b83e6f24e696bf4e2eb0d45a70734ab2e8f61935cdd331814800f91e31906fd7

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Size 764KB
Sample260721-ea1vfsft6x
SHA256 b83e6f24e696bf4e2eb0d45a70734ab2e8f61935cdd331814800f91e31906fd7
MD5 e7db50a30d159ea1fda813db8b9cfc35
SHA1 cbc3df25578f6cea7226e31149cff87435d9b900
SHA512 9ddee14b99b32d3a09297468bd454dc9988997f0fd64f06545f4c215f5c61405ee36c2e8d71214ddaf6a2694396555c415b04c4c892f473662ef580f5efc8fcb
SSDEEP 12288:Gtymff2j6Ba5K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r7:wc6BKKY8fMCBTFKJo4IPpZThwS8n
TLSH
T1CDF4122377D18032E4A24A3258A6AEA11738FD721E24DA173798754F9CB42C1FEB7753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4752	elevation_service.exe
1924	elevation_service.exe
2612	maintenanceservice.exe
2340	OSE.EXE
3404	PerceptionSimulationService.exe
5692	perfhost.exe
5660	ReFsDedupSvc.exe
1968	SensorDataService.exe
1496	ssh-agent.exe
3620	AgentService.exe
1760	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\708935123e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000083a4e059c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005a009e59c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004cefcb59c318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4f04d9bc318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000928a7a9bc318dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006191659bc318dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe
4752	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeAssignPrimaryTokenPrivilege	3620	AgentService.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5660	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5660	ReFsDedupSvc.exe
Token: 33	1760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1760	SearchIndexer.exe
Token: SeDebugPrivilege	6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	6120	2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	4752	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 1488	1760	SearchIndexer.exe	100
PID 1760 wrote to memory of 2392	1760	SearchIndexer.exe	101
PID 1760 wrote to memory of 2968	1760	SearchIndexer.exe	102
PID 1760 wrote to memory of 4808	1760	SearchIndexer.exe	103
PID 1760 wrote to memory of 2304	1760	SearchIndexer.exe	105
PID 1760 wrote to memory of 5712	1760	SearchIndexer.exe	106
PID 1760 wrote to memory of 5184	1760	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_e7db50a30d159ea1fda813db8b9cfc35_bkransomware_darkgate_elex_maze_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6120

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2800 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4808
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2828 2800 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5712
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d1e9f73870811ae6f39036f1e403587ff61193378d5e54b99699ce9a376283c0
MD5 4769f952c56049a259f3be73af5d1d31
SHA1 6f8f2c2c81a434edf97cf180ed8ad52d75d87469
SHA512 9a179a9ffad53cb22a96012ed8dd6b79e6c951b20f95f9d9e632c27a11089228f7fc7e23ff5a91cf3c4c56bd81bbba7995adb40dc4b55147a5cee65cafb518cc
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnVsZBAqvpZlw:K3q6HjBvtA
TLSH
T108D59D03F2D900E9E06AD178D7469133EAA1BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 72308af0eba48aed7a7073414fd2e611f1ccaec2147af2136a15ae97bf0d4a19
MD5 99d19b51d5300d094907358a325cd95b
SHA1 8c98f8346c7e2a25d841b52e77cf9b5e4e4783eb
SHA512 4299fc6b419ee934ff422dfcc77dd888a5d2d35e8fc9b01e2cf14691d331708c78faead33c76d56788b0fb9cb152db5a09eb5efbbcbf9d1e6bb6a27242cc833b
SSDEEP 24576:+XYfDtczAgKY8fMCBTFKJo4IPpZThwS8a:dtcbsZBAqvpZlw
TLSH
T19205012977D408F5FD678139C9A2C501EB32B8910764E78F03E4992A5F372D8AE7EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 a33e6536cbc2da2593c0f398123f9c52f8c743218f42d6ef7bb73eecc3184042
MD5 2e21c9339a6c7b3d194b258d1b0dc3c4
SHA1 05f06deab56270da7b0cb9b848d5dee7b79e8e79
SHA512 563a61519c949daa6d3ce24dc2af989215f35b48e43543c4972c4c6b1883eafaa70b91d15842d414b0172c78cc430149075351ae19ed82744331efa92accaace
SSDEEP 24576:60Le5ji0hmxirMdKY8fMCBTFKJo4IPpZThwS8A:6Pji0AcSsZBAqvpZlw
TLSH
T1F3359E66F6748331D073C0B9C5D2A69EED7130861B308ACB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 2c44f45807f17805df21efdd92d97e318b1a387114eba00c6a1240e38b6329d1
MD5 e11a893844b3ac366f265428ed7542e4
SHA1 dc516dba9565e26ce9b0132e2c3971b1e22d2d22
SHA512 6c44ba8b68f75bf81d6a849b46a44ad4a416e580d78bfdc947f48a95e6cd5599bd08715896347fb210d2662663dd3a13f0ee41fd4851881eec8f0190f7b1d14d
SSDEEP 24576:Qa7/ezSC6vUyD/aqgrvWE6q8wyuLKY8fMCBTFKJo4IPpZThwS8J:H/ezSC6vUzPvxHjyOsZBAqvpZlw
TLSH
T1EE755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fd37f0d943fd8af451c340c94e54fe77bdcf64d9162a7da87fddf5d5680b5f61
MD5 9dfa1b7d97c60f5cd1152c73b25facc2
SHA1 322d7659ece5d37762a691a4e5edffbadc275322
SHA512 6be86bf09c4db782d9591e14cbe0ca69302f0f01db19177c7e88d7e3f43e26a99447bb07464d1e01d3e1c0f16b588c7bb3c9a3ea67bd60909ec0cd407260aa74
SSDEEP 24576:VVbqPb88hv/l+60KY8fMCBTFKJo4IPpZThwS8W:VVO88hXl+JsZBAqvpZlw
TLSH
T18D559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5a7eae36b5768377712813ccf5a22f528748e148f145907f482ce79a85c6b540
MD5 787c12d149e09a07513e793272cd332f
SHA1 fbbbf562d64674540a58af65a7c799691ae3051f
SHA512 ecda2a61116064095f492fe8c924f84404444fd6fde93004607b0a67881e2f33c7939e4db48be496b01bb6fafcd66f6cc4e6fdf6ae6b995fe9e927bceb970571
SSDEEP 12288:lRBK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rV:lRBKY8fMCBTFKJo4IPpZThwS8R
TLSH
T1E4C423A61E495192F2478572A16EFE08BF70BD91080CE6081354B85FD8BC5DAFBF7346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 829856ea4894e7170cc4da8b4f2888975f5bd679d566333e491b9d0ebfe06c8d
MD5 1897c262c4a09e3882af753b99b1e512
SHA1 afa386adbd2fe8373976627becc144a47067e37d
SHA512 7d5eb9102c539ade7e1eb90d378129f392e233312f9f0b64588456c4b3424c63eca14463fe7a49358ba7db652fd9148f31cece289e9c0a986f2ae5335bbf8179
SSDEEP 12288:seBNUbTVO86U8K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rA:sJIU8KY8fMCBTFKJo4IPpZThwS8M
TLSH
T18405CF3BAE28FCD2C27A8DB95791C600E77278704F11A3CBD164820EDE275E15E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 22249f9436bb93a4e38394d7a3a4c484d82e06daa17c5a92095fbb28487ac426
MD5 775cecbde6bd2b357df5f0a8d22e33bf
SHA1 f7d77bb40156d4e5b0929f4f5cf2ab47deeea074
SHA512 943bceb042be84d010643faefc30e1e098968094bddce088fd3a78f3664451261113f5db2f3842da0213a75632e6a763600b66ac7a5987c1f031b81fb7d21dc2
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:fQvGAdlCEL8c/yRNw5CitA
TLSH
T1AA266C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 912fc8dce57e97429b6334fb4de93579de256884e39a5bfe432cda227dc81a10
MD5 435cc176704cb24ff0de6aceb9866873
SHA1 196b2af5e61f6ef3099570ef7b24f0955b458594
SHA512 1877631697845fdfa1b011ab446f8759d1364b2d2b683cd62ac4d9153e74530934fb5b21d90ee4631cf3157ad392ac374153712fce4e53c1d159ec4136ac8ca3
SSDEEP 12288:bAwSfxL/2Dc34DLLmt0LDQewsAjCK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwu:EdewsAjCKY8fMCBTFKJo4IPpZThwS8u
TLSH
T15D15E031FE74E032D27B0DB21B36D706683CB9600B511AC3E3A89D9E99742D26776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b485dea9c601ffb58940f71e496e43dcb90e398504036c7f19773386e228a0eb
MD5 569dc49036009525ec380c020030733d
SHA1 44048e911f1ce5778ac831802f36d0738dc564d4
SHA512 8ee870e64369bc0ebf6f27990a9058dcebc3ceb0b3ccb2f1a4d21934fda6a1bdb1041a2febdda3eae326d3c39a05abffdb56c35434a995c628708c6dea3fd123
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9:UUEtQevvqc2W1cpV2EI329
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9a80a1b039e498a5df07d94a85fe93eba93ff07678425a344fc0e777f3596257
MD5 d5e6c36119f783f32e50c335756d69e8
SHA1 7b154ffebd695b86f0e9f11c0a7d7452e4186448
SHA512 53db378c88f80a1d695cd42aea49112b3a3250ce9bce8cd57a3397e31be5255acfd7309520d03e9f34cc581196b9e97f78b4e55323f582f6119311bf02248dcb
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/zisZBAqvpZlw:IoquVjnmOtA
TLSH
T1A2D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ea9d172fecdf3e1b2e3d775e2590885a8e70aa42c890e3543587a1d4fb7b5ca3
MD5 75007e79c896d2ab0c437975c4326a3c
SHA1 0d2809b999dc5cddcf9cc8764d9f125f89069e90
SHA512 77fe5fd826911f0cbd60462555b7134f660d629d297d2a01fac529285c57642e6ef3bc49314fcba9b17d03bdb49fe7b56bf23e40ac35a77c62bcc99f895d4375
SSDEEP 24576:wAhGLJIFoiwtA5l7S533KY8fMCBTFKJo4IPpZThwS8P:wAMyFoiq5HsZBAqvpZlw
TLSH
T1B2359D81EBF955D4F5B3AA7899B69570EA72BCA65E30C20F2150D11F0E37E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 857e529cc5bdc1e2f7baa379678f54885033aaff887c54c90ebb981351c5dfbf
MD5 acd462df3750b61deeb3e31a6dfc5056
SHA1 95c0e37e6da9537daf6275d0ef2c5a3e4befa76c
SHA512 6515c973557e5a2ed9088049c911fff44ad7d05ba5f7006c86a4f20667795d792dae800b675d747dcb2861d4f5df4a911b7adbd8b78a0ff59b3a14a5508fa28a
SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+CrK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r3:QwuoOWuKY8fMCBTFKJo4IPpZThwS8L
TLSH
T14E05F14A36A40CF5F5678139C697C536F7B2BC022A25D71F1360C65BAF37261BE2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e578b6be3cdaa8e2cdd7622ee587f39df8326e1fbbdd2a24601ce9166fc08bb5
MD5 0c33584aafe11aa8d5bf677c6f5a12b3
SHA1 1fc6d6c7812c569be8f2f78b1c201484e863d43b
SHA512 1c6cec057eb8dc4ea4d6d812536aaf756959180b011dad48cd6618575d8ac22d8928d68fd37a26c037402bd941706ccc656f962757ca1c892a3041acd97f12c2
SSDEEP 12288:9BZ1IyyK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rn:bZuFKY8fMCBTFKJo4IPpZThwS8z
TLSH
T18CE422AA37D420F2F1538139D9F59A04FB707892173583CF1224556E5F7BAC6AE3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d8891efe6e63af4862c8927b20c9308a171c78579192847371333b1be7e889b4
MD5 fc8f8828ff3dabfe5c7a7905470bcb89
SHA1 647aa4b6b07ea23ee1874ab42800b112a23d5c29
SHA512 d3b8cf636e766247337377aee81736a76246a41481179bda9775e68dc6b861cf88b09d4dc0b8677b795ebaa942f11dc6cfa28b062283cc7aa25414f2243eb713
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:WQRQyi36YOcPQLvw2gAf+PN3DtA
TLSH
T182667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ad9e88994507e19b60fa5ead7fc7b6af5b24833053b3595648d5fca93010431
MD5 71da06cb38e3e604f303f59fb9397294
SHA1 f481911c2b64973990488745abc959da8b24f827
SHA512 2ada0295ed72ec2bad9dd5508c2f420cd5b2fd130335aaadb8582444f0a2f6663c16de64f8b8505a6c33dacce97c0e9d5409241b31c7fdbc3ed2e6aa9211d09b
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:MQRQyi36YOcPQLvw2gAf+PN3DtA
TLSH
T19A667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 748ace9e753dee74226999c5b6f4b457ced740d0a3c3b42fe591a0bc1bc075b4
MD5 d6301ae945d279701c3cd8c0cf5f04bc
SHA1 ac799203c0cd815a659a81e7f601a4a4a8f67921
SHA512 fc12e1026ded1ae72160301117fc388da1dc843a72b56b6f10c390865532e8cd1e63ace66a0052f76af27731e761c8e46f6e7a580cf401c31f27841be75ce0c1
SSDEEP 24576:cwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VKY8fMCBTFKJo4x:i68Qg55nhheWu7PNU3/SsZBAqvpZlw
TLSH
T19EB55A33B2F600A9D44DE1769F4A972196D17C718FE0E3DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ac4626c1eff8d328cd837eeae6ec96956ea8afbe7f7368046a951e4e0804b9f5
MD5 9638b8dea9a0f567cab2663ecee71fd3
SHA1 fd3aa75b0a1088007acf229aef3057981ff33bb5
SHA512 300f057bbeb31e30440bbaa7b29ca3302eb3543795ed0ba49887c0290bc5260be01cc13028142c08bcf39c2354dc165e50c39c653899137dafd4cb0ad4b95529
SSDEEP 49152:P3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:iy5112gYy5azzVvL69nLKnhZgtA
TLSH
T148167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2870bd85185d26288a054d75d55241e149881d5b82399226798baea32200e3e3
MD5 cbcc033a19d74f27580ff1231e9d2827
SHA1 451b70dc85f36c6b52e70e137c849f409eca0c23
SHA512 9372164c6cf487fec6f08a4fdde36b52d742cd7ae82464948608e46cc7cd9b20f99265a76a3526ac8487c1289617d66932386305ecb4b263bcd0e416617f71f0
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwsZBAqvpZlw:/u6JmVxd2dbtA
TLSH
T156D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bf2ad8171377a5ed9265978b58c470dad3405f4aba425d45b5424896cc5d82a1
MD5 0338ffe60795e270a6939abcd4ee8c6f
SHA1 853950bfbf778eae8edf5e889894f0753a076c3b
SHA512 5dfa8a43bbacd9d65153889a1b121201b1ba50de92be661b1684c98c000f0fa92dcc15834be7cf540317b5b6f3e18d5551cb80602be00116a8343e9e03a985f0
SSDEEP 49152:F1hpsNoJpF1A6UU44CwH7R4xcsZBAqvpZlw:FmifPbROtA
TLSH
T110B5BE13F2D900E8D05ED178875A9632EA71BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d74f3666088428ba9c60f4a43729293009000ea1edcc75954ab9e34fffd0c9d2
MD5 a857ffbe60a47b48fde0b3e40f5b1fe5
SHA1 ed74f0e2c0a077d1ef392c81f76388153a12aebd
SHA512 600ae508e3ed8c2bd7f620667aafe32e0789d43e1906bee4aaf402ac83ef0de0960a625711507b3018815dce567d5c2e02bbf75f06967e96b3b13ceefd1e8e9d
SSDEEP 49152:USuZQIY0Be2KRRVtOnks6NMHqFsZBAqvpZlw:G5dKTi61UtA
TLSH
T154C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 0e8f12534c12ee7aee5985f048982cde966559fb43ae7f9c39bf61f4b13d417d
MD5 e95b2bc997d0080344b6618119d5a814
SHA1 0c6f691a3fa8579c23212180b7fd2f686df428bc
SHA512 fb7d122ebe8bf0dbdcfb9a1b2d26272982eceef577fecbf34654e684148d082d10dc3cfb5b94e9bc89a2b9365de5ebb3b272a8cff82d00b98c0208c355f60e60
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wgsZBAqvpZlw:wX2iyphKtA
TLSH
T13895BE13F2D900E8D05ED175C7568632EA72BC160B38B6EF0A90B6561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 ca9c7d1d0d2e5b2e831d2101df25887301f9764c46d6e802bdd5552f36f809ae
MD5 439635567ba713c1ae706cd3fe616033
SHA1 47e02c60babab703fd500c92060ba4bc2c492f6c
SHA512 010abc6e9a0de90bd9850e852f1cbbe5c6da03200f46de3dc024f7a1388eb8e764abe446d6da38f62297d8254e81487d04dd15edd8f96eb785fd9439d469c488
SSDEEP 12288:WJK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rN:WJKY8fMCBTFKJo4IPpZThwS8Z
TLSH
T1D8C423AA1E494192F1078173E26EEA08BB707DD21908D34C2349B41BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 1d52fd8e7f6eef07218389779f1ea4074cdc3359c708eae9489d44d25111e070
MD5 ffdac38794bec26ecb376787ef9ce36e
SHA1 cc1034d022128424b695380aa8167ec345baa7df
SHA512 bb79d0573e22414a535e69118bf2911f2488d302d2fafa152bf1d5932043de9b4a4a238fc641af4584defa5ff9f40536f6dd42fe28d32f48e31c8ac06755e0ee
SSDEEP 12288:FmK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rN:FmKY8fMCBTFKJo4IPpZThwS8Z
TLSH
T160C423AA1E494192F1078173E26DEA08BF70BD921908D34C2358B41BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 4c3c3ecf311b0b24ea8f93c43901fa1b84bdf5975b8954dcbb36746f426e0e74
MD5 64c3e0917ef90bf9c926838b84393acc
SHA1 85a5d2bfd8bd485081663e436c61b60b1b50d18f
SHA512 95c6466ecd282a3ff0a98f555bed9d71c2fef46278cea667ad0ac43f3076d732b0529bfb5b3f9dc4fe32022659573ab23950432f4e90c0308abe947f67a8a025
SSDEEP 12288:LEK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rh:LEKY8fMCBTFKJo4IPpZThwS8N
TLSH
T1F1C423AA1E494192F1078173E26AEA04BF707DC21909D34C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 3d52630f1252c8a6b7809dfc8f852ae7a986c6723905da4743fe3519980af7da
MD5 1596ab9e225072351fd25095a700b5d3
SHA1 74e4c7d1568db496fd489aaf64eae0c3b1fea51e
SHA512 98f4e3da84407eb3dbaa321585f31a9ae142ac982b99bc535253a572eb36900ea1007897e451a408e1a2842a47e5c1e4e07a397f1cbf5f086e09c29ee5106eb1
SSDEEP 12288:LVXK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rg:VKY8fMCBTFKJo4IPpZThwS8E
TLSH
T175D423662F5901D2F007C172D16AEA04FBB0BDD11A29E38F2304681F9DB92D9FEB6741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 61f1e4e7d96c2f6a1264b3ab348cb0608437d6a1a6559e2a93657fa1e0c4fb1a
MD5 ddd2df76c96055a980f68c71e72009d3
SHA1 0a0f3e816d120491f66842af5fa4bfe1636f9cb9
SHA512 553a5c1c22f5e0691109c32523f1e1fddfc40cf264fa4b178d7b159565d8d15e4218bbd433140b2fdd82723508a1c41e169a101efcbe1f43018259390c09d96a
SSDEEP 12288:hvK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:hvKY8fMCBTFKJo4IPpZThwS8R
TLSH
T18AC423AA1E494192F1078173E26AEA04BF707DD21908D24C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 bcf9e3f28032628278664fda152ab1b7dd792d9d72d65bb5aa081c0035e54144
MD5 73991fe6368541b88fe087583ff21595
SHA1 0313333f643b352fabddec48e12a7f859bb838aa
SHA512 3bbb89621dd2ceb7458f81f9d12a7de804f75330e5e797fee6cf6592d3d76039d62ba171110c1c2cd78c55fad760ff8e6d7e1a6f8f9862af928d15b385d599ff
SSDEEP 12288:4qK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:4qKY8fMCBTFKJo4IPpZThwS8R
TLSH
T124C423AA1E494192F1078173E26DEA08BB707ED21908D34C2348B41BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1f32e545af41e594c67bce49b5097914a365bf7979b6155b0e4e191fec42949e
MD5 cc84e50afe5436b20970fa8d86635b21
SHA1 7cf4ffd231c76341ed2ce62c52f97d3660f70390
SHA512 0cb3e5d21774cfe346d0beaec1ede288fc748a20e4fe9f6b46a1a3868fb1e9347825aec5f62d02d1cd2bfd7fcad286c3f2d74530aafd1c76d802daacadfd1872
SSDEEP 12288:K+K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rk:K+KY8fMCBTFKJo4IPpZThwS8Y
TLSH
T171C423AA1E454192F1078173E26DEA08BB707ED21908D34C3358B81BE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 e2eb7836b73a76192ac0178994b3009a37802441728a130adb3554d1bec53ed8
MD5 ca3ea133a056167d7b307ed38e22ffc4
SHA1 3a914c97bbea04243f4e69cae82980128c5de8c2
SHA512 a4b418d75e8997cf9db59b9f5e737914105123f44322649de3c26cf577263198f277f29c415d72ebc280b3f35c9736b000d44f025e466d6db13917d65de05f2e
SSDEEP 24576:sZMSzFVSOGKY8fMCBTFKJo4IPpZThwS8i:sZMSzfasZBAqvpZlw
TLSH
T1AB0501A5739008F4FC67813EC9259905E6B1BC5A0B60C70F13A8362B5F773A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 1fd1271dc70b995967cdbdaaf2caa75618d8bf4fa4eed140d31e26ac835a322c
MD5 fa51bf3a2e8258a2b2014a25931a2d09
SHA1 594a32a844eeec8c61ff97eebb8645e9ec100983
SHA512 03299242c7c4bd65f0c1e3a4dbc1bd9538374ecd801463793679257a56b721dc369496174badd91a6ded53971db666aa249bd3c019b3515cf8ac6b928511fe23
SSDEEP 12288:F1K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rz:F1KY8fMCBTFKJo4IPpZThwS8n
TLSH
T13DC423AA1E494192F1078172E26DEA04BF707DC21909E34C2349B81FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 cd9a43d2a9121bb54d40979f4230a4a15e7cd6b253ed85c8641371383e9885cf
MD5 ddd9e952de37b1ccc83b938dd0d2dbba
SHA1 786ee79ca304d5aad41bfaa823511b58bfec6358
SHA512 7fce6ca022348cdfbe2ae8174a001d6bfea747359c1f02c6bf279c7883d390c8f05338878c498747570b97c2479799f14ac92da6700ca998ab20595f9e04a8ce
SSDEEP 12288:5xK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rz:5xKY8fMCBTFKJo4IPpZThwS8n
TLSH
T14DC423AA1E454192F1078072D26DEA08BF70BEC21909D34C2348B81FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 17536a179fe00f80420ea80e405341e1f96984716a95c70b8a0196735d40a934
MD5 fc08cd225420f3b69855322211b8f8e5
SHA1 7d4ae6a967ad3bd40d8301f094c89eb4913ca7ef
SHA512 ca552a75af3195f9186cdaf964c5a686d34dd2426b227f706e7d8268c4fd3803ec23aeff85d8c3fca90465d62cbf539ea7479946e7b0b62a06aa7c2236973a5c
SSDEEP 12288:6yPz5L8yK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rN:nzyyKY8fMCBTFKJo4IPpZThwS8Z
TLSH
T1ABF4125737A530F5E1278235C8665A01F770B8720B24CB9F13A4563B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 aff51036b4033166e107383f3dc3b0885ea33aed381f8fc851ca8a10bfad066c
MD5 5821801b1a0d7c995ba090aabf39b8f3
SHA1 ffd24f392af244049fbc811d5d719873600781f3
SHA512 859f92f5910f27ac6ecb882f86c2853f0f8faa62c30a0b0cf1e55870c78573d91743875c428e0736864192fc990e0ff6d4d11e269956a1190b5a435e2a2535ed
SSDEEP 12288:f1K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rX:f1KY8fMCBTFKJo4IPpZThwS8b
TLSH
T17EC423AA1E454192F1078172E269EA04BF70BDC21908E34C2349B41FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 5c3c3ebfbec112397826886c342f52c916ad3d91595dd71b385df4e8fb67e3b8
MD5 6776f0f680155d4cc86bbdce3d633290
SHA1 db0473849f840aeccfbe1e6c69bb752e7a04c25b
SHA512 41ac5b60168d43a6fc9c6841410a1f294b46b16caa5469546672dc41f1211eed95bacca4ce1e6a015669cca8005a9b25a5a5a02dafe8fb72bfeae029d5e17e62
SSDEEP 12288:T1K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r1:T1KY8fMCBTFKJo4IPpZThwS8R
TLSH
T1E6C423AA1E494192F1078172E26DEA08BF707DC21908E34C2349B41FE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1c9d21c9fb8695e4c1cac370f7f46daed6222d5c0049560b66ca8eb2940f1e1f
MD5 fa2edfc59a1d35b5b424b9e42f945165
SHA1 8005bccab2333c54fd508532bfa2d4bba7d17557
SHA512 7f960beebb94fc5f8a0d92029927ef7b6a8e056287fdff21ddc57ed18f1f950864b7adcce98e8fba2126182afc4f84131cf4cec3788946619ef8cd51107114cc
SSDEEP 12288:2yPz5L8yK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rK:LzyyKY8fMCBTFKJo4IPpZThwS8O
TLSH
T10FF4125737A530F5E1278235C8665A01F770B8720B24CB9F13A4563B6E3B2D1AE7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c08a644bfa2f4457dca102920a59f2b025b896bfb9e0057fffc9c62b19367007
MD5 643c583e6e89da95c22db96dba284321
SHA1 19b01b19e1eefeebdab24866c70c6aada061dbbf
SHA512 a469050c7b80ca180424f70be893b4d1699399be91ce31d50d686f362ecf3db98a48bc441b8c648f7406474ad39157b63699166013e8192eb9ff337f75ad2abb
SSDEEP 24576:VTHaLl3z0zDUKY8fMCBTFKJo4IPpZThwS89:VT6LljLsZBAqvpZlw
TLSH
T1950502A5735018F4FC67813EC9268906E6B17C5A0B60C71F13A8362B5F373A16D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 d758173332d0fe66e8df5e0430b7bb04609af97414cd2e37380b288a2d34fcc4
MD5 7a2665ee6dbbead002eaf2e8a9989e0b
SHA1 ce8ba6b1ba2ac0a752f865663caa8854432195de
SHA512 eb27fc9abf0f960e1b41fde8da7b306ada2e05472f40fc763343dd6a35c98004d392c3597d38745eefe68a6c7d41ff4502cacd95e28d2869eff325c2d72711d5
SSDEEP 24576:c37d9CHKy7GZoKY8fMCBTFKJo4IPpZThwS8l:G7d9CHKyaasZBAqvpZlw
TLSH
T1DA25CF90F3E410E4F0B7CA35C9769511DAB67C9A1B31DA8F03A8651A1F336D19E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2a55e4af3d2846c44e5a6dae1c7ebffd2959c99214a240225f5b101e073db494
MD5 fa1d63cf67469b848aafe3866fa6a7ef
SHA1 9f90cdcd6476ebf3e5cdca9d8d1dc2c7868e5cfb
SHA512 1866ef7e25a4783c041748e89d88a25fa204bf7b7532c857877c3d022a49a787cdd5aa4e0b7dae91ef71f4c4c49d945bdd0821d0f614d85f29b5afb3832bcfbf
SSDEEP 12288:4kK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rq:4kKY8fMCBTFKJo4IPpZThwS8e
TLSH
T12DC423AA1E494192F1078173E26EEA04BF707DD21908D24C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b5fe5d3454357942b1d5f1488e4843ba464bdad6910317f818bded00238d1a35
MD5 c256f82996deaf23fa7998ba6d1e9227
SHA1 8eb0bc7a76298afe82367035e77466530d728417
SHA512 fe5aaa3c4df4ca429080b9f44be89ee5bea33fe144e78b9eed751580e654c502501fed12a5b58cf76e0e7b399ebc599ddd1cb38d23ac0cca5cb41ec8ae8f73f3
SSDEEP 12288:ESK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r5:ESKY8fMCBTFKJo4IPpZThwS8N
TLSH
T1D8C423AA1E494192F1078173A26EEA04BF707E821909D34C2349B81BD9BD4DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 0abec0198982c6a0848b7d095461648845f7643e95f241eb9b177f9ef2ba2853
MD5 1b5658468b7cca9c80cebc6b1c9c4d37
SHA1 4a1bad29f0ac68086da7921ba3e8f7761529bd90
SHA512 a568d243b53944d8cbf4ba7313b9f1ff94523ef0ad6d0707f3a1c073316c296a26c10e2ec71d9419d8b8a1d7b72afe61fc09321b141035f9c5c136482d11edf4
SSDEEP 12288:BjK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r9:BjKY8fMCBTFKJo4IPpZThwS8J
TLSH
T1A5C423AA1E494192F1078172E26DEA04BF707DC21909D34C2349B81BE9BD5DAFBF7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4c4dac995ce3f896fc0142bc92732e637e38568ad19aa7f1f68d21f586fe9113
MD5 549aede9c8e0cae3ad5bb30c05571e24
SHA1 b86bbb0a0c88c351782688130e5648555c2b2711
SHA512 438b3682e7f6a357483582750fd0e8a89663d7cf84ab7fb318d6fcc50ada695b6cacbfe83df91cf61857128663c4b8996bd171c62b1315a18890be24cba68b76
SSDEEP 12288:r1K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rT:r1KY8fMCBTFKJo4IPpZThwS8n
TLSH
T1D5C423AA1E494192F1078173E269EA04BF707DC21909E34C2349B81BE9BD5DAFBE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d40617ec4527eebbe36b94ec1038eb282259fc6750628237251861bfd2f51dab
MD5 e57c568039e8ae98fcbc4543875195a1
SHA1 3d9afacefafa6aa73621d594ca4599e009ada015
SHA512 28613698e2abde88e0d68846f0e6e8d44ae6b7ef5d462b51bcaf45bb90aac510b96f9ee916ea1edbcc0fc881ac6dec2e7ef15632aac2fac12778d8b1ab68eda9
SSDEEP 12288:SkK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rv:SkKY8fMCBTFKJo4IPpZThwS8L
TLSH
T13AC423AA1E494192F1078173E26EEA04BF707DD21908D24C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 68ce8ed17f5d6e9c397dffa72b2d792567b7314e5c0d4a62e7f2e374585782b6
MD5 79902b1210b4f5571741806b4c78a77b
SHA1 e66bde44df06b931cf964cb682738016ad262799
SHA512 adf60b25c1570558ceb8387acb31801f737998e7a7f8fd23f57b4ca0946ea517ea42e792a1557ff5e95f708cbfd80c486731887f0639b7ddc84c85c38cf04b1c
SSDEEP 12288:YtK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rE:YtKY8fMCBTFKJo4IPpZThwS8A
TLSH
T16EC423AA1E454192F1078173E269EA04BF707ED21809E34C2349B81FE9BD5DAFAE7345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7488fe4a78e4ed4d6ac4100f51de0166b7852ada3796b20893014495fe84c5db
MD5 c85616f3e77b6c63e3227eb0cda0135c
SHA1 bec11c90d12c5d2fcf4b326e8557029efa999b97
SHA512 79b7f2c19536600dcb748aec7c28d447b08dff629bf56322b861498650cb1fc17805e37591b943f09bf02e55fb86a1bf448d48b55dbbb58f13045d41131ac6e0
SSDEEP 12288:IvK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rQ:IvKY8fMCBTFKJo4IPpZThwS80
TLSH
T169C423AA1D494192F1078173E26AEA04BF707DD21908E34C2349B41BE9BD5DAFBF7385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a9c343e2174e6c3cd560db17443106ea0ce9a50013ee7004bbc63d4041b50f18
MD5 6dac3bfa4d9651707a508bdbb3ecc09c
SHA1 a06fecd0452a0388071d30d46f9d0d34eb80864b
SHA512 2b78ddb944d4421ea030ea42ab7e23d4c2363c72c099d5fccd3f7c7043cdfb1d31c1557dcd0d5567fae173272a55174fe1ba1cb4fef2771d7fb98456566e7b6d
SSDEEP 24576:Ufwvok9RX6wkyAIhKY8fMCBTFKJo4IPpZThwS8P:0MnYIhsZBAqvpZlw
TLSH
T16835DF29EBDC04E1E177913C99B7460AF6B178591B31C2CF129A536E0E37ED4AE3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 17cd484eca76381be8a475f85d9bdb5bcf25315dbbbbb6eb3805481aa2fc7da7
MD5 4d2909c0d7aa2b3e177386b77cef5220
SHA1 7924c3f061a0a9aa315322b3746de8acf99fc816
SHA512 93b843910c0e9b3ff7bd181ac2ca1639824e301183667abd0d956d9ba613ec2224439a2882523d064792d2d23b5eba35b68decdbcce4e81a49345379487041a1
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AsZBAqvpZlw:6ySzPjtA
TLSH
T130067C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a1d6983ffdddc5eb6f6b6530f0a93aa2fcc478599b8b5b97f7f74ab48334d372
MD5 521f3d79a773aaabb6488a7153576edc
SHA1 d884ec4a3db59f1d0e705579e200b0b678aaa6b4
SHA512 db53dd2ec845763186cb8083ba7596f06e5d1881a2b3c1eaeca3c17bb998653c4c86e0460579960ec9b353a0739f1e38cf9ea77ffe8190ad4e2a3d1ece19e829
SSDEEP 24576:447Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2KY8fMCBTFKJo4IPpZThwS8x:447JUQj1irIhCnDHUPfF/wsZBAqvpZlw
TLSH
T1B065AE1EA3EC01E5E17A827885158A1AEA71742E1F31CACF1270837D6F67ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7f35e95313be605c221752367d7a505566e74e1722f54bbde3c71dcc8e05c86a
MD5 852942260c268dfa40b45431d1d5d9af
SHA1 9026087080f1c044b79f570a00105920a0f54b20
SHA512 9d6a4ea99ae99fa54c03d154f0ce9dab8f9cbfa9ae4412d03ad4fa2e8334d884296ba1a0d47f7cd3f3ef88aa8a9c3d51cf8abc0e9bf0dc91c5040e9674486140
SSDEEP 12288:9NsfFK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74r4:SFKY8fMCBTFKJo4IPpZThwS8E
TLSH
T1D8E4F05AD29802E5E06E9176C7569A00B7337C6147E1D3CB23D0F43E1F7A694AEEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1016KB
SHA256 09f8a698db8c7f0d84885e04f664385922e951759e939f78f9e39d6515ac8c22
MD5 8434a13936f007f82d23ff46c52bdeca
SHA1 fc815eee6dd0f92052e747595f94d0cfbf46ecde
SHA512 28174f819a028368d4b55c3061cd61973d2f7c2602128f18184d39db4b093aa81bd466316a6072343189dd42ba3377a1b87a346a5b60420099720c16fbcab5f1
SSDEEP 12288:tpkqU3f3+gISIq71HhRzT+WOpQEAwZD4f:tpjUPu3q79eWO+EzZEf
TLSH
T16F2527107666C74FC6AD40365E37C2CCAB707D01EE459B0372C99B2FD5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 adacf8a7a7388b9d8f5e6b547acb93625a3483533864df0606873816520956d5
MD5 d8d5ff77c220cc8e29e0c10a1d493758
SHA1 6a6f8dc2c62fc387b9e26ca39d8b265383cbcd55
SHA512 b3699d50ab98b9b953a60e1a73074e41ddc93a53bacafcb05aaeb709b7f29bdfceaea3233a059efa0b2ac9e8a34d6f66d2bce43de972a42394b1c62a497ebd47
SSDEEP 6144:JlDx4gxfBbZYYVwkmk11XZI1+uI1+zey3D9tMx+vt+LmcN0daTrPJOzme0NRXxaT:qYiTk11X3saySaxE2Oq
TLSH
T11B65C6406536A38FD1F76032072A9B4D7BA4EC12B7495F26A3C8543AD86BB15A1FC3D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f61bad3c2da258a73f231d7ac402ec41c3f4a49183dd4c17fd19cd76131a5654
MD5 876b8da4a8230c5ae9c2fd8f5f3455c5
SHA1 f0fb68c87ba308ffae33e93fd154b06002e3cdde
SHA512 8403fdfcd5bf86b77d0e54f51c8d794b0b32d5088dab39d4b9e93860c988bd9de75ab4d803e2b24fbaf3de1e049130d1ca49af8d6bd4463af12fd63d5d09b44f
SSDEEP 12288:t079K9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rd:G9KY8fMCBTFKJo4IPpZThwS8Z
TLSH
T1E4D423661B495592F02B8572A16EEA147B30BE910F08D2CB7208745FE87C5DAFEF7306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5c189f36e51f89ccfa6c27d753f2897a9268e5db7965e2c4685615e9eafb747b
MD5 682f7dbc5dcd86e1c21489c20591f5d1
SHA1 2d45cd9c3769fffbce52a9f588cadc2d1c3f67f9
SHA512 16c86f6e46de5b18f0facdb1cbb875334aceb306800cb77e15aa2a96014222b11f7fd0e666c85b009a39c8b29b4aca46b7f78996170570d8b8350fd2948129bc
SSDEEP 24576:5gb6bmBIi49WNNFpg1rSvFv7bYLKY8fMCBTFKJo4IPpZThwS8N:5gb4mBIBhGF2sZBAqvpZlw
TLSH
T17F659E1E22EC02F5E0F6D2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 54e909632a6c5aba3396f8802f543bc32e7643c4dbe5f996774cda902d74bd54
MD5 29317d11f44c8b63f0a7f905e6c79ad2
SHA1 38955dbd9c7007d0a95b4f62eeb12b27be8afeb6
SHA512 69392d8a778a28c5039a97d0eb82d70f9f6dcf1e6bf7b0e7f5ea2f834f9cde976ffae1a4c86c84dd326cee895dcccafb38a7b62c5e75a6cdb6b9f9b9362ab39f
SSDEEP 24576:+G88u8FpJqH1bzria7/mGKY8fMCBTFKJo4IPpZThwS8u:V7ZFPqVea7/DsZBAqvpZlw
TLSH
T1E435F16577E101F1E07BD1388A864663F6B1B8210364EBDF07A88A561F33AE54B7FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 98cd33a9b1f2cd441af0537ce88fac461f38fc126345a8329bd066f9414c78e2
MD5 82f3fc050605075194477fd54cce16f5
SHA1 14c9e6c51e106671e49ad7095d98776fba2cc0b0
SHA512 4e2d4d7f4179d7b5325cdcb0fb2b62ae505e8a7dbec1dd3fa049f3e42aa0e6e89fac7a7b0558989e51b996f76f82153b417f4933bf10b590c3b9d63732ff8758
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqsZBAqvpZlw:ZG05lO43bItA
TLSH
T1C5D5CF6E62EC11F5D1BBC17CD9C68A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 48d55a93ecdee8662d65e07e061fb0e8e9d5fc16bd634797e08ddeb08feda1ae
MD5 1ffe8152abd9db310f21ab84d83f2f2a
SHA1 5183f786692bf588ae3ddcbd433e85e7b37591bd
SHA512 1d582291b83dd02fe0f55299fc5e862328d92aaaad4b6c9a8bb15f3db2c83b25371149a0bf79afaaecd4cdf626c939b3a0f48f25145da92c1dc863238d861227
SSDEEP 24576:Cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnAKY8fMCBTFKJo4IPpZThwS8C:Ka5POZ3+Jt2pasx2+mSsZBAqvpZlw
TLSH
T17F65AF5EA6EC01D5E179D17DC583861AF5B1346213319BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 50d50d67dcf158d5e0f15e11bba803a00bb9adb03f0dec9b7da5f0c5df639eda
MD5 ce3ba3c40853483d740bff915558f024
SHA1 7c6dcacd5e39b470f119f2de9455c252cd913b88
SHA512 ce89844eca0f3b88699246b7ae833a6b292bb10079868297039fcfcc962d640ab7b0a44bd1fe76f8c270286c2c285bc94f188da714a0703ebd79b62137342e2a
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7FkOKY8fMCBTFKJo4IPpZThwS8C:CNc/zEOVHFjsZBAqvpZlw
TLSH
T17A857B2623E901E4F1BBE1BE89679546FA717865133486CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e20ee7105f7226f8851f95b0d72fe2e0568b1a8853eb36b14a37a970a0f0fc18
MD5 db9f01b5a6d16f13b23e82548a5167a2
SHA1 0506f3ce7180bf2f1e566bfb7ada9e2f0c93ab31
SHA512 1bb9d6fb2977082f87aa5c4272b3947bb482f622642ef83a9423afe79e5e421c93714f83a386032689d39d5af50694424a608d11c1bc8907841f67882cbec286
SSDEEP 24576:28kNvNnaFeYhJNtmZBmsKY8fMCBTFKJo4IPpZThwS8Q:28MwBtOmssZBAqvpZlw
TLSH
T1EF55AF6E7AB806E0E1FAC675CD238512F6727461073293CB5290C13F4E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 9eaa63d32e7a446d108a23b2b98a712c125667cfbc30fbc39802e4c1a6f8493a
MD5 d22f7616c8444ffd4467e7966ca45534
SHA1 5852eb560aee09ef7bc9f53c8900dde34b77c1ae
SHA512 4419f48c6d12584912e2461252eda1f4447b9befa22a563850c37386d4f35a693f7ce00d4bb684f5d35efb64beaaa42b6f28f237f9f4be27849a7326f8607d2f
SSDEEP 12288:VHvUrBFrEjwaQaK9ryJa3v+VGCC1fTPtKEgo4hgDJ5hPpZThwXC74rI:VPUr+NQaKY8fMCBTFKJo4IPpZThwS88
TLSH
T17C05E12F26AC18E5F676E17D85868709F771B8620711D2CF02D0817E5E77AE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f31aeb10cfa29c173356fd3d11283357e3a34f249f71b12b3086f90cb14afe63
MD5 ab295af3da3560bef948f9f7144c5e6c
SHA1 37d3f3184d8d0aab31e28cc7daf3ac13b9110421
SHA512 f097cb0e8ed8f4b532125f311fddf1745defd3b5b50bf26fb88dca11e6e8b198b3b768ae1228d0d647f4564333bc4531234e3754868803400e065bec60ad5813
SSDEEP 24576:AD3FHshBIYQgApKY8fMCBTFKJo4IPpZThwS8t:ADVHeBIAApsZBAqvpZlw
TLSH
T18F25E17DEA5C04E0E57BC1BCD6638A06E77138A9032156CB12D491BA5F6BEE47D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-304-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1496-110-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1496-104-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1496-102-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1760-308-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1760-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1760-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1924-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1924-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1924-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1968-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1968-91-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1968-97-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1968-307-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1968-305-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1968-90-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2340-50-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2340-56-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/2340-266-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2340-49-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2612-39-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2612-45-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/2612-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2612-135-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2612-126-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/3404-69-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3404-63-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3404-282-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3404-61-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3620-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3620-129-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3620-122-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3620-116-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3620-115-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4752-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4752-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4752-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4752-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5660-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-77-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5660-319-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5660-84-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5660-78-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5692-73-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5692-300-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6120-0-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/6120-76-0x0000000000400000-0x0000000000591000-memory.dmp

Download

memory/6120-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/6120-8-0x0000000002470000-0x00000000024D7000-memory.dmp

Download