42317365ff7b02d3180a9ddb2b282e3c9f696537270b6b86928e397298d9b0ef

Analysis

max time kernel
140s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 932KB
Sample260705-b68ndsb14p
SHA256 42317365ff7b02d3180a9ddb2b282e3c9f696537270b6b86928e397298d9b0ef
MD5 2b51c526a9f166fc6cecba112578afbc
SHA1 d38619c14da16dd5839df59b3da83baf509a1200
SHA512 e0a1b89bc2a5d2b89c9a21fc371094aca9d4a9d0b790b7f2d54ad2cc062176bd956380b6f6445988388153430dfe56bdc723eb57a4edefa9227cabe40f281b29
SSDEEP 12288:sDwSfxL/2Dc3bDLLmt0LDQewsAjVoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjj:umewsAjiTpqHvDLLv9VbNNDQUFjc1y
TLSH
T13215E031FE74E436D7BB0DB21B26C716647CB9604B911AC3E3A85D9E49302D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 22 IoCs

pid	Process
2512	alg.exe
2328	elevation_service.exe
4816	elevation_service.exe
2440	maintenanceservice.exe
2700	OSE.EXE
3352	GameInputSvc.exe
4472	msdtc.exe
4892	GameInputSvc.exe
3748	PerceptionSimulationService.exe
3160	perfhost.exe
1540	ReFsDedupSvc.exe
3984	locator.exe
1232	SensorDataService.exe
2832	snmptrap.exe
6064	ssh-agent.exe
4564	TieringEngineService.exe
4592	AgentService.exe
2868	vds.exe
4636	vssvc.exe
4036	wbengine.exe
5624	WmiApSrv.exe
3876	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f12d0dac58f5f28e.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109015\java.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{42453F56-2058-43D4-9319-D8B6EAC350CF}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1797646245-3139070211-3019596475-1000\{400CF2CF-6CCB-43BE-A02A-C645C750DC20}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6036	explorer.exe
6036	explorer.exe
4892	GameInputSvc.exe
4892	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3808	2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeShutdownPrivilege	6036	explorer.exe
Token: SeCreatePagefilePrivilege	6036	explorer.exe
Token: SeDebugPrivilege	2512	alg.exe
Token: SeDebugPrivilege	2512	alg.exe
Token: SeTakeOwnershipPrivilege	2328	elevation_service.exe
Token: SeTcbPrivilege	3352	GameInputSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1540	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4564	TieringEngineService.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
252	sihost.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe
6036	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5720	StartMenuExperienceHost.exe
6036	explorer.exe
3180	SearchHost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 6036	252	sihost.exe	97
PID 3352 wrote to memory of 4892	3352	GameInputSvc.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_2b51c526a9f166fc6cecba112578afbc_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4816

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2440

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2700

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6036

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5720

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3180

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4472

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1232

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2832

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:4036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:5624

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3ef17b2b581c5bb22766fb048ed25ce08f34f906343b6d14ee6b274e8402f3b8
MD5 090988b6c69a37e8db1ee190080d2971
SHA1 56ab80cf0acc82d1ab5e735905b6a0568c4ca32e
SHA512 bff3387141175cf77886254e2f57204d7014137fc9e085c6021d9cc8705afbac86326bde76ce703636c6c9ae2e1bd55abd6a78850df13bb9cf44a563474baf92
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBTpMvDLLzxNDQUJc1:/3q6gjBbPPxNDQUJI
TLSH
T1EDD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 c3a08b0901a10ad168e265d019a85810f0ea1b549340965dc99fb556cebea1ce
MD5 2ece2f82f556d89e1d901f36bf6570c2
SHA1 1c482070aebd947fff3116696ed9b22ee75e61cb
SHA512 74f4a2ff04699d542038fc40eb8c81256f994b429354a7e5b531c8308e1e821047c821710edeeffedc39c5e63550b2874224ebccb9ae0dcc0ba8179e307abc01
SSDEEP 24576:EXYSD2czAeTpqHvDLLv9VbNNDQUFjc1y:I2cbTpMvDLLzxNDQUJc1
TLSH
T1D5050229B7D008FDED57423DC9A28516EB72B89147A0E74B03B499794F333981E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8be238910a596ec9de3c82108f324f36726337f49f4bc7b95aa2b7cc5496420d
MD5 53dcfc528e3aa223df78774239c558b6
SHA1 6adee001362bf1832ba115625641ba50b7c2b0de
SHA512 83efed7099e2047a9baf122a342ba2374e4e7fc95969081dad88fe57751c8b2cefd405819edf26f009dca9423eebad410679c6a93b26062818c046cdb4c283e2
SSDEEP 24576:S03e78w06hxOrMgTpqHvDLLv9VbNNDQUFjc1y:Sl8w0ao9TpMvDLLzxNDQUJc1
TLSH
T18645AE16F6748775D073C0B9C5D2A69EEA7130821B308ACB0286D77C6F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 39ef7ef9fe19b3a0c4037760df9097d45f204893720bfdb4aec35d8153f19df1
MD5 dad2401683b91df27a9624eaa25fb1fa
SHA1 c0d97e69e85ac1e3f84401805515f137db04f443
SHA512 25d6ab05818f5d185f21915b47d2afdbe65b820ffa17636acf000f5e4cd4d960d22a0f26121ddc4d57854dc75a7c8adf083f91f93c103f7ab5a2bb7a1cd6151d
SSDEEP 49152:h/ezSC6vUzPvuHjytTpMvDLLzxNDQUJc1:hezSC6v2XuHhPPxNDQUJI
TLSH
T1C9756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 c7ca8ce1508efb865c134451521f6d86043a4780729463e492f25225593a5148
MD5 a5a398c456de0d587a17aaa592d8f3be
SHA1 f8330684e2bd1e6abdd3dcc9fa120574b3d15489
SHA512 adc7b76546e2a07e20dd9b2862d5f92ff5b85cb8cee56cd5cd6cace4da9e98f266f2c51ddf2df73b1107efda55d8d2b72caf6676f298a5663933c919385a2c45
SSDEEP 24576:eAbZPQzOdv/l+dx0TpqHvDLLv9VbNNDQUFjc1y:eAqzOdXl+0TpMvDLLzxNDQUJc1
TLSH
T155559E66F5748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 f1d359c06797c4a256bc8fc10ed03b00e66e1c511d0ffa5f9a6ae6d1638b3347
MD5 39aeb1496df75b11112ce270b08626e6
SHA1 bedce1f7aaf50bbeb537612b5418211efae604d9
SHA512 68962715ba9a1513788ad76e5a0fbbf9407cd6da31d8e346217676ce0093bdda86c86a7a6b30822a06c8a1ace769adfe03762ea0e71f99d7f9f2f882df0b73c7
SSDEEP 12288:AdrioNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:AdrHTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1D9D4231BE940A9DAFF890673255D0A1EF77CECF129C499070D253CBECB3512626939A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 8d3f95d9e343061b777de554985549ae6fa02a4dd5cf0eea917fb4e6c3fbdf33
MD5 f9b0e79376e2a412268274f90be4ebed
SHA1 0745c25e050e035e5db690b2f32cea93564e45ca
SHA512 cac0fc180c720530b21d1f8c6b9cbeb93cfc815abda2638017e382f3df62ca52445f135f3a923306ec1aba191246f12c3527c477482383394b9709fee68c0b63
SSDEEP 12288:9aBNUbTVO86UpoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:9FIUOTpqHvDLLv9VbNNDQUFjc1y
TLSH
T10815CF3BEE28FCD2C67A4DB956918600E77278714F61A3CBD175820ECE235E11E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 c17548a912e5143d51572ea178fc1be77371866967656e954434f7779f0ddb19
MD5 54315a4ccfd20cba10f3991b9f7b992e
SHA1 195fe185f0dcac4b5aed2d31f95bc7ccb22aec5c
SHA512 8da2d37bbf38405b0ae243e907d94ed1b7db21e11285be8814608c8e7999f6e1198c1370cd53e2df3daadcd738bc904a5bd5277047cce1cf909e66d703094bda
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5JtNRV3THQ:nQvGAdlCEL8c/DRNh5CmPPxNDQUJI
TLSH
T190367D656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 b11802a44c4f3595f4368ffc6e32f53c170cbeaa0490175d29f757a2cdab0d07
MD5 faeb6a51ea8733f8bd1d8108b7d54e6b
SHA1 c531902717de41e130e766ca0d7f380a8c93bc0b
SHA512 838dfb3b7f505371c171dc750ef09bef2c8b4dadd34a991754a3ac5a975e11c2ebca9bac814079d4e4947e6175c5e2329ef29d352a5493c0e41567073755a081
SSDEEP 12288:RiwSfxL/2Dc3bDLLmt0LDQewsAjYoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjj:gmewsAjxTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1F815E031FE74E436D7BB0DB21B26C716647CB9604B911AC3E3A85D9E49302D22376E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0931bffe9ed7aced62cca8eca9c151b4c1dfd1f569a62f0229e35c92048dc763
MD5 96dd1be0c31fdd2fec1eb14bd26eccf6
SHA1 367d5b5f9fdd8eadfaf3beeab9130bf7ef5fc380
SHA512 cfba2adcf0c872661c76f5916a7afc28297a05aaa87a9b883962c3b6eb366b08d7778e32b11f8d30dd397aabcfe76599d2777977cfc0cae674e4b836acbb62e4
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHJJNDQW:lUEtQevvqc2W1cpV2XF32JLEW
TLSH
T1AB474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 39937018e7b29d5852b486b6540a1b9b9181d30dd272fa9c1e65b4219f131811
MD5 004dfd8226b3c4230037021172176e53
SHA1 f654c86752a5c0bd723a353bc33b6a8b8e6a9310
SHA512 d6c6c4b51c001a3f5c1677477c50a64ecfc2e606c663d12da590772d12362e8c560151d773882f874b919ad40cdbb314d6bcb3f9b22aad3fa419a7553cc7ba16
SSDEEP 49152:9Q5RquA/m2yL5zMfFiV+XenmE3/zdTpMvDLLzxNDQUJc1:Coq1VjnmXPPxNDQUJI
TLSH
T1FED58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 02e26d9a0ff2227cb971884d52f1e4f183c5b34fda296cf72964d28db14945aa
MD5 e6f3126da2df573821980225c8207bf2
SHA1 bb8cc026dec9b76557ef05668c43e4a78f337dda
SHA512 7532a6f254e2431e6803a1205462825cde1398b34162edb8730cb40b26a6fdbeaefb339cfd39b94492c9cc01d0658321f2ed35c03df23910b8ed035a2753d635
SSDEEP 24576:RAhGLvFFoiwtA5l7S530TpqHvDLLv9VbNNDQUFjc1y:RAMxFoiq5kTpMvDLLzxNDQUJc1
TLSH
T1C945AD81E7F955D4F5F3AAB899B68171EA76BCA65E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 f226f81378846f548f3cfead07bc3032a501358ce1207bf2acb9bc634074956e
MD5 a17d6f4f162bfd352b38daba696afab8
SHA1 5641e5cf30f90f08e96c95dc5fbaa527addf6eca
SHA512 e0bdeb5024db15d032cf5f42d178d166100fc88edc8814131649aa0cf3ac441ea0188bc83831ec8ce8b70716a756b4dbbb424c0dc95f60431129f4de7c7af77a
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+CGoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:uwuuOWkTpqHvDLLv9VbNNDQUFjc1y
TLSH
T17605014A76A41CF9EAA7423985478136F7F2BC522A61D71F0770C66B5F333217D2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 ca332866cc9716ed20cbc4b23e962e200dab741be17137437ba0a78fd89ee72b
MD5 8cf30498b9a1b197a52877c99d5f0f69
SHA1 deff29c1103e27f76054846588f1f839e7263182
SHA512 c4e8a090ae7ed28114d9e20b20658c27bc11951beb81521392d131cd0733e26a0a5ac045a9e9c32e4327fe530ca12b236e3f620d377f54f5a1e41c9e9953bbab
SSDEEP 12288:ZVY1I3xoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:fYu2TpqHvDLLv9VbNNDQUFjc1y
TLSH
T16BE4125A72D070F9E697023A49E5060AE775B8B227B583CF052419BA4F336D62E36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 85037349f9588f664fea0087ea09c4dfa2acfbf620df9adf56328efb551d631b
MD5 2e6de90d17b627d7c22f6deba6e99c7b
SHA1 60785107e1b7425552eda62aed79f3156f2e4820
SHA512 4031eb2b2f213bb088a60188afc588ccc68eb033f6d67f09f0a95e1d65a57d5045b70e901f592becdd7047a500c34e0b49db51a632be1892ffd3290edf179b08
SSDEEP 98304:qQRQyi36YOcP8Lvw2gAf+PN31PPxNDQUJI:BQyiKa+X+PNtJNDQW
TLSH
T1EC667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 34c77aad36b8c7da22052541251b76855a7db07bc94bf627340ce5a80d272f50
MD5 a95e3d4a8b230f257c579ecde4723b1f
SHA1 bc42fd84fcf21c153ac40d1473fd692f23c2c907
SHA512 ad6c147716d952edcee2348ad5f5d7593e074cce72e875098a832ed1874a0867a1a233528785604c0f4e7b6ce1bd9fd532a778f9fe5405dad075176f96162ee5
SSDEEP 98304:qQRQyi36YOcP8Lvw2gAf+PN3gPPxNDQUJI:BQyiKa+X+PNyJNDQW
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 86f815af73dbaf1cd2d645764aa9281f506aae46d2faa60db9584bb929ec7cb8
MD5 bcb88242e39d1b2eb5605b31a9523f2b
SHA1 d4531efc60659f285a1bd2a232fcb585785f3469
SHA512 e189f847defde5ccedaa742c549eed341c1d78655794870452948215864b89d8fff46311135a817ec7d686a38243912b8ddd158cdad08a8d5ee0b67f61748e84
SSDEEP 49152:j68Qg55nhMeWu7PNU3/JTpMvDLLzxNDQUJc1:dthbRc/wPPxNDQUJI
TLSH
T13FB54A33B2F20099D44DE1769F4A872196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4f0dd3617d4bc8e29c8c02f2705b91e6dabd22c6ac9b9c3535b8e54aa55c729d
MD5 c5112dfe6cc3b4625df1127e31a778f7
SHA1 02e7bbdebd7ff20ac68bfb382e651c6759bed4fe
SHA512 c83a9dcc1522c511f05ba24b09c20be8aeeb28f60f5369bfcc310a086402fc9ea9353cdb7296dfd11e3908e33e984ab81ed3b7cb774b2205adb85ce408436728
SSDEEP 98304:oy5112gYy5azzVv569nLKnhZNPPxNDQUJI:BLIHAWhbJNDQW
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 75ab4878ebed0106106132dfb2bef075bb90ac5972e78d18a789a360387f453c
MD5 e88750e32ab91e32b16cf21f04946b1c
SHA1 ae5aacff85b8e19e8508ca82f6242f1608123e68
SHA512 feaa21250aaab705d60d3bcd0da8743fd57076a3aaf0815b9ad5b423b7b2357206179c5b9d49eb13e030ede4bfd4a67c2c51f9cbc9e473c28bdf01008c471629
SSDEEP 49152:wB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glzTpMvDLLzxNDQUJc1:qu6JmTxd2diPPxNDQUJI
TLSH
T117D59D13F1DA01E8D05ED079974A9233FA62BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 df52d5cd3bf95706b4d84bf4cfc45aaf9fbf1862e7acec1ce6ba8ad78f52af0b
MD5 183eb2fe15f0656f610b1c2a805f302a
SHA1 decc31df49f845dba940fa795724733afad9bfb5
SHA512 14d6663b5a6aa6376fa968749289ca77d06aa372430407d77581e172bc6f839f1aef50ee5d18307740a69c2ec337e93ba96069a09ca393413a3f22e59cb2336c
SSDEEP 49152:N1hpsNoJpF1A6UU44CwH7R4xYTpMvDLLzxNDQUJc1:NmifPbR8PPxNDQUJI
TLSH
T132B5BE13F2D800E8D05DD179875A9232EA61BC460B34B6DF0A90B7961F7BBE46B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0e6455eee553751a4e856af11d5ace5920e3a6f46ab6be41ff7e09412494a170
MD5 858e17743dac8c9a11b67ae21e528754
SHA1 24184b63bbf3429854778f2c00cf31aa47594578
SHA512 eb3b61982f7437328255ad712f11ad087e85a4b299f8aeee8105634ed41936ae7cf6c3d9a8a2f7e0b6813b23da2ed20b197a6ea869fcd2b08984c8ef00e79ba4
SSDEEP 49152:9SuZQIY0Be2K6RVtOnks6NMHqiTpMvDLLzxNDQUJc1:T5dKoi61bPPxNDQUJI
TLSH
T1CFC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 efc7c7051d1e3a1fbd48533ff8a370efc0ddbdd122f9a7f279e7a26686174519
MD5 40a41299490ca00dd2a365dc8daed65b
SHA1 1d7f748818b518127da75595300a61980c287b78
SHA512 4155c000027b1576688abd66dc01b252d95c7a96dbbdde09ff098cbf9c25579e494f5815ac174605edb2938cbee7151cdb069d5db765552894fcb23d57b8bf38
SSDEEP 49152:8B8Sn8EApI0figTgiDn0AP5wOTpMvDLLzxNDQUJc1:4X2iyphyPPxNDQUJI
TLSH
T1FBA5BE13F2D900E8D05ED179C7468632EA72BC160B34AAEF0A50B6561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 344b5ba5d4bc58c1f965d5accb71123ce46816a5935ab98df174ba7d24e5e1b2
MD5 6fc1b6bed6d929de9517056ffe8ae326
SHA1 60efc6cc02d2916bc6730a14bcd9cbe35b45c615
SHA512 3b66f84828decdaad5501355768d68a753d59f3dc3738eb4b6f5176ccdee05b5d0ba9d833cf040f43b279bd1f15c89c379a577219d6922b435fd03bfa8af0d7e
SSDEEP 12288:lqoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:l/TpqHvDLLv9VbNNDQUFjc1y
TLSH
T1D0D4231BF84099DEFB880673154D065EF77CA8F379C5950A0D292C7A8B3163A3683DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 adda5849f85600f7fc8125b2aa791c1e8edbcec9d034c8259130834226dda397
MD5 f35f7c3f47c9e29948bc1a607a303401
SHA1 d93556f116351fae2f565990bf8592fdadb0f279
SHA512 cc373b85c7d109a0c7ddd3da56113c5916550711ddbcb82aa828638b3a82c9c6a53d16a220e79d608710847a162066d3ad94429c5e8ffb2544c70ddf625dcf1a
SSDEEP 12288:DSoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:D3TpqHvDLLv9VbNNDQUFjc1y
TLSH
T155D4231BF84099DEFB880273154D065EF77CE9F379D5950A0D292C7A8B3163A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 08787cae17cfda131c04f8aaafb44e95208e93be7f8e28aa2c30cd0cd86c9663
MD5 11938b7c88b9f75f8e2aa9af8daa9682
SHA1 733c9b35a0c20ef6b862cc6ac0c5a17544bd1266
SHA512 6d63e8bafe67096454757811289249c30b855d0f396464e098975c2d1e5dc3888ffaf81b23b07d89e97895a6a957205f9fd82c5d2d8aa90d8d1794fd3e2d2ece
SSDEEP 12288:J+oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:JbTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1ABD4231BF84199DEFB880673154D065EF77CA8F379C5950B0D292C7A8B3162A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 91546839598f750028e85d099f37f5d45d2109265d251d05ded21183e1d8aa00
MD5 9de80562994cf53296272d883a708adc
SHA1 b33c0ed62f4371b730ad6d3076f7960dcd3a8c81
SHA512 5d96d172089d24cbccde32a80a5c837eeef9527fa8eeec9f793d42021e4af54e1510d79b24c5bd0ea0da383d4abe42b0234d0844c8094797cf171e97589ff8aa
SSDEEP 12288:3lxoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:ATpqHvDLLv9VbNNDQUFjc1y
TLSH
T14BD4231BB64055DAFE8942774559061EF7BCFCF27AA1A60F0E101C6E4F313293A52EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 752b7d132e19dcf06e3c4e6e82bcafac4252df57bdf16abb4de151665a6f5272
MD5 1b277b7d14279809a7ee308836d75db0
SHA1 16b76d56a61c0eee710f00d1e38ebf7a32bba2dc
SHA512 769cc593185f6324d20983dce4825503116c4430b8bf8b61e111147e6a7b605cad6d2b701d1fac54619823416472350681994e3f6b745865ea14f2b7a6c18234
SSDEEP 12288:IaoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:IvTpqHvDLLv9VbNNDQUFjc1y
TLSH
T122D4231BF84199DEFB880273154D075EF77CA8F379D5950A0D292C7A8B3162A3683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 ed94cba7a33b161bec614de6f2f58bc3d5ad3751bea5e0a357b158b0657c3348
MD5 bb93687eacd9f089e0067f237f5e8bf1
SHA1 17a36b4fba7513158249c030e4be6fe31560476e
SHA512 2e11bf683a0077d8c29d7e21321408e28445e571d3aa96719c1e117c3cd75c189d159e75b3202c05b6016259e223a80072bfa5c172fb920344c2cdf8a7abc08f
SSDEEP 12288:bRoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:bGTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1A9D4231AF84099DEFB880273164D065EF77CA9F379C5951B0D252C7A8B3123A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 31e2fcb9e948653bdc02478f4234041c0e4fb476c0c98cd9e6efcaa796b4b20f
MD5 653be57151caf7ed70a6928a48461685
SHA1 7238568d347df492cbd065857b7096162905723a
SHA512 e6ce728a20560624dadc316b07f5c8bfe8b0db63bb76d66ab23955aeddc7f6c1b188f22375955bb02ab8a17578c3833832ac29b68fd1292fdb072f1751762025
SSDEEP 12288:+RoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:+GTpqHvDLLv9VbNNDQUFjc1y
TLSH
T185D4231AF94099DEFB880273164D065EF77CA9F379D5950B0D292C7A8B3123A3643DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 f597811f93755390aca844903d6309fc75aa91115a8963c183f3e15caf3e9aa2
MD5 59cb807ef8a94070108fc00f01a14038
SHA1 805d5d8502de0a4b079ba051c85ff6099cb6b35f
SHA512 c161efe91cddb40832785237ee6f63c979928483895336d7a20eb732461432b5c4d68a2b7cf596558c5dd1327ea1bb5a617d025cfbb338636bb1052221a9e626
SSDEEP 24576:RZMWzksSaKTpqHvDLLv9VbNNDQUFjc1y:RZMWz/aTpMvDLLzxNDQUJc1
TLSH
T16E150299B3501CF8ED67423FC9154906E6B1BC661AA0C61F07B43A6B4F333611D2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 a122d005fb9f030ac731722ef174270377fa51920d5c2e232d92f2ad583357c3
MD5 41db04a3eb6ff87b5cdafd239ac18fde
SHA1 881bc97c0805edaf80ca20b77d8352a9f5fe7afe
SHA512 8375eb9f3d5f10852c4aa22e552a919a0f7dae4cd2b9d78da9177161642f094c324b5e801640279160e220a182433a1aa0dc35af2f5bb13db80de34164efe512
SSDEEP 12288:N45oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:NhTpqHvDLLv9VbNNDQUFjc1y
TLSH
T133D4231BF84099DEFB880273154D075EFB7CA8F379C5954B0D292C7A8B3152A2643DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 c1dbf9ef6913f749ecadcecc5115a73ec0dd0716266d90b30d3877443efdf8b7
MD5 a2e61e56021667dc26f19b23074d70b3
SHA1 d63abb9b236dc02977af29cb7c0f74d1141b6d39
SHA512 4666c3637ab0f8d414cac217cf88e067479fda2e1da2f0c92429d42c74e79bfdadfb3202ec2244348556a3cee2d18ab093091dc9fee229a8550ffdb1d3bb6506
SSDEEP 12288:HIoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:HhTpqHvDLLv9VbNNDQUFjc1y
TLSH
T17DD4231BF94099DEFB880273124D065EF77CA9F379D5950A0D292C7ACB3153A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 9509e15fc5651922d942e697080552038317f78cee04cd8e188ab777599e82c9
MD5 d45acd333a20a3ea37805570af3efc88
SHA1 6286421dd3fd43c07ef0d1bdb946161d21dfb2d4
SHA512 b0d2ddf2c9cc5b46472155ccee765e534dab620911fd749da716704ebcb01fffac521aece441e3872e58120e90e467fbf6e5d26d85472442f5ff38e235b461af
SSDEEP 12288:iaPz5Lbm+oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:jztmbTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1B7F4120BB7A130FDE666423689560A06F775B8721B608A5F07640A7B5F333612E3BF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 e1132e424d1fff198ac65e50360e532fc08ce04c1378e8647551d06afe688edb
MD5 1d810ca7d564e894765b9da2f869790c
SHA1 160d45396278ed2cc7029df1895bf6a68d91e46b
SHA512 e0288a8aaad8051e39168eec5cd7ddda93a1b2fdb7f663413af7c5437e0cf23c9ef9e930743b4059b2643b3289c235fd716b8a8dc6ac3ec1b8322e420047d1da
SSDEEP 12288:BpoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:BOTpqHvDLLv9VbNNDQUFjc1y
TLSH
T13CD4231BF44099DEFB880273124D065EF77CE9F379D5954A0D292C7ACB3162A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 654461c18688018e6e1d6fec77bf2aac31aebc77ef45e25bc540ac84a1b3d339
MD5 a540fade53da6655cd9885dd1cc0dc50
SHA1 776ca62cd8853d321abccf2a1fe41bf2e7429e1b
SHA512 40f8be3b607c343756e348a5d35d524dd4779a92ce111d412d1e27cb1e92ccdba7f6b604f40f8303418f1e44caae82dc5ad925fcb6617b45c2ca2bd8698e3729
SSDEEP 12288:Nc/oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:NcwTpqHvDLLv9VbNNDQUFjc1y
TLSH
T12BD4231BF54099DEFB880273124D065EFB7CADF379D5950A0D292C7A8B3153A2683DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 ff83a9392087b0aae1c0bf9f3eb64928f8a3fd2b490c95227ee226622adb28de
MD5 cc94dcaf60cb72da09c7a7d939ae8ecf
SHA1 98bc865e8aac8acd1be7eb25e024820f9001eef0
SHA512 5c178bea263c7e66832d764018b22a9709d315f239f09b9a3fd614c9caaeaed29ae43d3abeedba71f6546081c85f40dbfc66969270b75f07446c80f21bfe6f68
SSDEEP 12288:XaPz5LbjdoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:SztjaTpqHvDLLv9VbNNDQUFjc1y
TLSH
T105F4120BB7A130FDE666423689560A06F775B8721B608A5F07640A7B5F333612E3BF71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 f4f0c975c9acf2d1b231894389c1b9e8fcbda0b8c4e4815ffef586b80668af35
MD5 01d2b7f37a22aa56982ac66ea9d735e3
SHA1 7ba49d70e5aeaa3a7e496a229ed075af09a9cd36
SHA512 2973375be86d940e4589b1672e1c94c8cbd9a35a8bc8e7425cd16ab3ac924e36483d0944cf970f8ded56b7e53a8396a46dafd838f63a4c889afb7605d79f664a
SSDEEP 24576:sTVaLl3z0zYXTpqHvDLLv9VbNNDQUFjc1y:sTYLljJTpMvDLLzxNDQUJc1
TLSH
T1A1150299B3501CF8ED67423F89554906E6B1BC660BA0C61F07B43A6B4F333611D2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 e83fba2e66d1f73662ce309b34abd4848fb6dc1294d1de0ffd93ab9e34623e36
MD5 eb92c9981e9f58a9c4624a11d0ebfe8d
SHA1 028d5d88bc76d2be6a8b5acdde662fa229d986f4
SHA512 9218803015bbc9b7399ed4d35c4a5543d7b9b0f938bf363aad279c8a91e966dc789ae52a5c8a620a74fb6cebb318261505e06451065bdb3c54c894fd0f610f86
SSDEEP 24576:y3qd+CHKy79IWTpqHvDLLv9VbNNDQUFjc1y:Uqd+CHKyhzTpMvDLLzxNDQUJc1
TLSH
T12735CF90F3E414E8F1B78A3589764512DAB67CAA1B71DE8F03A4251A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 9ddd71f00180098332c9e1ad98f395e9dd6e26af4906507359856eb1299fe977
MD5 7e97877645e4bbd9d6991fa67b50bacb
SHA1 d9b3e12a6767020918b3ce62328c296bf4051907
SHA512 50ce13c82fbd3178cb7850a7de22ad3b53ecf406d9df9f95c57fa8aa97fe925457d9a5721acbbfad4cd70323c8cea3e40333395d7467e6145ff57a06015466fc
SSDEEP 12288:nZoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:n+TpqHvDLLv9VbNNDQUFjc1y
TLSH
T13CD4231BF84099DEFB880273164D065EF77CA8F379D5951B0D252C7A8B3152A26839A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 20acefeefbb429798347dfc43d7200f4a7cdae2d49cf95cfde2256fce2098513
MD5 f4b15c9c0788cba0d1695397f980fa04
SHA1 e2a0358747f9c1e5ef6e545a163a306b7be85e26
SHA512 e6dc22b8f17495d17113947bc219c2960493ff09a23aee04157ec053766f06aab728ec667c6ba0610d4c21673645f2dee3c07abac4fc1c766a4de7fddf14316c
SSDEEP 12288:4IwoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:4IZTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1DCD4231BF94099DEFB880273114D075EFB7CACF279D5954B0D252C7A8B3522A26839B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 937d2668a0b248fb4c10353938ed3460994727989a7656321e46a893b5f7ff51
MD5 0dc25457d1333a9ea74cc41936ec2132
SHA1 bfdbc1e140217548376e88a0100b16db219fdc3d
SHA512 fb500b0fe5c37f20db1cb88323847030a6a4c3f72280ee3d6fbb9f09e7c8e610aebdfbd771035fa7a30ef5703a9fd273f04e1ad6f50ca1bd25b677aeb097bb39
SSDEEP 12288:gdoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:gaTpqHvDLLv9VbNNDQUFjc1y
TLSH
T145D4231BF84099DEFB880273124D075EFB7CA9F379C5950B0D292C7A8B3152A2643DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 4ea20c5f2873729865bd048b6faa7081cb98cc0a1f01d484c24ae9d2a2cdfd0b
MD5 a5cad11f025784ee2ce8f7334fb87b1e
SHA1 8c90b023891f5ed88b6094eef3978e1a5f0fcd94
SHA512 5213285217eeb1e54f37bbe8392789f2de4f51a286756e8f9b49d9eb4b01480ae42aeee817e4c1ccb50de718c2b474c509bc49c4486e8b31290e1c84ec654c68
SSDEEP 12288:nOoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:nrTpqHvDLLv9VbNNDQUFjc1y
TLSH
T113D4231BF84099DEEB880273164D075EFB7CA9F379D5954B0D292C7A8B3153A2243DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 127799a76a5ee016e08b0f5347906efa66b94c3586d4f733876e2ca0933406a3
MD5 7d6cbe62916898cec574ae0edf240c2d
SHA1 5f4017be7aded0570ea8d4ffb8705d3337a26747
SHA512 697170260953f9273d8c467afd351eb2010196580942eaff7168cdca60fc09942a6ee68575c45f081fd290604d1a1b192ad573085ac10bdedde131b89d092c9f
SSDEEP 12288:jl9fUO5oNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:nUfTpqHvDLLv9VbNNDQUFjc1y
TLSH
T101F4010AE29412E9D59E1276C7494A45F3377CA297E1D3CB16D0F83E0F362602EDAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 9a7e0aa1d578ac16e1eb0eaf0bde8e9f1340b9626d07c6ea54b65a4aa8e05da1
MD5 56fffb42e82aae3e9475f100f294b29f
SHA1 12ace5f31445d8d0b94e1659ca21503c456d3b83
SHA512 e43549f2d3bc59c49519a2d5700d60fb4d1b79cefbf65d67fd96e1c816268674f62472fa974e796318ec3ae311387f030e4d8ab355d2c7fb1220cfe31fce2f81
SSDEEP 12288:RU77GoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:e3TpqHvDLLv9VbNNDQUFjc1y
TLSH
T1EED42317F6409DCEFE980673155D4629B73CF8F22F80D58718152CBA8B306662AA3E67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 33b66993a410fa75b1a2538443d541f56964b6869b3bfac63df2fd89fac02ab7
MD5 ff73abd09fc35d420b343184892188ee
SHA1 e835fd668b2bdfa669901dcd8c1233d021342ff8
SHA512 d570cdf8994144c14ec95b9294f02dd096f14b1f3715fcb79f344b6806b41101db41f3a9a740fd29c293084d706c34d8aea34c4ef8f90f664d2af3043fd84e7d
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bY8TpqHvDLLv9VbNNDQUFjc1y:sgb4mBIBhGFHTpMvDLLzxNDQUJc1
TLSH
T11765AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 db04369688d250e1d58e450102d82933b104bb2ede6444c5e690137cdd8885ee
MD5 886c6bcb32d9b8fd676d235feea9765a
SHA1 c34447bad5918385c5bee7622c9af8010cd2427a
SHA512 c6f4452f617ef943c18b0b312c7f5269aa0c6de97fd28fb998afa1e1bf47dd201adb4757896fc93d35137664f095da0c1deb942cda9db100ab862b6293537906
SSDEEP 12288:w2GuHoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:bG5TpqHvDLLv9VbNNDQUFjc1y
TLSH
T1C2E4232EB4A174DCDE7943370469062BFA7478F12B5465EF08A1A879CF306F03636DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 fc3db3e577738dac8ed82496e94ea113054bd52bada85ebdf57765375ab67e81
MD5 cf40fcb7dd8b8cfd109854d1c678efc4
SHA1 f47fa4e21b5bf7631d5277a7d62f4ac1f390b874
SHA512 4c43c629b37771b4a100e46b7abfabed7f8c05c21676bb6e0f1267cd886a5ab97aff3fb44611e542601cd594145bb4f048f6b58d902c427d0409072de5102ac2
SSDEEP 12288:vFtoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:vYTpqHvDLLv9VbNNDQUFjc1y
TLSH
T137D4231AF540A9CEFB890673114D061AB77CE8F22BD595C708253C7A8B352F62673DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 13d7609048d5ca051de9a92aa08b57dee2a3d87c21c98cd215661d493ac883a9
MD5 9e43f9621179eb67f853708b8dd0939c
SHA1 c225cc0bb7dc066ee980a6ce1c253b6bc57434d2
SHA512 49fb93138c44ff06936af44aac3607668e4441a4b151a3c154b5acaae8b675ab1e40c6d71bda60008d76c9e3142741742416f9e2ff488e956e6f6eb368143e90
SSDEEP 24576:NPq8u8FpJqH1J0riA7/mdTpqHvDLLv9VbNNDQUFjc1y:NZZFPqVLA7/eTpMvDLLzxNDQUJc1
TLSH
T1B8350125B6E001F5D47BD13889864667F6B1B8211364EFDF0BA88A550F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 acc24faf56a945353084c6e374ea13066c1fcd4b4c05bb659c45939db4c4bc4e
MD5 f4484c7c897d54bce8d7b12f3034ca48
SHA1 c79d972fb11ad744170fb2205afdf58e20de8273
SHA512 95e670546b79930c1955591b36edddde3d0cfb34563f6f842a1daaddf2c9d70275b7bb179151eb4515b474fc961659c1e911a6045ae5a5f72499b8c3a258ce6e
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9TpMvDLLzxNDQUJc1:1G05lO43bNPPxNDQUJI
TLSH
T1A1D5CF6E62EC11F9D1BBC17CDAC6460BEBB23425032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 3c42f1d0ebda9f6bd750d5a19c7310af10cb6363844eb5ec71943c03cccd74cd
MD5 be0d8859213b0060bda0969a9b705013
SHA1 ae14e6a982526d4ea9c8426db5e6765e965cbcf7
SHA512 d3456ed17fd9be86dd79223220728d5a462b88c9e66a36e48df914a69b8dbd6063f29c352de1bb64ddd3ed6641306631866c9aa735cde9fb8d6a6bed5de6d976
SSDEEP 24576:GNa5POZ3dpbWVM50JicR2hG0lasx2+47eidnOM5d5mROWg6j7vZ:Ia5POZ3wJt2pasx2+mbr5mRvZ
TLSH
T18265BF5EA6F801D5D5B9D17CC583461BF5B2342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a789f9dbd273582b178dafaba4ec22de9fcbccecc6e111db1b2e2603ea681381
MD5 19faede5e39c0ce729a614e5ee2d13ad
SHA1 d4e4b8e6a6b5352683e4b01328c068ca56f16aa6
SHA512 5972e65a1ea5d134bfcf08525107cfe73b47e88880ae1dbb443ad15dbf29adf0710cb4c070c2fa4b14d191a89809e79155f29cbb56ec6ffc633568c579b00f67
SSDEEP 24576:qNcwHdjbyQ4nLC18lb/EOjowL7FkITpqHvDLLv9VbNNDQUFjc1y:qNc/zEOVHF7TpMvDLLzxNDQUJc1
TLSH
T139858C1623E901E4F5BBE1BE896B9546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 de317a4e7b5889879cbb8a42a6f2129568cda33b30933192d95b1a81264d798a
MD5 374f8400f28cfe3530b57aedf4f214e5
SHA1 36f6eddc1c47247a9839d3dc70247aea5b559dca
SHA512 f64ce5e651c3a966415db247c6f157c549f8f5c69c89b75415e159e1fdf306338896e197b74478564d32bfc45bb8da318b12949be04f007600fe9545d6902cb1
SSDEEP 24576:AJnJPbzB4SrTpqHvDLLv9VbNNDQUFjc1y:AJnJv6SrTpMvDLLzxNDQUJc1
TLSH
T1CB15D02DD2A810E8E4B7C2B5811A1B5AFF31387D2F2169C719B4D4353F12EE06A79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 5f1a075859842328e7a6b69b045654eba972b987af53e377f73879b479d153d0
MD5 8c3857b01d0d6b0220c0276d79f46ed7
SHA1 1555551ecfe0a5ff686707e553969ab0485ba530
SHA512 986b93955a2b1ad40823cbb0f494a74b6d93730d5a605354cff9dc910b3a8e6077a3a44a4b50ee61929bb0099530ee4067f3acc07c21bdc026267d99908efbf7
SSDEEP 49152:FCLHGeeV5ijCmlDWDkvTpMvDLLzxNDQUJc1:cAPPxNDQUJI
TLSH
T1C1A56B05E7EB5188E8F3CAF5CA2694169A327C509B34F7DF4E80C96A1E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 588f1791b05447b494fab40edb9ead043bf78862da2dc292f6dea86d27c05952
MD5 e93b4bab722fe73170539ea5aa4768cf
SHA1 73989d05f8732a9bf0b023fe3c530d6e132ba45b
SHA512 b25cc0bdd67ebe81c67cb57f519af7240680bcefd7082296f4d36f08ef6dcd3259d123683d1b74cdfb5e9f586abc9cff530d39a064178b755d185327b51f19d0
SSDEEP 12288:J1H6kgj5ZI7ypoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:TgDIZTpqHvDLLv9VbNNDQUFjc1y
TLSH
T14E05021D737610F9D16B803E82830506E2B1B4B197525ADF0A94C8BE8FB3EDC7939E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 b8b5cf2a189c82f8e1577c6c34b3d7d5548299b9cc7474c94f49117f846742d8
MD5 59e53e7638cba33a2c2a5f443aef6506
SHA1 12d9933fb71349e00dd0d5553388f30ebd12f3b3
SHA512 33c07e2e5dc632c2812cc163eef3040da4679fdeca59fbebf16fcd8df2a3701bc30e00f2742f2f1a3f4dbe298f6e449fbe9bff8763aa6b4ca7d5e5827b44b60c
SSDEEP 12288:tG6ky4qoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:UtyATpqHvDLLv9VbNNDQUFjc1y
TLSH
T1F1F41209A39064C9FBA902364A664265EF38BC706F5193DF09A0B93E5F317E53932F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 45fcadd70950d0fa1a997a945b9e08b8a809d6cdb4e21de73d50ae5c844a6b3a
MD5 149e5e0b22377acefcd758c79ab63f77
SHA1 cbdf7476eb6cbce2563d7c0263c8c37844fcfb8b
SHA512 fac22cd81d809b689613696868120874ae2febb1d236a2dfdfc3c959d3c141623865e45b94f1239b94007a3ec057f18edf6fb1c176729696d3f447a5e42fe073
SSDEEP 12288:7+vDoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:CkTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1FFD4232EB550A9CEEE880673010D071AF778B8F22F9555DF08646C7ACB312E62672D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2999ae8b733600681f9074717c32ad3899ea79937752eda7518f4c3374e53f06
MD5 984a219fc0dab3cdc109bf8d5742e152
SHA1 40124253877159db5b2408ce317ed58e812316ac
SHA512 5cdb2e77b2d60db56da15e83e1020e8f486e6d9520e10715ab9ec755296f0e9223980c7de3d44d1e14d996f7c597e31d6562702c5409bfef18a56f700d0d03c7
SSDEEP 24576:W6gv+VoTfaidZuTpqHvDLLv9VbNNDQUFjc1y:5gm+TrZuTpMvDLLzxNDQUJc1
TLSH
T110559D1DB7EA05CAE2B2D275D9621493D633B4311772D6CF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 3d118cede0a2d52102a7b4805e94d253b879453eb86b526ac3ec731d57807bca
MD5 05310850456158331d522c5467490b8e
SHA1 f175d205339afc78b2485d7a07f6b67f7117ba31
SHA512 bc7c238e93dce745e1524f8dbb064f3bf7bd6146ee8e94b646613042517f93f2af00213b4d399a8d2affd6fea8bc06bca17a614b94855017ed4852f657d4ec95
SSDEEP 12288:XpJcm8CNwc5wM5d2MJZWROWDnExCikD1PJj5mMq5cown:XrcmRMM5d5mROWg6j7vZ
TLSH
T10D05F14EB27A10A5E0BBD17C89424616E6B3B0316702A7CF42E1C77E4E277EA7D35B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 130346ce8e471ff6e1bd02d1ab2066087b659ce788f40d01e3fed4eed7385a41
MD5 15a9531179878f59b283edd8cfd5fd55
SHA1 a6beb4b17b52ca41d2faaa5cbc923f619115102a
SHA512 0f095ef72e4d0f6efc086f3fc1dc17e544c37f56359a9645361339ff9407fd947bf0b535f650a1e514415b4906b27b68d954810754313aab332d8394fde7e88e
SSDEEP 49152:jDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3OTpMvDLLzxNDQUJc1:43Upow8sBSPPxNDQUJI
TLSH
T117A58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 6608657c8402346d165b62ef93be2ee95938dd2309f79c2de3e7846061012f60
MD5 5c697008071fd16818110936e4c3db06
SHA1 55a6183a94d1125a78240b99189ba5986e0e9c24
SHA512 d5d4a0f08440a61005aa1e7113fb76d57d95a211b6b53e160b5c25bb1c5c176968dbf326bc7b53d902de0cb0db8741dbd67ae5a228cf9c9c0777ff755a644ab5
SSDEEP 12288:JHvUrBFrEjwaQ1MoNCYpumRPeTLvDLRxv9VbNcOOAake0EcQjjEFjc1y:JPUr+NQfTpqHvDLLv9VbNNDQUFjc1y
TLSH
T1B105F12F62A81CE5F67AA17D8586470DF771B4621751D2CF02A0817E4F23EE87D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-572-0x00007FF6A6640000-0x00007FF6A6A57000-memory.dmp

Download

memory/1232-639-0x00007FF6A6640000-0x00007FF6A6A57000-memory.dmp

Download

memory/1232-495-0x000002A2B7820000-0x000002A2B7886000-memory.dmp

Download

memory/1232-493-0x000002A2B7820000-0x000002A2B7886000-memory.dmp

Download

memory/1232-637-0x000002A2B7820000-0x000002A2B7886000-memory.dmp

Download

memory/1232-494-0x00007FF6A6640000-0x00007FF6A6A57000-memory.dmp

Download

memory/1540-477-0x000001B210100000-0x000001B210166000-memory.dmp

Download

memory/1540-561-0x00007FF718C70000-0x00007FF7193B4000-memory.dmp

Download

memory/1540-478-0x000001B210100000-0x000001B210166000-memory.dmp

Download

memory/1540-476-0x00007FF718C70000-0x00007FF7193B4000-memory.dmp

Download

memory/2328-30-0x000001E4E9DA0000-0x000001E4E9E06000-memory.dmp

Download

memory/2328-31-0x000001E4E9DA0000-0x000001E4E9E06000-memory.dmp

Download

memory/2328-32-0x000001E4E9DA0000-0x000001E4E9E06000-memory.dmp

Download

memory/2328-29-0x000001E4E9BB0000-0x000001E4E9C7F000-memory.dmp

Download

memory/2440-47-0x00007FF7E3C30000-0x00007FF7E3D98000-memory.dmp

Download

memory/2440-63-0x000002449F0D0000-0x000002449F136000-memory.dmp

Download

memory/2440-65-0x00007FF7E3C30000-0x00007FF7E3D98000-memory.dmp

Download

memory/2440-48-0x000002449F0D0000-0x000002449F136000-memory.dmp

Download

memory/2440-49-0x000002449F0D0000-0x000002449F136000-memory.dmp

Download

memory/2512-17-0x000001B385390000-0x000001B3853F6000-memory.dmp

Download

memory/2512-16-0x000001B385390000-0x000001B3853F6000-memory.dmp

Download

memory/2512-15-0x00007FF729DE0000-0x00007FF729F03000-memory.dmp

Download

memory/2512-19-0x000001B385390000-0x000001B3853F6000-memory.dmp

Download

memory/2512-71-0x00007FF729DE0000-0x00007FF729F03000-memory.dmp

Download

memory/2700-56-0x000001E6F0FF0000-0x000001E6F1056000-memory.dmp

Download

memory/2700-57-0x000001E6F0FF0000-0x000001E6F1056000-memory.dmp

Download

memory/2700-55-0x000001E6F0E00000-0x000001E6F0ECF000-memory.dmp

Download

memory/2832-504-0x000001EB676F0000-0x000001EB67756000-memory.dmp

Download

memory/2832-503-0x00007FF6DA6B0000-0x00007FF6DA764000-memory.dmp

Download

memory/2832-581-0x00007FF6DA6B0000-0x00007FF6DA764000-memory.dmp

Download

memory/2832-505-0x000001EB676F0000-0x000001EB67756000-memory.dmp

Download

memory/2868-545-0x00000208BD950000-0x00000208BD9B6000-memory.dmp

Download

memory/2868-641-0x00007FF6959D0000-0x00007FF695C5B000-memory.dmp

Download

memory/2868-549-0x00007FF6959D0000-0x00007FF695C5B000-memory.dmp

Download

memory/2868-544-0x00000208BD950000-0x00000208BD9B6000-memory.dmp

Download

memory/3160-464-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3160-543-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3160-470-0x0000000000840000-0x00000000008A9000-memory.dmp

Download

memory/3160-465-0x0000000000840000-0x00000000008A9000-memory.dmp

Download

memory/3180-99-0x000001D041890000-0x000001D041990000-memory.dmp

Download

memory/3180-97-0x000001D041890000-0x000001D041990000-memory.dmp

Download

memory/3180-120-0x000001D8566B0000-0x000001D8566D0000-memory.dmp

Download

memory/3180-109-0x000001D844EE0000-0x000001D844FE0000-memory.dmp

Download

memory/3180-111-0x000001D844CE0000-0x000001D844D00000-memory.dmp

Download

memory/3180-108-0x000001D844A80000-0x000001D844AA0000-memory.dmp

Download

memory/3352-426-0x00007FF645220000-0x00007FF6452E9000-memory.dmp

Download

memory/3352-428-0x000002B2714B0000-0x000002B271516000-memory.dmp

Download

memory/3352-502-0x00007FF645220000-0x00007FF6452E9000-memory.dmp

Download

memory/3352-427-0x000002B2714B0000-0x000002B271516000-memory.dmp

Download

memory/3748-457-0x00000221FB550000-0x00000221FB5B6000-memory.dmp

Download

memory/3748-531-0x00007FF65FCA0000-0x00007FF65FDEA000-memory.dmp

Download

memory/3748-458-0x00000221FB550000-0x00000221FB5B6000-memory.dmp

Download

memory/3748-455-0x00007FF65FCA0000-0x00007FF65FDEA000-memory.dmp

Download

memory/3808-6-0x00000000028E0000-0x0000000002949000-memory.dmp

Download

memory/3808-0-0x0000000000A80000-0x0000000000C27000-memory.dmp

Download

memory/3808-26-0x0000000000A80000-0x0000000000C27000-memory.dmp

Download

memory/3808-7-0x00000000028E0000-0x0000000002949000-memory.dmp

Download

memory/3808-1-0x00000000028E0000-0x0000000002949000-memory.dmp

Download

memory/3876-585-0x00007FF693E60000-0x00007FF69419E000-memory.dmp

Download

memory/3876-586-0x0000019E167D0000-0x0000019E16836000-memory.dmp

Download

memory/3876-584-0x0000019E167D0000-0x0000019E16836000-memory.dmp

Download

memory/3984-485-0x000001882B310000-0x000001882B376000-memory.dmp

Download

memory/3984-568-0x00007FF61AFE0000-0x00007FF61B08E000-memory.dmp

Download

memory/3984-484-0x00007FF61AFE0000-0x00007FF61B08E000-memory.dmp

Download

memory/3984-486-0x000001882B310000-0x000001882B376000-memory.dmp

Download

memory/4036-643-0x00007FF7E9FC0000-0x00007FF7EA4C7000-memory.dmp

Download

memory/4036-564-0x0000020BDAA20000-0x0000020BDAA86000-memory.dmp

Download

memory/4036-563-0x00007FF7E9FC0000-0x00007FF7EA4C7000-memory.dmp

Download

memory/4036-562-0x0000020BDAA20000-0x0000020BDAA86000-memory.dmp

Download

memory/4472-512-0x00007FF603CF0000-0x00007FF603E0A000-memory.dmp

Download

memory/4472-436-0x000001F1F9920000-0x000001F1F9986000-memory.dmp

Download

memory/4472-435-0x00007FF603CF0000-0x00007FF603E0A000-memory.dmp

Download

memory/4472-437-0x000001F1F9920000-0x000001F1F9986000-memory.dmp

Download

memory/4564-523-0x00007FF672640000-0x00007FF6727D5000-memory.dmp

Download

memory/4564-524-0x00000153087C0000-0x0000015308826000-memory.dmp

Download

memory/4564-525-0x00000153087C0000-0x0000015308826000-memory.dmp

Download

memory/4564-636-0x00007FF672640000-0x00007FF6727D5000-memory.dmp

Download

memory/4592-533-0x00000260A9110000-0x00000260A9176000-memory.dmp

Download

memory/4592-534-0x00000260A9110000-0x00000260A9176000-memory.dmp

Download

memory/4592-538-0x00000260A9110000-0x00000260A9176000-memory.dmp

Download

memory/4592-540-0x00007FF6699F0000-0x00007FF669D11000-memory.dmp

Download

memory/4592-532-0x00007FF6699F0000-0x00007FF669D11000-memory.dmp

Download

memory/4636-552-0x0000017D151B0000-0x0000017D15216000-memory.dmp

Download

memory/4636-554-0x0000017D151B0000-0x0000017D15216000-memory.dmp

Download

memory/4636-642-0x00007FF611A40000-0x00007FF611F11000-memory.dmp

Download

memory/4636-553-0x00007FF611A40000-0x00007FF611F11000-memory.dmp

Download

memory/4816-39-0x00000289B9280000-0x00000289B92E6000-memory.dmp

Download

memory/4816-38-0x00000289B90E0000-0x00000289B91AF000-memory.dmp

Download

memory/4816-41-0x00000289B9280000-0x00000289B92E6000-memory.dmp

Download

memory/4816-40-0x00000289B9280000-0x00000289B92E6000-memory.dmp

Download

memory/4892-445-0x000001FA04890000-0x000001FA048F6000-memory.dmp

Download

memory/4892-443-0x00007FF645220000-0x00007FF6452E9000-memory.dmp

Download

memory/4892-522-0x00007FF645220000-0x00007FF6452E9000-memory.dmp

Download

memory/4892-444-0x000001FA04890000-0x000001FA048F6000-memory.dmp

Download

memory/5624-575-0x000001F70C850000-0x000001F70C8B6000-memory.dmp

Download

memory/5624-573-0x00007FF7A3CF0000-0x00007FF7A3E1E000-memory.dmp

Download

memory/5624-574-0x000001F70C850000-0x000001F70C8B6000-memory.dmp

Download

memory/5720-362-0x000001C9483F0000-0x000001C948A81000-memory.dmp

Download

memory/5720-417-0x000001C9483F0000-0x000001C948A81000-memory.dmp

Download

memory/5720-252-0x000001C9483F0000-0x000001C948A81000-memory.dmp

Download

memory/6064-583-0x00007FF75F140000-0x00007FF75F3E3000-memory.dmp

Download

memory/6064-513-0x00007FF75F140000-0x00007FF75F3E3000-memory.dmp

Download

memory/6064-515-0x0000021C84D60000-0x0000021C84DC6000-memory.dmp

Download

memory/6064-516-0x0000021C84D60000-0x0000021C84DC6000-memory.dmp

Download