f2177ac4075f9bf4df38fb250265591ecca5addeddc1ca23d5c9a4681677d34f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Size 3.1MB
Sample260720-mfe4yaew9j
SHA256 f2177ac4075f9bf4df38fb250265591ecca5addeddc1ca23d5c9a4681677d34f
MD5 1d8c70f2e334689984798fb7a3077886
SHA1 be21f26856e37af7e645d9c325891526994dc037
SHA512 a431e6ebfc2b9c67fb627d63377733c836611529761188a5b5d2790068a061f46e218f91338dc99be2674779284ba7801895caed7f44c35827e191f4f979ae1f
SSDEEP 98304:vMs3nGpoKfQWYQB9/JnP7y2UZB0PHUoPqrrMMDMMM66MTqGsQr:BWo+9x6Ywj
TLSH
T1EDE5B0213FA5C036C2623532957EA37AF169BE711B3446C766902E3D6E305C3A93D72B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5624	elevation_service.exe
2940	elevation_service.exe
4232	maintenanceservice.exe
1908	OSE.EXE
3360	PerceptionSimulationService.exe
1040	perfhost.exe
5568	ReFsDedupSvc.exe
4488	SensorDataService.exe
5912	ssh-agent.exe
3172	AgentService.exe
3296	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cff3419623e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\ConvertToCompare.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4382d363218dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e79205f73118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000859c62f53118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000082d215f63118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005c31b1f53118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000304a6ef53118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044ed49f53118dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe
5624	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3172	AgentService.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5568	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5568	ReFsDedupSvc.exe
Token: 33	3296	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3296	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3296	SearchIndexer.exe
Token: SeDebugPrivilege	2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	5624	elevation_service.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
2500	2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2640	3296	SearchIndexer.exe	99
PID 3296 wrote to memory of 704	3296	SearchIndexer.exe	100
PID 3296 wrote to memory of 940	3296	SearchIndexer.exe	101
PID 3296 wrote to memory of 5520	3296	SearchIndexer.exe	102
PID 3296 wrote to memory of 4056	3296	SearchIndexer.exe	104
PID 3296 wrote to memory of 1808	3296	SearchIndexer.exe	105
PID 3296 wrote to memory of 468	3296	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1d8c70f2e334689984798fb7a3077886_coinminer_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2500

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4232

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5568

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5912

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2968 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 3068 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2968 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2d9b2840590133c2531d4a84cfd0954bf74756662136b3a53f1a95cc1496b769
MD5 beacc292e0c11e1b8954839c776ae9cd
SHA1 7cd4471cce598dac3540473bb94ac54be7938754
SHA512 52ceb972f4b4adbd6927ded6c45ac865c401fa4095f0f9efcd842f75938e4e684c1166ed43f4e7a0abf80b90a1732045b0f969ae793a5c02e4a6509c32aec881
SSDEEP 49152:vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn3AQgAT76sQuE:t3q6mjBXqGsQr
TLSH
T187D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e782be4a19dc48577b3f91bc7865f3d7835783fc7681fada23b26007dda8fe2a
MD5 bae6303d1d93f0d172dffc7bb16a1693
SHA1 864eeff97c1f37daaef0590eea71a09eb4378065
SHA512 1baf4d4950e16dbca3b75817e33352d4f64f214d3db28665d80f3f524a64e51c68c2495095031049a6c1215e7bc5c8cefe91d9088c55dab017835ceb1e72844a
SSDEEP 24576:1XYfDtczAiAfYLH8AcevDN0FImbwQuq3Wia7gD:gtc5AQgAT76sQuE
TLSH
T11875F12967D408F9EC6B813DCCB28511E773B8A54360E79B03A49A661F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 50ba54cd89ff24397e37b2c5934c4db6e20a170e4eaa6e6be43536b13e038859
MD5 68824a2c06c895ab3a5d87646e92906d
SHA1 04d23f3bc29c9e10b4174de4895a48f6b53321a7
SHA512 4c102906feb3423a1a25c094da67d37f4b31a0acf621add5069a6786dfcd8f26662a777425a4b882a6cfb8e730a3937703aff690f527156f20c2cfa3fdd161d6
SSDEEP 24576:O0Le5ji0hmxhrMPAfYLH8AcevDN0FImbwQuq3Wia7gD:OPji0AzIAQgAT76sQuE
TLSH
T15885AE16F6788335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 df29b982265517f14ef135c2f1b7b9c739fcf167580f8237ab796cf56591c6d4
MD5 a857cb257ddf825ccff62f3d5acc2dcc
SHA1 287eaab6eb0918319af2da50b4a448b1944896d0
SHA512 8aaeeed6eceae4e93c35c41d443b73c11462dad271739228c492d0dd63d5dd298ed11c857bddac2f7271cf2648a50d6d7cc6b10d32c196ee2932c7fb2f989aca
SSDEEP 24576:Wa7/ezSC6vUyD/aqgrvWj6q8wyuJAfYLH8AcevDN0FImbwQuq3Wia7gD:h/ezSC6vUzPv+HjysAQgAT76sQuE
TLSH
T15A755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cd4420d5b4e4023ed22a7e09387f52cd060691a4d1105d6f789a411a0a67e36e
MD5 383929f9794e710c26b5613970d8a173
SHA1 70d51b762779a45bb2b21932f6effd751d7b26a8
SHA512 1dafda023ccf559a5a98647bdbd91a7371ed4c2256cfdd4450dd4a9f93613bb4d4d95a711482c07fd8ebc7647ae868fb44dfe0a9615b23c1cbf2c02313d01653
SSDEEP 24576:JVbqPb88hv/l+BuAfYLH8AcevDN0FImbwQuq3Wia7gD:JVO88hXl+oAQgAT76sQuE
TLSH
T127559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ff08df9604860b8bb9536cc7a1d968781e3c70d25a38b4d55a24e3e25604f02c
MD5 d1a671733c32c782db5b8aa814ec18f1
SHA1 b665547caeb1f503ded412fdc50f82f772289986
SHA512 de92c12680c4807de4fcf42bb1b7f79112fe032a6d135f3e052b7726ef79dd535c3e4820b67dbd7bb79a9f004687bbe3e58491f232071c1d594e3283375955e8
SSDEEP 12288:4GbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4GbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17B5523978A4C70EAFEFFD1365CBBA5B963D1BCB88245965A00463BCA793D408D1D0D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 7a8aaf4c54f8c338329c654c5dec4054feeb7e803bceadde56b9c2b84cb8caa5
MD5 1fb4822cce52deb3d146dda17ddf3ef8
SHA1 a0372960ea13811a921546d77ea8961ff8e04f49
SHA512 9bb072427c96d73119426c0f16d4dd686e5f2b69470032be8ccedb872e05a5e0bea2bd3649d299f2011e49b92cec18e0d56b2b08c5a09405177eca06a7d58b0c
SSDEEP 24576:eJIUGAfYLH8AcevDN0FImbwQuq3Wia7gD:eJIUGAQgAT76sQuE
TLSH
T16375DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59753f739cfc30afaded76ce41f81ea39e7dd13ec07394475300504918c708f5
MD5 622625b547f550b8376e02fbcafa0045
SHA1 974414dda3a8f53399e937d4fc41c987031a3de4
SHA512 cdd1d41714d412e9f26e341be09694fb0ac19ee67e651ec6b20ec2c69811cb723e7d29629eb61183b6988dddd9cc6e8ffe206ce545cdc32cc2332a25289901bd
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THR:IQvGAdlCEL8c/WRNw5CCqGsQr
TLSH
T19B266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c50f7cdbf03f908fb07f91a03be67b1a089ff70795fccece52b9002ea0b47332
MD5 680cb85cacf2dca622edab98d1f9a1ed
SHA1 63108fb9c274db6d8ccedb5ebc550400ae431873
SHA512 d0d7c35d94f7dc937a509384caa0043a57859b8618e3e953e45906f5740762c52ebfeef7701a675c7e9467a62e4d691b88e9d065da41b4785c7b9c63690fef41
SSDEEP 24576:efewsAjYAfYLH8AcevDN0FImbwQuq3Wia7gD:8ljYAQgAT76sQuE
TLSH
T13275E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8bc8124ea5d2f351d8ef46147d1940db9fa1e151df9e61c9ed29c7231cf8ee02
MD5 4bc0a64c4d90b500b4cdb92fda5425a3
SHA1 878e62885a36a386799e8c2cb743f5764e486909
SHA512 3cc19c871b68e2a864cc9b7fe73afc4b1f79d1eaa268b02479931d2f2e7e1ad560ccc50b85b6525e8d0be7c1310faf5db5d041b6f93b61bdfcd39c82d9152ba7
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHTj:oUEtQevvqc2W1cpV20I32
TLSH
T1FD474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a8232054ab03cb17992401eef9226f5683458b7fb16c21b174985a63faaee700
MD5 b0875737a0a9ae4e656c8230500a3416
SHA1 18556f966364caeb1257f7eadf71872e1123994f
SHA512 114def019112cb2dcd24ff03e851392ced4e119dfbc66345e39415e11731cd0be8b9e1833a6e4f9ca0a5c3974ac33d31520f9fae2a60b10ce10193905dd221e3
SSDEEP 49152:fCbRquA/m2yL5zLfFiV+XenmE3/z4AQgAT76sQuE:4oq2VjnmmqGsQr
TLSH
T12FD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4af918026a506541af59b7e23e63e339e69580fd515daf8eb3d9e58f1ffc709f
MD5 a1219a38a924274590737f5537c277a2
SHA1 76c14d7823248046c54a39340a3f8c1b6457f651
SHA512 5dc3ad95297ce73a63e452150ee2a4d40ea8949abb9f705e4d3aa2b9c5e3856ffd6f88c045517bcc128653475a20efea7f92156254925816910a113693bf6365
SSDEEP 24576:fAhGL6IFoiwtA5l7S539AfYLH8AcevDN0FImbwQuq3Wia7gD:fAM5Foiq5tAQgAT76sQuE
TLSH
T19435AD81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D21F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 42bcc8cfa0a1dd2da317e4f0ace2bc70ab49082ac5799dcfd5c12581d57d94a5
MD5 7a850d71f5b65e9b25a178f0ff7bc62a
SHA1 6e09ecd717d3c0f2e07efc9053fd6632a98d5a22
SHA512 f5f557110b6db88b10e7006b2391380e6ec482203ff9d3ed14f9791690616218cb97c043701602c3f82ec7163d43048dfd3a963adc3e38741e1b82e0a31163ee
SSDEEP 24576:CwuROWMAfYLH8AcevDN0FImbwQuq3Wia7gD:CwSOhAQgAT76sQuE
TLSH
T1E565F14677A81CF9E9A7813989A7C136F7F2BC152621D71F0360C75B6F37221AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ad15f397099820c8bf087666174e625182be560dd633ce90a8bb3be8d01c5b59
MD5 da4927b9661985386e89677192e2284f
SHA1 fd35c70d2f4efbfa33bbab0850ea87cdc64278a9
SHA512 ad7bc328ecb5805ad1fb4133539f232459ad65dbcda346cf3f76adc79b64997d759426b1f9f98fddbc1e217ff98261e9deb3ce5c648fec7928666a98d0397d0e
SSDEEP 24576:jZuHAfYLH8AcevDN0FImbwQuq3Wia7gD:0AQgAT76sQuE
TLSH
T1F355129B239830FAE5A7D239CCF25659D3B278A6532283CF0115079A2F37AC59D74B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 271fafa0d4c8c610027035ab5a9e9ee04836bfc7116ec3a99c943cd1dc89f5d4
MD5 184d3c97784566851f341d9ced628b53
SHA1 8cb7fa2f2a39b270b7c48a9066b1d0d50129cf28
SHA512 dc2f828a0c418aeca0b3d60332f1a7e38809ebf62883f8f02c7f8dca8693fa97545eb4ac0c5a7a9fb78314af91d393f617bc21a230bd89fe8238c12d10a773b6
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UN:oQRQyi36YOcPDLvw2gAf+PN3TqGsQr
TLSH
T142667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8b39716e4c8d8734c6b84416bc76e7e4014d306202ace72a198339e21478b8c1
MD5 62ee663d6f33a820b1a830f4aef588a7
SHA1 171aa90eecc23d6e9b8981714cb1160b78696552
SHA512 eaaca98e6bcdfa5900a8c914cf91a8ddceee7b38530f0e755707eee8edd6534f6962fc6d8ebf2482b5ea5e2995aee3c4a8fb23cdd709d1eb5bd4478bdb2ee469
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UN:MQRQyi36YOcPDLvw2gAf+PN3TqGsQr
TLSH
T1EF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 49c6fa9ea934edc582ba29d2ccad62abf4c5bd6a178ac31943d8f267720f7146
MD5 76e15329bf9af44dc082b37a3cd7d31e
SHA1 aed6faab8e542b4493c0e5f7be43ac267983e957
SHA512 9394b1811ac9303e2d64420edf2b5fc5c4c975c42a37060d145679f48a381648e5b38a01dcc2d0b3b6c77cdf9695f2eb407bc6c5a59a4335f86e9afcdcac3517
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL03AfYLH8AcevDN0Z:768Qg55nhkeWu7PNU3/IAQgAT76sQuE
TLSH
T1C1B54933B2F600A9D44DE1769F4A873196D17C758FE0E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b3c7e7d1018d1c8e8ed105f93c39005cc976b11c9a55ffd6738e1087ec49ad03
MD5 bbbded059b9eb1acdd287b9177347023
SHA1 cf3887ced24932eb5d1579cad13222cb63266c42
SHA512 05d7ed59580af65ec86fe401348fe59af043e1806bc173ca65e8a9abff76057c89ea1c8f11d1df0ca8e5bbd8459056dd8fe6e0a1b014cfb52df271845fe04bb4
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99X:Uy5112gYy5azzVvU69nLKnhZAqGsQr
TLSH
T171167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 24964be95f6874a3b195f55490429cd371c31f31ef60675d299f100f3676ac68
MD5 820e83fca72cb92ab2c33930010acf56
SHA1 caeb6f564fc8c58470a96612d685dbc997b9751f
SHA512 aa08258ada5bb56782744e413161dc4a4a452f061acbbd39a537ff7a5fad6f5686fcf93b3d5fa4e373b5a3f2d4b816db29fd0828d81121465352a70276af015c
SSDEEP 49152:rB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glSAQgAT76sQuE:9u6JmIxd2dLqGsQr
TLSH
T11FD59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8e976fd9307b4651c78fff2d32b89fbd96b4a5b32308afc890d708cf43ee8447
MD5 8ca6bdc1075beea452ac7f30cbd1c5b7
SHA1 48dcfa7f490615837ea46363bb953d89fa9a246b
SHA512 ea6a0782a456770c74ebb62fd069a607dd56b9efd765d6d2b7cb9e1d95b478530009cd3d54bc47dcd6dc4ad69767edbde0d72741ecd3e82cb6c9c2f418715652
SSDEEP 49152:P1hpsNoJpF1A67U44CwH7R4xmAQgAT76sQuE:PmifPqRmqGsQr
TLSH
T133B5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d6132a30fdcab6f0312bf74e055607c3fb186d14a4b36b3dc7fdc6661332bbbc
MD5 bc84641902bd2b50bd2138c3a5556e17
SHA1 6016b0df74d1862087257c47ff86cc45b3ca9f2e
SHA512 37e0756de3461d89ba5802fc28ad1a27c1cdb59726b843b310b485eb1e2cba3e8a1de844448e68c3356f289a7f2dcfed82d56f048335457e6661cebc4a35d272
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqHAQgAT76sQuE:p5dKqi61MqGsQr
TLSH
T195C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8f7790b44739bbb270fa40e9842c328e5b4ec2096ce7a3725a21f7fa0be5db0a
MD5 8f22326f7f632da7ec77d0ee95f785be
SHA1 5025cc6087cc916363df77411fc38647f2fa3bdc
SHA512 9ec5b7a8b51fc828e3947d0c273d27fdb494b515edb89dc87df0f7b64f8a7059638b8a5c01a6643fb2eaa7cd2abe5614f60270dad9c60c39d6e6bba335accf0c
SSDEEP 49152:shtSn8EApI0figjgiDn0AP5wiAQgAT76sQuE:NX2iWphqqGsQr
TLSH
T1DE95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 29caaaf2819b600d3964332ff4433c0f23ed1d7dc5ca66fab12a0bb4413903b3
MD5 30457cfc29cb82c5f94ae2194a51e9ad
SHA1 3fa35856f9b8938037553a2776af59ecb705d8d3
SHA512 9ecb7caa28247bb4e1cf9aaa60830dc3ff5a6187b4bac99d8d101cf2d49b446bee7d6b07f4286f45fc569ac2b745ca6b8c356d40a88d4a26491121d9fa690a52
SSDEEP 12288:BTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14955235B5A8C64EFFCBBD1368CB791B993C07CBDD346539A110B2A8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 716e1968df636357ccd2f27bc7b95198af30625dc3033b73a5151aac6110de6e
MD5 357ad10223b6e3289c8941708bdf714e
SHA1 884ebcc0ce8ade520619623af14a92b9c87d7bf1
SHA512 c54b30bf29f8258a6d933fd41130ebeb508d98add78fdc6c631574e1f3f9ae0278bac3107e6d8955c3e5767af0c4a3d0e6ce144b4e2a6f93dff6a6d153dff04a
SSDEEP 12288:N0AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:N0AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F555235B598C24EFFCBAD1368C7791F893D0BCBED346939A110B2A867A3E41891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e06b2ee6a4aeb548176ea5fa60706b0c65a124ae57399ff229c4d473f44a5257
MD5 27be5a6eaf1f96533bbddb15d45da79b
SHA1 7a9f0e4903dcf1321a049ae4df1d148c1ebece7e
SHA512 e73cdeac8bfb4ea9b933fa28697f61f3a81ad8cfb191bdc72edfbf36b074446af561cfa8f933f057aac8a5bf7530598cf6b3e44b9c85e4f370422088a85312be
SSDEEP 12288:beAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:beAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1CE55235B5A4C24EFFCBAD1368C7791F893D07CBED346939A150B2A8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 d5b280a9ecef627976315d18c9a79cfeb1d26fbe3fc7fb3d839e73ab31662a60
MD5 8483942c02c93a9951a454341a95665a
SHA1 006fc955aabb6a5a71017648c6e44d22e4d74ec8
SHA512 d1ecc9967217aa29f42dc47378b80a9ac80869e7bf48da1e751378edd8074e242350ab1283ea9f0185d6fe4f2a98e5b3ba240a08794f943670515a3258bd92f7
SSDEEP 12288:3VdAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:TAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A5552357179C20DAFCBBD135CC7791B9E3E1BCF99302939F46021A8A2E3A64495B0E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6384226505b13f9ba494371c057231f0fcf090d6923a91d9710a7b1fb7a15899
MD5 452b7d6b3ff0d43a2646609684161c4b
SHA1 4645e0c1f65ba9d346a96e6ddb5230272d9f55e1
SHA512 2771b5c528fbaf895ab384c95815dd2dce018b951249a889253cbf731267a2f4c5c50d6574010894df44740c0dd91f7b3b3d8f35f5c434bd3a0105783554a8a1
SSDEEP 12288:UFAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:UFAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19455235B598C20EFFCBAD1368C7791F893D07CBED346939A150B2A8A7A3E41891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 72df65c37d34afbe9407d5fea47a88917786977075dc2153a90dff94d621b6c5
MD5 5f9f597f66f21e17b52a9a4c134bd587
SHA1 c00f2cae1e9a9f3c0e58698f0a166053d26a50a9
SHA512 f0db374b9055be57286a31a63a9e3d54321b10d98aba4a18de9efc4ed2615ad5571d741f4390ab1893aa1085c1eb8668c2f5a10e028a94220553dcff899b28ef
SSDEEP 12288:oQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:oQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B598C20EFFCBBD1368C7791F893D07CBE9346939A150B2A867A3E41891D0D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0856c26290b06e67757aba6803a5515a2e9cdf10ef7637fa91779da9ee28d790
MD5 06cd2a550c2e534e90afd8dc1db423cc
SHA1 ed41e8b748bfe8bcceba1a56ac1b4756c925c854
SHA512 7396fd4db81726e8eec0ad843d5b46716b01c57cc59e10d25a837e60a6a4cfb2513423cbeef1d52a6067a71c3e6359296179af2dd43da40e46a2c7e38a2c7483
SSDEEP 12288:I8AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:I8AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15D55235B4A4C24EFFCBBD1368C7791B893D07CBED346939A150B2A8A7A3E41891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 cc3ac8d0391ab3b49e74b71a4c0f431134d3741a9d8894724da6b5d9c07689cb
MD5 1548ebb52b05558ae8980d55b0e161fe
SHA1 d78ad4a85dc2598507d7166a575c9ef1085f4718
SHA512 c3ab201ba1c41188181edf79bfbb79d845ea21a3e14de02a0c6e6642064a8214685a31b19184000b46d983dac7f9c3ade3ea0d008af449d7cd15e0bfb7631f45
SSDEEP 24576:nZM3zFVSOUAfYLH8AcevDN0FImbwQuq3Wia7gD:nZM3zfgAQgAT76sQuE
TLSH
T1A0750195B39418F8EC67813ECC668916D2B27C6A0760C61F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 580523638ee73b9d3ab6015c2836f62cad0f655c7106f7a497e2b8fec0e38e9e
MD5 a9b5edf8679a74cd1d1ea0c0f780a820
SHA1 74021e53e3c83dce35b4c6bd77f92d605327d489
SHA512 681ed26973af4f1787235226d1825516b8158a0815fd54cd25a84876e2c0e4b36ee3023068dc3f213f44ba9099e0d7592a152f09f610842219b8c72bab45699c
SSDEEP 12288:5XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:5XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F555235B594C20EFFCBAD1368C7791F893D07CFE9346939A150B2A8A7A3E40891D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 1af1882a0518b21937e31810b02184d2a457d64158693c20acf30f00464e4a62
MD5 f1608b58fde6a96b4afd151398ee7994
SHA1 32a2914970c427db2ae41486ca9def0f8e59d466
SHA512 d252621bbc5c7d3d0d80747b55521a51d4312d9b20d7f87fd5d2b65aeea12c0279915867a0745a43d6f960f91e8fd1c10ff72e5370029503ce6a6652039a13d2
SSDEEP 12288:RrAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RrAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B594C24EFFCBAD1368C7791B893D0BCBED346939A150B2B8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 8151ce0bf28fcc0f4d33523d09fccf57ff73474d1983573fc70335a360b31bf9
MD5 2a169565b2a8d5cf7c84c366a45b145a
SHA1 228b987f9d9f443fe8bad93a0ff99ebc6e8fe495
SHA512 75d7a0199852cfaa7e60d8e9ff819f29ae5d9fdfd07d5868443408fe8c74a3aa4b5ea34d2e708c3f4e64821ad9460612ba291ef347667ec67e3860abf56d3253
SSDEEP 24576:jzyoAfYLH8AcevDN0FImbwQuq3Wia7gD:jBAQgAT76sQuE
TLSH
T1F265020763A530F9E577D23988A21A55F3B1B87647108BAF135407BA2F376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 d3df58b6c97972a3d222a3b530029c3572614ab7238005b1619f26837aa6b2e6
MD5 a297bd0cabdce3b56879ed65587c9433
SHA1 b404529f923e4ed3502ae594ef94c5ec6677f9d0
SHA512 70fa7fc11ba152a521e1f55ac7754e08e826df9338ee1e1498ecb55536ad974dd063142569ff8e52cc8a4740970933b10326e63b1f2f6c462e1b477d15eeeb0f
SSDEEP 12288:jXAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:jXAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16D55235B594C34EFFCBAD1368C7791F893D0BCBE9346939A150B2A8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e8fa290e408b0998a36f0f93112fe74fdcd7ee798fb554b9cbc0af81c5df227e
MD5 e8de8eff2dea028e14081edb021e6cc0
SHA1 2986a1b3dc4e25f5acc74cdae86c157eb43e531f
SHA512 2dcb674dc0a0d9f8ddf95eaa751f98c6b6da4014a90da560535f334e6735f37953189c3a637c02dd002dd87184c24a5c4ecbe10fc3669909bd6833e8988ab4bb
SSDEEP 12288:4XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13955235B594C30EFFCBAD1368C7795F893D0BCBE9346939A150B2A8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2c99858912c2dc774c074bd615fa8085a192b184d8e9432bc9435dea2c7a04f8
MD5 f971afdeb284650455de0d0614cc21ae
SHA1 647569566a670aca1184d4aa43afed540b160897
SHA512 b66ab79e7d3c306c329fc232c2f001d114c0c36b1101149b9e8ff0920e25735d933c0d7aec56f8551673358456558e2a3958b0e30298981fc0ca19b08a97e526
SSDEEP 24576:PzyoAfYLH8AcevDN0FImbwQuq3Wia7gD:PBAQgAT76sQuE
TLSH
T1B565020763A530F9E577D23988A21A55F3B1B87647108BAF135407BA2F376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d87c751014375dd565d2a3c475a7fb225c1a1ce2e3455f981d10f7a87553a3f2
MD5 9a02bc4736c1a8a6f7605a1fafc96d63
SHA1 b2e693b835114e77c9fe419e23f1c8474e9eb1f3
SHA512 8dff5fe10ed481cda9e518880f21ccc1921d3f78f6063b49ebd9e6f86e4916dc56dabf9b069900d6433fbb747fff9fa31ba8ed8b3063cbde5a64455bb3bd46a0
SSDEEP 24576:7T8aLl3z0zDOAfYLH8AcevDN0FImbwQuq3Wia7gD:7T7LljJAQgAT76sQuE
TLSH
T194750195B39018F8EC67813ECC668916D2F27C6A0760C61F03A8366B5F373A15C6DF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 1cb629e2beaddba38ce15ad9a50403015fd06b8237748dc21ff7796d17d0ac90
MD5 81f47550fdf03610d9a74443739e8254
SHA1 1c3aa7e006248dd07832a9be8d1a1df5dc68c2a7
SHA512 27d9a956bdd13830e415765f1da60845588fad90bd1f9b1a1a0b87187016a710ef15d0d208b1002711e8e4426b0109851fbb8146d65ed828e9e8378df268e6f5
SSDEEP 24576:+3rd9CHKy7GZ6AfYLH8AcevDN0FImbwQuq3Wia7gD:Ard9CHKyagAQgAT76sQuE
TLSH
T1EF85CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e7e5435ce1102a19efb832ad9b9624ae34800268c5607c931c8d8b21a5ce75d9
MD5 a71d452214d418de5c585cef292a017d
SHA1 d36b46470c3b0782a2df2f76afacad42d9f6238f
SHA512 15c539cd86fd2e45064682b2c4fc9e059eb1f74a5df58c5d53ae99fa9d11ad1fc5fd03854bf0e73711edc16d24d57982f835336e3f687f7edbd17baf141f5ab6
SSDEEP 12288:v+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:v+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1EE55235B594C20EFFCAAD1368C7791F893D07CFED346939A150B2A8A7A3E40891D0D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8831ee29dbcf185dd0f2f480dbb38d5a5e3ebab6ca814f7f447b1d77545be798
MD5 5db7d0ea70b5238d4ed00c8176b16d99
SHA1 1d6b77f174117be65f38667a99b92f089a299341
SHA512 97ca7e88a1a00894bb04ba8e3f884c4cf2391de0f44ecc2f9a75fbb0c591dbb14bad25ec5ef9b9b727d4393754ec99a7c704edde4111c4d7625dbf4dbaa06042
SSDEEP 12288:qIAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:qIAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B5A4C24EFFCBED1368CB795B893C07CBDD346939A150B2A867A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7a70ca0ebaa60198a9788cd7ee3a797d74ef89cac85e3fdb2742c8ad1d2a4731
MD5 0d8c62d04d03b0879b6c0061f420ec19
SHA1 99d47a4213deecc41b41d1c1d1e42ab267e5d01f
SHA512 c2966fe2156a4a59ecf10a217cb567826f6ae536e90e97140f9db9e52979b33e4697aaa6b8a12f9439185d671651218118fe0ff78a855634b005cb7a96e43aab
SSDEEP 12288:lRAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:lRAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17055235B594C24EFFCBAD1368C7795F893D07CBE9346939A150B2A8A7A3E40891D0C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fb3d7b51562b72a37b5817c1eb0c0ae5bb674cc31660350fd30097647829cf46
MD5 f3adee0a271aaa85764c545f4acb763d
SHA1 16471cf0944eaad4049f78ccca72580757dc4467
SHA512 7ff90086ef6efc5b4a50e12a097a9172f016a44fe9cb7516f8a73125159cb59e961dfcb429a40782cb7184b0b7f7cc7ade63309991e684093479886b9ed7622f
SSDEEP 12288:2XAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:2XAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14255235B5A4C20EFFCBAD1368C7795F893D07CBE9346939A150B2A8A7A3E40891D0D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 175a7f54602300f278bd673fb276f80853c2577b82ccdc6dfdbbe5156bf5284e
MD5 be3f7251282df0370bb69e6ebfd338d5
SHA1 209d897859bb8fe5623ea081302a58d98332c713
SHA512 a307f48366c89fdcf9b1a3a8a09eb3633cfa3452cf179b55f24c09c192eee13d621f07ea22f7af27ba4bd6127f924e89ce10c207b828c777e3bff1c834b6dcc4
SSDEEP 12288:B+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:B+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14655235B594C30EFFCAAD1368C7791F893D07CBED346939A150B2A8A7A3E41891D0D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bc93c860b598e22e2d238bf9fd8a49d3e7cde05306ef58518d865815891fcd01
MD5 bdd9b0d5b0b926cfef2da81a02f51dbd
SHA1 56d9e79b3a4eb422bf32c24dbbb486eca1b9f0b7
SHA512 c01f101476144734f705aaa6464c70066e4057e502e60bcc3ee0395386efb84e72e5de0b9ed5cfdc4febc8783dea13c58d9fd82c94857c393c3a0efe1cc5b379
SSDEEP 12288:W/AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:W/AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B594C20EFFCAAD1368CB795B893D47CBDD346939A150B2B8A7A3E40891D0C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6c97230fc375e1b46533611d3286a5c11c4d9328478dca76602849c43dbcf1ab
MD5 f93544d9f64e31d48caebfd81ab6a985
SHA1 525f7b21a0eb285d26752b5e109db06495c2db9b
SHA512 898821f5e3c35d199fb0b29fd6d8b326074e6dbf46ff1a9b71d89022c42d2a032a338e81d4a491f7c829f751bad6b89f957213a4ed5e9677999d51006f08682d
SSDEEP 12288:+FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:+FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18A55235B594C20EFFCBAD1368C7791F893D07CBED346939A150B2A8A7A3E41891D0D78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d0ad8bd23169b50e9d287d2203f95cbce01154c1244e65871ae7e76b1ddf2f3e
MD5 d7b6a56c778f1c8789362e3270097473
SHA1 bbc3b62b13e1cbbda2a23b73393579cd6d60ede7
SHA512 62524d262f6a13647fa97a3a9fe9fbdbcd29a605f048b2b398f7bb065d15d8af208fa37a47d19cc94e9a8c1b34ee5c10a644ee57092546fe3a82c3c01762c4a4
SSDEEP 24576:Sfwvzk9RX6wkyAI7AfYLH8AcevDN0FImbwQuq3Wia7gD:ZMnYI7AQgAT76sQuE
TLSH
T13685CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 36b2d698483e5108d0287c3ef768d1a41ad2e0355922bafa555dbead1c625d1d
MD5 ab885f969a4aeb7b66cc2710238414a9
SHA1 80bd91913f41db54296b374b86ff310a06356ce7
SHA512 88ac4c1aaa416cb764ed81c706cbc5879252b58232981ad9407b1c10bdaeff17362b8dab654a9e8a2a8faabdcd99e723bb2f4f67dfc84010ed2ac435d0cc5012
SSDEEP 49152:uYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CAQgAT76sQuE:RySzPzqGsQr
TLSH
T120066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 cc08b0c48f4e13a26de57d1fb420feaeb466ae89b5b5995e383a53d81273870c
MD5 4352ad6620c564347905c3ffaaf4b4c9
SHA1 20fc84d97f974465298ab6d1aa2e79a2d517e9e4
SHA512 8dc3fe2df56fb14fb316bae62c29fed0035aaff9e3c713daf0e04cdb58b6bc4af2f24955992c50f2b5e6225bf08c23621e9a725b4c490369004ff0b65e93b170
SSDEEP 24576:r47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYkAfYLH8AcevDN0FImbwQuq3Wia7gD:r47JUQjqirIhCnDHUPfF/SAQgAT76sQr
TLSH
T187659D1EA3EC01E5E1BAD23885154A5AEA71782D1B31CACF1270437D6F27ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bad9d4fe0ff3bdff93efe78e0bd0914768307adc296efd68091f42a9e3f614bc
MD5 a65be1c57e419a48c8443222eb8b35b4
SHA1 044167f0aae7cf692e215c39625095a4fa2975ae
SHA512 a9ed0fa54f2f9b99039cab1d2c7e3d54a411f054b473116e541d5308914e919cab7b4b90191bda526f37d3c18c075ea9acd3f292888d121a274f5aa37d1f47f1
SSDEEP 12288:LpsfHAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8HAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17C65011AD29811E9D46EA139CB664A50F3737C6983E1D3CB12C0F57E2F3A5809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7e844a9eb0e20b5cf15a3ce361732d78098c8b7284d96aed4bb5e7da46c2025b
MD5 bb0e53ac3dfc9f90ded23756252fdc19
SHA1 4889255842bd3f3975e223c37c549d20a0e114df
SHA512 15e45bfce27440c1b1c6f7a84a0030e220f37dc5439bb93db93dd20b17d2e490d42d8b7b320297f378e286a2789e0405f5fea18c67b533ea8f4990106cb12dbf
SSDEEP 12288:5nkoU3fSiujSDUigKNQAhnKCgRMVQu1Kd0:5nxUPR9DUjKNQApDgRMVQVu
TLSH
T1714517407626C74FC6AD40321E32D5CCAB707D51EE04AF0773C99B3F95B6658BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 cba5728ca26625c9fe9fef7d0d9facc725502870de503044c037b0b6729d5a93
MD5 fb7c195216311e5760caa0655d3c834e
SHA1 920ea2cdf4e9ce61c00ae330d1b9b6eec99b6a9b
SHA512 dbddc06f8ebeefcb4844c77935557d9e647295b5d87bef48e1dcf8c13dbc9f0c127387920d7c5f1f9310702426a15c9dba3615ce1cef5c9986f2f5f8fda603e1
SSDEEP 12288:BH1wwp60n+790okfRkOh6woT6swAKJacSI5yCTpYy5uss+VNrdkbquAly:160n+qD9ux
TLSH
T1D365E9806437D28FD1BA6032033A9B4CBBA4EC06B7495F1677C8453AD86AB15B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 b51da9f0e3d8c6f7efa7237666414a659c5b91893fa3be774632156ab93ed3b0
MD5 b77ff8c39fa68cd60c76f757576686c5
SHA1 aa6b7e7dd73361859a168193dc6cdf721f362ef9
SHA512 c7bd9f541aea4b089a9af62407f7d9cd8bb24045abb367cea2ea082f24855fc88207b1fa91c5959783d16bd06eb282d450bf2f4b92b34e15d6115ae10d0daabb
SSDEEP 12288:WF7vAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ivAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BD552357878C64DAFCBEE135487B91786395BDBC870092DB640627CA793D8C8D9F0E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d7a34b853883126b54b4eac7b08fa228529b23671bcaf440e15d80e6c9035ad7
MD5 a4b833f45eb068022473b27791ea8ab9
SHA1 44f18fe8fd148ed615d0fecea051bec67930490e
SHA512 cc24e32b8a4230c9f70cca6fd4ed6530e82064f2aeefcc588f5b89a0e1a0da59ebe90a6501b93267d24bb1e6762b78dd81a8c7ae2c5c3d41c55b6b9ae4c8fe6b
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYJAfYLH8AcevDN0FImbwQuq3Wia7gD:/gb4mBIBhGFkAQgAT76sQuE
TLSH
T1A465AE1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 919ee22d03df1ad83f421fe171800983212ec2e0baf7a0adceebdc16f4482c9a
MD5 86e45ca12c9a822832909458a64519a8
SHA1 93814d3387b70ceec81966d6e18b6a5d762d0b3c
SHA512 ed830a8734563fe83faf086e9e227aa61651f9df0fac15f35b7749b8d425294313fd0eb28fb9fdd81036d8450b189f5b18e36b814e7d66e412e9625e314ee469
SSDEEP 24576:zG88u8FpJqH1vzria7/mUAfYLH8AcevDN0FImbwQuq3Wia7gD:C7ZFPqVya7/xAQgAT76sQuE
TLSH
T1B085F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 f87d7dfbe97ead7bba64c3be2639c9121e35c72bc892a1d11b69d410df1d3326
MD5 b31f6fbf52eb53ba22ea19fbd9804b4b
SHA1 463a9b1d6a116f407b8c551e5c000994764d2d6c
SHA512 6dfb4292ffa2a983471ad0c5d84097fb36e7fbaa5ba93e0de24ba80a90f6473372eb58cb990673683eee407421dfe6bf65e930dfd3e85f61dbb1cd83d7b1525e
SSDEEP 24576:KPUr+NQgAfYLH8AcevDN0FImbwQuq3Wia7gD:KJQgAQgAT76sQuE
TLSH
T1E665E12F26AC18E5E67AE13D89928619F771B8660312D2CF0291417E5F37DD8BD39F20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e29ca871a59947077ce554f7108aa11d330ee3b63dd3a4e202fbcd082338f2de
MD5 94d58e3a3869c369d1d8e366f9bd2456
SHA1 6f1112a62342708c5519290e735f3f99c64467cb
SHA512 5852fe5aa9b86981d87445553b2f6858c48a3871d8c9fb366438d13cccd11a41dd42a0f1ddd19b0abf7fd014410de18c227f35af9d9664bfe3a236192817c8a3
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjQAQgAT76sQuE:YG05lO43boqGsQr
TLSH
T102D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 628e48a3f548554e7be4a5f21eb71003598d90fbc79853d665c9571186cffdd8
MD5 b7fa1902d84b5251f01c6380a203c5f0
SHA1 92139c72d7e26cd72e96619e7a7d489eec4eef27
SHA512 f51d041bd5bfbe50259ed02b7f01baef70e67785a62592583640cd25fc0ac5cb8f3b2251e910293dd88bff2dcd06ce42f0efb7e4be7744f28987e53faf10fb26
SSDEEP 24576:Afa5POZ3dpyWVM50JicR2hG0lasx2+47eidnCAfYLH8AcevDN0FImbwQuq3Wia7E:4a5POZ3lJt2pasx2+mIAQgAT76sQuE
TLSH
T1A565AF5EA6FC00D5E5B9D17DC583861AE5B1342553319BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6c8e49ab23fbf4688610a60fa36542f527aec064119ad88f8ee415a39fac9d19
MD5 0ebadb9889ebe93b46cddccc84271615
SHA1 4d11ecb084b697a7d96ec6e351df2ab2d502536b
SHA512 4de82823d24bdc4bd3d89cd07a90bec39ccfae4ca230e7fdd1372685d66f620f67562a97702c1c64df4f1438b1eded0fc2c8538d597dc28289165bb82112d2ad
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FksAfYLH8AcevDN0FImbwQuq3Wia7gD:8Nc/zEOVHFRAQgAT76sQuE
TLSH
T176857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d0276fee906af8310b90b137d32942d31fc52bfaaf702173cb2a0e4241868268
MD5 e92968ed308902b8ce3a73b59474dd0b
SHA1 62f23f81e80b605db555cea7b4507c8da4a04381
SHA512 57b648df26a846bbd4ba2d8f856f9d82e082537fc52556e7911f8785766b1aff9d041c27d68b83b53bb0fa7362d351fa73bba9d741389530ce9c4ecdbbfe59f9
SSDEEP 24576:wzkNvNnaFeYhJNtmZBmWAfYLH8AcevDN0FImbwQuq3Wia7gD:wzMwBtOmWAQgAT76sQuE
TLSH
T10355AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 69cf0a3b27c316bea4f281e15b829649c074b2b45fb2318ff7ff052c97254b97
MD5 49f44f8c2f540880309cf4bd11e6a859
SHA1 94096c0f83fd855619a8bf8f0b61bed302f2f39d
SHA512 3b2dd97ab97c9d639c5a13249de2d040ca8c8d75566203cad665c380fc3aeeb22f140c55d11bde690ee46b62dd04e47583fb51a50d99d8354476dc34fe71d2e5
SSDEEP 24576:MD3FHshBIYQgAzAfYLH8AcevDN0FImbwQuq3Wia7gD:MDVHeBIAAzAQgAT76sQuE
TLSH
T15475E17EE69C04E4E57BD17CCA638606E7B138AD032256DB019481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-82-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1040-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1040-77-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/1040-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1908-271-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1908-54-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1908-60-0x00000000009B0000-0x0000000000A10000-memory.dmp

Download

memory/1908-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2500-6-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/2500-7-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/2500-0-0x0000000000400000-0x000000000072E000-memory.dmp

Download

memory/2500-86-0x0000000000400000-0x000000000072E000-memory.dmp

Download

memory/2500-1-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/2940-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2940-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2940-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3172-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3172-126-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3172-132-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3172-137-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3172-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3296-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3296-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3296-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3296-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3360-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3360-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3360-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/3360-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4232-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4232-45-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4232-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4232-39-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4232-49-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4488-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4488-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4488-311-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4488-100-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4488-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4488-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5568-326-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5568-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5568-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5568-88-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5568-94-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5568-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5624-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5624-14-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5624-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5624-22-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5912-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5912-314-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5912-114-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download

memory/5912-120-0x0000000000A90000-0x0000000000AF0000-memory.dmp

Download