2c7b8e341e21677a39
SHA512 386368278790bc7ac90ccd91936132beaaee67df7cd454803b431352e967d75c61df7b2e9e8897949adca330798be1a7217af1058a3106dd7d2c5c999d57d48d
SSDEEP 12288:9/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C84523BE965C41CBE52608B5C3E5F14DAC073E6BE92004837A9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 b07f0569beb78ad65f4cdbd45b914b9651874dfe7e125d093a86c035db9bf5c0
MD5 6e64f9191e5baf3720ec953e5215bc1e
SHA1 749aaa913d16ec1181b645f00b4be0030de821a3
SHA512 39df7bbcd87a3bd17e159d95ba081e1cb8b8e01dbdebd2bef54c49b57fea4f0accf0bd6989467a551bf3afe41a5b8361d634f25d2480059543655fa597e44bca
SSDEEP 12288:lIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE965C41CAE52648B5C3E5F11DAC073E6BE92004837A977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 78f82db1541157bc2d6393b26a9fa5ca9e7383b3b4ebe3a5b2aec18dabf405e0
MD5 2e447865d49d4428b4fbc1a40aab4d70
SHA1 f83881acb993a291cf0f18d955b58909d5030914
SHA512 c7c3f6969b90443ab1ad81d924f15f6b735a4128f381b0499c283e7bcc02f41fab547fe14d7bbb7ace834f29e2dd94639a9fd1ba26afcdfbcd1de0b0e376f291
SSDEEP 12288:HaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B74523BE955C41CBE52608B5C3E5F14DAC073E6BE92004837A9B7CB9FBB14984B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 2d4bad53a94c438463ca3c5524e7a915b2f6905e22d4f81148c5fde09194d9ee
MD5 73b921455a9fe28bce6bd65f03144787
SHA1 4083ebdc4f4d95f4223ba81aa66aae40ef36dbd8
SHA512 3f07c5535b80de7a43d2ea6b6cd7f5921028a9c829203e0b569b3544c75f7cc23ea387a3c3bba5649c95718e72247e182f2b0202945913a9430d85c3d544524c
SSDEEP 12288:NnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE965C41CAE52648F5C3E5E11DAC073E6BE9200483BA577CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 52bf8e3873d86dbd685dacb9feef55a5a6179fcd22282baf35b5bd8cfc8f02d6
MD5 ab8d675299a9cb46d60f5e02c499772b
SHA1 2df86f961c9dd13b8a1ac8a315b2a95a419df699
SHA512 55da61749b47b8478be948c1f1a30afe59b4a6a5070fdf2f920fedf443f9154e9a66bb27970cf81e865f572f1297447e9acd9b17ebd49edc54ae60759b388a9f
SSDEEP 12288:WaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16C4523BF955C41CBE52608B5C3E5F14DAC073E6BE92004837A977CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f6275d4ca7557664ce74ed2b2ee5b3708765b83169405fa635c36f729829220b
MD5 a3fdce868c6ce17ac119de6d073b41b9
SHA1 6bf50c2a89a009dc3bd081c33eef51c79afa8817
SHA512 2d95a178ccbcb6893b90568d81e9d33b353ce31709b2500220ea76075c7b0e5ce498f2fa0f4f1556943b50e1f3a9fe27e1b0503d3e9b438048cb41784ab3a663
SSDEEP 24576:nfwvUk9RX6wkyAIssqjnhMgeiCl7G0nehbGZpbD:1MnYIYDmg27RnWGj
TLSH
T16E85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 91e5c90b573bf1e68ce39cfc5d2f0be04f9d486973194751d129fc8a0c0bdaf8
MD5 6875b9990af7ba89bd00c5b275d4b4a4
SHA1 4533a4d0b388a9725142f5c34c941098a39abb08
SHA512 8d64d60de071a6a948b178aa9722fdd3ee57a6757b69fec964777612e66f1365d652cb950183f2b25f58838d7a8c0f7d0c81bfdaaa090ad5a8c1e6bf97e59d39
SSDEEP 49152:iYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PDmg27RnWGj:5ySzPnD527BWG
TLSH
T13A066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f56b16b404e5f0777041fdcab31937718139ea6b19a06bb23561b24b23d776d6
MD5 be538076f0adec60b2cc93229edee0eb
SHA1 b160b563517c56f9279049758fc8f6017fadc0a5
SHA512 e4d8dc9bdc78408cfae0589a98e9cd2a19ffa0309f0912a7d653ed41fb60ccdd3b0acfc1eb9f6096984f729565f76a6aa8db28379efb130276394c449b4b00cf
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYhsqjnhMgeiCl7G0nehbGZpbD:M47JUQjTirIhCnDHUPfF//Dmg27RnWGj
TLSH
T17265AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5743a61a9de098204403e91f37b5530fe0f7c6c87a7863e2cacf834c111fab6e
MD5 5a7a7186f53c8008feffa80e1a9c63ec
SHA1 217dd98db785d4dc585bb0da05298adc5bb52bc9
SHA512 51024a68c11db227b6bedb7125e23bcdd89a5edcbdf0236ebefa63d986298d4553db17b5d500b2a45bf0c2339076971c9df94aecdf4e23c0edcb7c9aa16e4a23
SSDEEP 12288:nbsfgXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18055015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 96430efdbf6c307419b8df8ede6699e11abbcf9d37795dc85e4954b4c11bf46b
MD5 249a15d0309b0bc2c0aca080ce26d12b
SHA1 fcb27c96dbadd8968913518850d33bcdb1d94ce1
SHA512 1cbe07bb0e37c75edb096a02e767ec5192ad458c74043be34a9fdf6e541d605fe2c332efca8881299d194a931909b3be722c03d3e15f5e597147ab98ed2dbc9e
SSDEEP 12288:wuL0cyLYU3fvE/W4buytgpHDscKZHN+lpDVQJOBY0Bsmq/z+QgQ+:wuQcyUUPCuytgpHijUQJMY0emq/z+M+
TLSH
T16B451700B626C78FC6A940325E72D6CCAB70BD41FE056F1773C9473F9476658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 c101fe232583ed14b20a5fcad9458e585e73e48cdac196dd96dc7061c4e69364
MD5 1a0d28094195b34198baeb99e375a546
SHA1 e61f7082b58199ab4d6821ddcc51d3b6be2cfefe
SHA512 d1324cbd8c2ebc0c2c89b303986ef9d0c714de6af41d129c0d4aa93e7fc509775c268ff61e764de1a619675c7a6a6f3ea083cebc127554d84d191c76b11fbd6c
SSDEEP 24576:09rbiL1D0Rg1bBr15N5+ytgpHnytgpH6ytgpHUhWE9i9:0hiL1D0OuytgpHnytgpH6ytgpHU
TLSH
T1F7353B05B577A70FCAAA5033423086CEBB749C12BF493F0573884D39D86AA5DB5E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 46c25fe93a742ee6c0a4d5a8b6c2cc6902fd361cdfe1ede09d31d41c2de4f30f
MD5 2ac910dfd6f7eda92e125aaa39bac76b
SHA1 a96ca4f38a8648ac856e6a29e0c055dc80dd0c2e
SHA512 487af959a1b286fb3a211dbad1a35c530329e39279a16e6eae703853665f162d340a7a43e576b79cdfa1fd29f65b42cfc99760bd2522307d4bc96c7a6b92ba94
SSDEEP 12288:c07YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE6:hYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE45237A935C518AF83605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 cb84314d1d3f9011c574d50c003ebe9054c909654bf3848df0fabb2690528e3e
MD5 5350a14fd8d805495fefb22a0d5e7cd7
SHA1 cfa631d193e24c11ab3bfd0058b3c48bf85e19e1
SHA512 9b98fd94b1bfbf2042d09f2d7cf82fd2c0df7af37deb22450d7384849c2c04ae177eb85017dfedd97d5bc1d1fb8f23a918d84794ad3517ef56cc74970b7f326b
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bY2sqjnhMgeiCl7G0nehbGZpbD:egb4mBIBhGF1Dmg27RnWGj
TLSH
T127659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 733e7b6506dd96b49fa0df0d0382a0c989a4d60cd578ecb3b562b19afeb70fbb
MD5 7f97ed76ab1e052d41cfe219ed1de941
SHA1 2fe35dedcdfa83465a8761f359d7cca7e249cc63
SHA512 9f1e715f3bd952c2b2e2818f4c682221135a4be0cf1be94e8ab992eb3dc6c91dc6470953e56b389aed680df97b6c819436735ddc3cc21a6766030b48d41d6d95
SSDEEP 24576:iG88u8FpJqH1bzria7/mxsqjnhMgeiCl7G0nehbGZpbD:57ZFPqVea7/CDmg27RnWGj
TLSH
T13D85016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 46649a36f9204e3298426d70e0f87906315e86ea01eae687e41f106ccc5f2355
MD5 f188636171aace9a243c98e853d013e2
SHA1 8513ca849b06ef54c8158ad585dc7b089028174b
SHA512 bb577a040f36a5f71c826057055da55ce0047c2581279c8100108d618e447ca458c12e823c06c5714181e8306d3527cf232411c8fa83fec058ba45be5f36789c
SSDEEP 12288:fHvUrBFrEjwaQlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:fPUr+NQlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CB65F12F22AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e8fb8edb4da2b0e60f544020c30f75c13c22d6b0b2fe8e2d0707f3a5d216c4d9
MD5 5a3348b31e7c04335f852ea422295ccb
SHA1 b4c5eeab08b7bd26f9270ffc8ed393d07b51fb33
SHA512 d33044eab0d88756ade84bd861021211f4c7a94e45b33883b693a0e26025d5574cc34bea538d215054e05c708429cfacb8147ccdd7591b6d877a14f883b05508
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjpDmg27RnWGj:qG05lO43bAD527BWG
TLSH
T149D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 91f6b2a420e01b5834a22b094841c496844d81c69e7c9c84059e6d42d826bd14
MD5 e6204ad43273f0ef954acaa6b945ddb9
SHA1 3554686bd7983b45caf29f71828d7d82e58c5b1e
SHA512 e16869e6892439518d76e210aa7a2dc0292e70c9ba9d8f8cc0801df55c5fca49fbec6bac592e9166f5ef459a73d37e35383430c2e666fde38ebc1173858a0cea
SSDEEP 24576:gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnbsqjnhMgeiCl7G0nehbGZpbD:Ya5POZ3BJt2pasx2+mhDmg27RnWGj
TLSH
T1E265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d33d253377013cf21a2fd4c690ea178e1fbd110fea370e07acc201081d7961fc
MD5 f45a00d4ef75f8d9139eb121aaeb8687
SHA1 84d250ceffd52b87aaa1bf5431bf11794f63b910
SHA512 4fb0d280c59df683f2301591e72b437807f1d5008cee95592a5876e4755ced6fec52c975c2cb476a274786abc96c83b474790cc0786be6d9310cae4164c9591e
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7Fk5sqjnhMgeiCl7G0nehbGZpbD:aNc/zEOVHFiDmg27RnWGj
TLSH
T186857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fdd7e6dbecca35fe18865f47fad20a2bb56639b6f916b2a1ce77f9629d7fda5f
MD5 672e9b46ae453d320c071854026cc2a6
SHA1 b43b4eec73f4fbd83ff5de4b1fadab1a099d41db
SHA512 30c170e79dba1a8a3dd0d747ad85598de7bc3ad056745c367eac5bbef803998999ac847e7c4cdc210c1b385c63d18a124d3c69bf037fc99f02f0b21708758337
SSDEEP 24576:dTkNvNnaFeYhJNtmZBmnsqjnhMgeiCl7G0nehbGZpbD:dTMwBtOm7Dmg27RnWGj
TLSH
T10955AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 64bc1e94d78a4a918f8a0be044be6a8cb94f330700cba91a9be0c60a30cc429b
MD5 ae464378a9cd9c8297a7cc6611a5fb53
SHA1 0124668b20992be2567b152685978a1be570f136
SHA512 fca14aabc071e818029c689140647c807b14315af9141d169e1f11c933a11f1c99bd841988749fd666d735f4748232a534748a3ca9fdc6e641b02f7638f89243
SSDEEP 24576:CD3FHshBIYQgAUsqjnhMgeiCl7G0nehbGZpbD:CDVHeBIAAwDmg27RnWGj
TLSH
T1DE75E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-394-0x00000234801E0000-0x00000234802E0000-memory.dmp

Download

memory/1048-439-0x0000023494330000-0x0000023494350000-memory.dmp

Download

memory/1048-403-0x0000023482E40000-0x0000023482F40000-memory.dmp

Download

memory/1048-402-0x0000023482920000-0x0000023482940000-memory.dmp

Download

memory/1048-392-0x00000234801E0000-0x00000234802E0000-memory.dmp

Download

memory/1048-425-0x0000023482E00000-0x0000023482E20000-memory.dmp

Download

memory/1048-393-0x00000234801E0000-0x00000234802E0000-memory.dmp

Download

memory/1240-105-0x0000000000A60000-0x0000000000AC0000-memory.dmp

Download

memory/1240-103-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1240-358-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1240-111-0x0000000000A60000-0x0000000000AC0000-memory.dmp

Download

memory/1416-122-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1416-116-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1416-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1416-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1416-127-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1480-1-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/1480-275-0x0000000000400000-0x00000000006C0000-memory.dmp

Download

memory/1480-0-0x0000000000400000-0x00000000006C0000-memory.dmp

Download

memory/1480-77-0x0000000000400000-0x00000000006C0000-memory.dmp

Download

memory/1480-6-0x0000000002560000-0x00000000025C7000-memory.dmp

Download

memory/2524-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2524-359-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2524-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2524-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2680-246-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2680-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2680-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2680-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3476-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3476-132-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3476-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3476-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4588-561-0x000002693DAA0000-0x000002693DED4000-memory.dmp

Download

memory/4664-271-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4664-64-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4664-70-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4664-62-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4732-36-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4732-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4732-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4732-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5216-370-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5216-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5216-79-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5216-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5216-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5216-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5848-355-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5848-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5848-97-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5848-354-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5848-91-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5848-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5944-339-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5944-74-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5988-102-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5988-12-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5988-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5988-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download