17996cc52a8e3e00faac944aaa84ea58fe5e2279ef286c5b0d719528bc05845e

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
Size 2.4MB
Sample260722-v3mrasaa59
SHA256 17996cc52a8e3e00faac944aaa84ea58fe5e2279ef286c5b0d719528bc05845e
MD5 8876022c5e4d2871a2b4acb109e014a3
SHA1 0383715d85f98216882cdf59d220f63428897866
SHA512 584b53ffec03a04fdae81632522644eaeb6149746ed7966de3fcdf7440d963098c2ed5066ff005dec3dfb043e807a164f82e21376e83197066bb642425dcc3d7
SSDEEP 49152:a+yFhqdgapB7D08gdwnWxXCVswKbagiUeEB0JQpVUkx1Gsb61tySHD:aRfqdgypDedwnWxXCVswqibEOJQpVUkc
TLSH
T175C5BF3179D190B6D57317308ECD777872BDBF704A35420B23E55E2E2EB0482A92DAA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3244	elevation_service.exe
2756	elevation_service.exe
2852	maintenanceservice.exe
5484	OSE.EXE
5764	PerceptionSimulationService.exe
4528	perfhost.exe
5524	ReFsDedupSvc.exe
688	SensorDataService.exe
5184	ssh-agent.exe
2640	AgentService.exe
4348	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2c44403483806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c3aa11f7ff19dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e1cb5c35001add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000091bdaef4ff19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0ad83f5ff19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d60dcf3ff19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000473f4df5ff19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
3244	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe
2756	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4252	2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	5524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5524	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5524	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5524	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2640	AgentService.exe
Token: 33	4348	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4348	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4348	SearchIndexer.exe
Token: SeDebugPrivilege	3244	elevation_service.exe
Token: SeDebugPrivilege	2756	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 5796	4348	SearchIndexer.exe	100
PID 4348 wrote to memory of 1808	4348	SearchIndexer.exe	101
PID 4348 wrote to memory of 2972	4348	SearchIndexer.exe	102
PID 4348 wrote to memory of 5516	4348	SearchIndexer.exe	103
PID 4348 wrote to memory of 2824	4348	SearchIndexer.exe	105
PID 4348 wrote to memory of 4296	4348	SearchIndexer.exe	106
PID 4348 wrote to memory of 5704	4348	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_8876022c5e4d2871a2b4acb109e014a3_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2852

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5484

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5764

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5184

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1808
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2828 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2828 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2884 2896 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cacce26fcea2ed4249c9e4401930e81027b30a2a64dd0233435e93459527af05
MD5 b342d2cb1c2eba43d6cae7555b8e802b
SHA1 b6801b914803d7be4440299e62c469758a57f947
SHA512 48836ca1e49a42d00b164959bbe66e4244f15c6054458173e593f1c58f631c0fd5365884b41e900d0779d01d70badb6be66ae145e4b5c1c98e5b562c06024c2b
SSDEEP 49152:Xb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnb61tySHD:F3q6mjBE61tySHD
TLSH
T130D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 ca8e336ef6b3da3eb5d5a2110c841fcc6a84618a1c1623b681740659b951e7ba
MD5 36f4d437088b7a8c9eeaeabf67908d19
SHA1 e4a7c01e1a6a7634d29e3184a616bd1866f34341
SHA512 0fc30ad3b2281003ab72d15a16724ad6294b77800559b6352e2917ec2e1cf464b626055e8c5ccc95e4e5789e2a439b6c65616edffe42cfaadd03e581c13029e8
SSDEEP 12288:s1XLsswWkxy2lRq2czAG/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:aXYfDtczAWH6LRgy7iBY5/ryIDxXv
TLSH
T19675F128B3E508FDDD678238C8A28551E672BC5547A0E78B03F4A9295F337C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 84d8d1fa369f509169841f34bd9c5236352c1e2c7060395713d46060793b927e
MD5 c5a5c134a2425268b502f73508c3dd0d
SHA1 869d5cec1106343882181c6e2e1a972775756880
SHA512 8067e2e77d252e50dd64de86fba8babd80b9cb870734bbb52374153897e0d892edb2144f4339e28951ad3c54ac99b0007785f79c89015cda365d1b12cf1199c2
SSDEEP 24576:80Le5ji0hmxhrMTH6LRgy7iBY5/ryIDxXv:8Pji0AzK61tySHD
TLSH
T17285AE16F6748335D073C0B9C5D2A68EE97130825B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 07dff3d3b54851829eda950bfe2438109b2078622211f7e21b50408cfae20d8a
MD5 24d7002eb3cdf23f43faafa5c66c2a6a
SHA1 a45f70e4f6f367899e1d479dfd28699f6147eb44
SHA512 5935ed61078d22840983600cdd56bb0917de28182de6e66606d66305359051f0b7ad65f8be42f23b5900b4f72544d19c2ea581a724c6147722e2dbb8792a256e
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWj6q8wyutH6LRgy7iBY5/ryIDxXv:k/ezSC6vUzPv+HjyG61tySHD
TLSH
T135755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f73e13f4a6d67bbf8b71465066cde2a281beceea9cec40239d3da9ef53861c01
MD5 09de5696d8e4d28912294646f95f26ff
SHA1 57e5e2c144ff73e7022122a3a1aff02688710e24
SHA512 e8e9823cef91fc88d4a05fbdadb7659b924f3f1841d8eadfeb2ea3e262dd9bbd7557aae1d129e0833f756a1d0b93b46386289ef3b9c0ca004ee9f0601899a013
SSDEEP 24576:xVbqPb88hv/l+BqH6LRgy7iBY5/ryIDxXv:xVO88hXl+q61tySHD
TLSH
T115559E66F5748331D073C0BAC4D2AA9AEE7234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 89ecdfbd585095ec12330c3e6fd2865a9fff2dba00f1247b0d7b681719b32cbe
MD5 fc838c8fc1af8560ce9ba4c589fbc9a4
SHA1 14152feaa88d4ad5f3d26c0a002e0135e74b4ba7
SHA512 4ac181a76da39d1a804124228b60dc571757ad37ceb175e43b846aafcdc5b28d5b8afb56c6a4cd083be745d19e21545117b08f00caa52a2072e339cfc745894d
SSDEEP 12288:hGr/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:hGHH6LRgy7iBY5/ryIDxXv
TLSH
T1DE552365B5FA02EFCBAD0630C8C516D422CCBF59DCA1498261F5BA6DFCB5A44CA0F613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3ed41de71ab8e68e1d58ac52c3af56c84db38c6eb1653824b76c00ef3848d939
MD5 f54dd49a51cc53628a70ee20fbfee070
SHA1 e19a914d68a3b1c3363130af3e0f191fcd0fc03f
SHA512 f6ec8492bb979a8b2156edba9147d72896de88bef42a0edd3fb51b5e206ce740e295e753f6261e096f4428bb345f5388a5483a3883072de2b8b8560fb8a7657e
SSDEEP 12288:IeBNUbTVO86Uq/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:IJIUSH6LRgy7iBY5/ryIDxXv
TLSH
T12C75CF3BEE28FCE2C27E4D785A918640A7A278704F6193CBD175C20EDE235D45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 2ba43e9ed2f34c5b4ea03ffe05c0dd8f32f409cdc25c05c5dde68ca51e51877c
MD5 a07969e8c0fff552720d1998a57e47e1
SHA1 78a85916b360a420ca78e51b9c5c5020106d1c6d
SHA512 4760c482ef97dcba418222004565648ea198d50fcb0618e5e2d9eedf86e33ae9c19506846350dd64fdf4993a65d647cdeda876a990a6f67e3eb055ebbad2aac0
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THL:6QvGAdlCEL8c/WRNw5CB61tySHD
TLSH
T13A266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 229813c1d59b5e94ebb56dade1838f4a0b8c6ac49e8ace69a7a6a2bfc7a8c155
MD5 b12e233ee3fa34575db0d72c5cb9d0e9
SHA1 9f63a6e161881d1c38df74214200964936b39c9e
SHA512 e7d1a2c156217ed46f41a8b83dfdd5e8bf520b972d2239d095344f9f1d6c5733ebc265a8e844d2caa4ff2c95867d45fc4f58e924e1689c918da51bf55218c60b
SSDEEP 12288:rAwSfxL/2Dc3mDLLmt0LDQewsAjk/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4Q:UfewsAjEH6LRgy7iBY5/ryIDxXv
TLSH
T13475E031FA75D036C7BB0DB11B26C716146CBA204F611AC3E3F89E9D99702C2677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 101f6b8d075bce5c96f49fb1a683966cf4dde368881b597709bce6c31cd3284f
MD5 10f8614510190774b60c180d3b60abbd
SHA1 5f103002b1be952e37b4b85835a96f7e779431e8
SHA512 6e4636b7d792beaf63386d8738b92d57ff1781ddb894300930b1c9a80fb97438b5eef12db625b8dbd353c4750618e5d33e199e6886ca00ba74e9cfda8ebd1c16
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHi43H:RUEtQevvqc2W1cpV20I32x3
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 14344156b59b3585e02dfd09cd73d44bfc11f28a8a2b1e06cf93d34efd01c604
MD5 30cc33bbc568b07bfdca31f603be8ecc
SHA1 45a4b514f6a31504c93df08eb536393206349db0
SHA512 ffc356d06ceb5d118cd8517943af686bd998c87c23619ca57bda67e6e98a46b4ad5683d0c42bb3729f924dbfda3c231bb030bcf63b055911d18d5a834993bab3
SSDEEP 49152:7CbRquA/m2yL5zLfFiV+XenmE3/za61tySHD:koq2Vjnm961tySHD
TLSH
T189D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ccb422ccd18f8259a9b485353340ff458562e68b84c3190bc61c7fa6ddefda9f
MD5 a37e6c78497302d1110845e70f3daf06
SHA1 77cb57b59afb435039f7de59f39ba8395d099926
SHA512 6f24bb73c905222755320173abd13d3ba69afaede0b685bc822bcbbc3ed7573091e4bcfd143aa28549b82a028394d27f01196737de047b4c59318118345ddfe5
SSDEEP 24576:7AhGL6IFoiwtA5l7S535H6LRgy7iBY5/ryIDxXv:7AM5Foiq5t61tySHD
TLSH
T1BC359D81E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8eacf8e8b0a44505b093ccc60ba89aae3a77e6d646b2adff1cceb27ea1501547
MD5 225df53439fb931b93632898fe62f072
SHA1 34e3c45e8defc0b70e68d8acdbe7b2d9ee7d7d4b
SHA512 9016c4d550e7cc7dd4aebad9914714daae75d1813d26fa42ac34b1379febe997d9eae7e6ce3031d11dcb615d09829959d796fd4f0b60233bdc920e36472bc353
SSDEEP 12288:dmw5HEjsChNEBFgl0WDm+CR/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:YwuROWQH6LRgy7iBY5/ryIDxXv
TLSH
T11E65E14576A90CF9EA664238C5978175F7F2BC122A21DB1F13B0C65B6F33351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 79ef1ea8b0df6b089b5dd6920030ce47f9509e534c249a757b73d80190e04e9b
MD5 7e5eef26e568baf73a0d4d66cf1daab9
SHA1 747948f07a9713b21d451c20910b9782a86c9573
SHA512 482b79920cfcf75c4671bd5a02763cfdf5d0cbc0d56eea896e61b2d45117343c20a349af926b2ba2ea6a6e1b04a6d277a60e4b5f5ed61886a6b5a60f603659a5
SSDEEP 12288:syZ1Iy0/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:RZubH6LRgy7iBY5/ryIDxXv
TLSH
T1A555125932E921FED2A74238C8D106C4E3A47C66677143CF12B5666D6F73AC18E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1fa47b97eb33b41efbf6f55dd55b23f5560dc807d8ec5a63ad25c0e97f65d5c0
MD5 18521f5fd107e45588c6b5f9bf1390ed
SHA1 c7b94913f0925988948762aca7ff6e334dd3942f
SHA512 37bb44e4b7e45806aea7c6c07d21fca2b3686334a8812dadb560b2a11528307a28754ba4973773566b98be80357c4a1b58083f808cbb816e6588f53d955c9210
SSDEEP 98304:+QRQyi36YOcPDLvw2gAf+PN3I61tySHD:lQyiKanX+PNY43H
TLSH
T1E0667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 67ac54b3267aa4b463f89f80fcadf37a35a3f60a7f5d1a913a4c7675ef42f09c
MD5 cf4bd8e7488598a3500a25c940216a81
SHA1 3d70d8753e96cfccedb8078ed1e21d70110af579
SHA512 82dd0f91e3d099c841e8e2b8b3b0771b1afdac79f1c2f12c80cc5014e55ddcdd96ff2b9ece8c87f88667f51a7d45850b8385af2cd143a7885aac16ffdbe9b2c5
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3I61tySHD:GQyiKanX+PNY43H
TLSH
T1E3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a6dea778b5ac0a3e2d1e3ca2b7c70ba1c04df6e065d099e86d9472a94a956b40
MD5 c9e91c51cd2301c865679f75075922d2
SHA1 5a080b97ec2fd86056f4c1c687d2bf0fa657eeae
SHA512 2e13ad64c40400ffec8a7427b6f25514ab8f8c67743ab0c001926e5c47f2f0dedad09af8dc79fc12c4d1e09b82e357d5c37de72aa5b2b0452f56cb1c063a555c
SSDEEP 24576:/wvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0rH6LRgy7iBY5/r5:n68Qg55nhkeWu7PNU3/K61tySHD
TLSH
T1A3B54933B2F600A9C44DE1769F4A872196D17C758FE0E3DB8151721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 479695f35979cb704ce98f04606e462950373a25276df09c533097117f22d7e3
MD5 2dfa03c044a748fd5f028bf8a4c2ff60
SHA1 464b4ba4c7f5ae0c867422bc605a52e02c8ff314
SHA512 3ba1cad50f35ba953e1f476ae33c1e4c289207ef5ab2dfea1f42db2eab0de9eda7d3fcd20f74b65fa98f3a90356583f06efd7b7842f4e01f0a348765a445c6a3
SSDEEP 98304:Jy5112gYy5azzVvU69nLKnhZn61tySHD:kLIHRWhl43H
TLSH
T12F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a94375f1566a6936946e97052804d68a525b92f166954e1c9da34d4185cd0105
MD5 7f8eb6421d64546fad94972d613904fb
SHA1 d4c8bd48da91e5e6688cf4b7faeaf033b89362ac
SHA512 7dcef9f3c28df0bd737d0a66b587afa5eeb25e4ebd89a1d2cb1bcd033ee2d5f0e4158bdfb8db701ace051291f72f2f8cb34c0d114c6172893d56d650c2627a4f
SSDEEP 49152:3B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glA61tySHD:Zu6JmIxd2dA61tySHD
TLSH
T1A8D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7bc961b923e18641a68a0dc1a03c3cf23ed12780a83883e90d1de97c90f37c05
MD5 eb9cd6774768fe62c4ced88fc46bd631
SHA1 012aadf95d24bbc722386dd4c4647dc80657a6df
SHA512 5819ce41131558ba5f0e2a743eec7c7de51da9fda216886a71e1860479d0a0cd01f01caa198829a60db001f5a03efa0992a551643af21bf98c38ed4022be7576
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xs61tySHD:6mifPqR961tySHD
TLSH
T1E4B5AE13F2D901E8D06DD17887569232EA61BC460B34B6DF0A90B7962F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 77697e6cd59769cdceb85df9860954c2b932b3ee65f35e684a823c98696774a7
MD5 9f9fd87603986e28d5f7a40636d5f82b
SHA1 09899777daf7bde72893067654ad0a9c99c21709
SHA512 f9692c0e0ed3672bd5438f3fcd665ef46c85781520365672c1334a15cd4476e201c917b41e58e43470834a257400ff94167f84a19faa7f0a2d12da1545f0b74e
SSDEEP 49152:JSuZQIY0Be2KkRVtOnks6NMHqL61tySHD:H5dKqi61L61tySHD
TLSH
T1BDC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 135dea140d13a87986b947219399e7a45f058b3eb944714cad4ca13893390756
MD5 4854c0b38ac92fa03cda4c7930a541d1
SHA1 1a0da110286b914551c9a185591639905fe7e522
SHA512 73f5e07a3bfaf5615eb09818432284cf41177294cc14abfdc71e26438b522e775369f26530a8ebbad6b18d07edbf93dbdd29a5786b47bc07598b2c093402cc76
SSDEEP 49152:IhtSn8EApI0figjgiDn0AP5ww61tySHD:ZX2iWphJ61tySHD
TLSH
T19895BE13F2D901E8D05ED174C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6c05f49e353151ae30806b129cec388c6ea838d961a67dfca1d75b5c87aabb33
MD5 636ec28537cc8e1e3f1521dc08b9371e
SHA1 8091058031f7b82de904b2e35a50f90aa1676494
SHA512 3c388d5a4a3c4fe6fb6c254d38c209b5af65a59716671c1443b06532337e6b3253dec9bb5d6dfef71116f2bc3f4925d34e34239099f20d3617873b354188c893
SSDEEP 12288:Oj/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:OvH6LRgy7iBY5/ryIDxXv
TLSH
T179552365B4EB02EFC7590630C8C502D462CC7F5AEDA1058372FAB56DFEB1A84CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b4f9381750ec0e6287d6a7e913e644bb5bde86cc3466dd21b2a0cfb218e0042d
MD5 36b46e2a86a88e50d78eaa513767f33f
SHA1 ea59dd7c395b2efcdf73668ac5278edb7ca0cd16
SHA512 8854219b1be43b296dd98383d62415008aa7a2e2f4b52da2c5a5594532b4a52094ab25b38f13bb0984d2c186ea7070b2655dda157312ca1c4a14be26177ed5ea
SSDEEP 12288:rQ/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:roH6LRgy7iBY5/ryIDxXv
TLSH
T100552365B4EB02EFC7590630C8C502D462CCBF5AEDA1458372FAB56DFDB1A44CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ac9047bd34bcbe29ee2d8c8d8aeef6263f245ce3de5e58320ece16d15d73eccc
MD5 5ddae9200e1cd4f18caf4cf5551af967
SHA1 03e934680d34994b8b766c981ef5078de9e8a2de
SHA512 7cc1c8bb3b88b28d02f9d7db9361c60cf488a83fd849c4eaaf2adeba491007470c012d0b72157e85a500156ae827f7d6d8ee225af6ab7c63bd387239524a1a67
SSDEEP 12288:+C/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:+6H6LRgy7iBY5/ryIDxXv
TLSH
T14D552365B4EB02EFC7580630C4C502D462CCBF5AEDA1558372FAB56DFDB1A88CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3df9c627fdd73f5353f782a22c5e0091bb7a096462ac712119720e66e5d216af
MD5 518691e7210dcae9f290401e779cb375
SHA1 a1c0b69fe7c5433413508533011f9aec4e19fcad
SHA512 6ba1a7dec403ee87d9be1975e9dc5cbff45680d882014b132fd80a13501d8877347cc2f0cd865d0be3ba990dbf6f6f7f3056bfcac5b5c7a1c2cc1bce444b1656
SSDEEP 12288:rVV/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:LH6LRgy7iBY5/ryIDxXv
TLSH
T16155232576FF01DFCA658230C8C102D4A3D8BE5AEA3143CB62B5755DAEB1B84DE1EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6c25eb3a74677232f3b7946ac7194c8728b79b0dce12324471620355403e1221
MD5 469bd50d89237249c985101f5ea44386
SHA1 4dabf1c0d2e800fe494d517816a74f26c4242908
SHA512 4f00c08604da204a8465e4d5726a1a7fb61ea56582b7701a44300dcc83c02b30917b9f94a164609b983fc85adbb1bfcc8a629eae218624c244ccbbc94535e5be
SSDEEP 12288:Hd/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:HxH6LRgy7iBY5/ryIDxXv
TLSH
T108552365B4EB02EFC7590630C8C502D462CC7F5AEDA1458372FAB56DFEB1A48CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a4b198e19ad7d5910fb0291d6b1f249461ad1732f7b377c6334b43a3e72fa532
MD5 9f8d43e9fcb7f479c2512004171ded32
SHA1 759e126f4f9c176c86c2c8c93305c851c71e119a
SHA512 6b3bee000e81ad736068d7ae646fa560c5c73728c283302f53b7f9a4706933235d54463bed7125edd2f571a621b00531d48fbef99dddd8d54017bfcce3db252f
SSDEEP 12288:BT/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:B/H6LRgy7iBY5/ryIDxXv
TLSH
T14F552365B4EB02EFC7590630C8C502D862CC7F5AEDA1458372FAB56DFEB1A44CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8145295c259ba6bdbe5b3983e9664452c733d2e72572a93dd9c0df7513965850
MD5 5a3f4eaa5936ca39c231001240366f0d
SHA1 ae6130bfd72356aca8999edf5cc12deb36a97903
SHA512 dde18f753cfc79a912cab468c9b8aa4440f7612621dcc8d4cfbaa852bdb1f0c61b5071f2f2825c1f35b12515b53600b483f59ba3b0de16b685753d1e78c6e493
SSDEEP 12288:+X/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:+bH6LRgy7iBY5/ryIDxXv
TLSH
T1A8552365B4EB02EFC7680630C5C502D862CC7F5AECA1458372FAB56DFEB1A44CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3648b4193a46af2f619253004d07a8fe1d68e43fc340d24c9faab6380cd5b3b5
MD5 d667fd355a0f3c40e26aeffd7c6b7a69
SHA1 298769cd2f73cdd3dc7ef191715ec3265f8b4986
SHA512 e595fe99cf58b49f60180407460055d4654b35e8c98758b0e1bd702c82db8167275efe164899fb3c75ee01874522aac442be9d51c54a5456d460c8bfc3fea248
SSDEEP 12288:RiZwbDzzFEoS2cPvyP/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:UZM3zFVSOjH6LRgy7iBY5/ryIDxXv
TLSH
T1CF7501A4B3A008F9DD67823DC8558945D2F27C5A4B70C64F13F8362A6F733904D2EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 60dd154c6d2a4309e1a13b5daeae414b1b4f3c8540be372699334d18c2516b76
MD5 f6859d50f0fac23abe476de85d2dbc39
SHA1 790c34e39cf141e90d9bfe03c2ce1526a9021a7f
SHA512 91c8b119b157349479e755dc3235cda180d943b1f93bae332b17e955ff86beac9655c8c5902ce384fb6c2dc17d6017fc34aa56844f4cb41281ae96ff5d90f8e2
SSDEEP 12288:7s/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:78H6LRgy7iBY5/ryIDxXv
TLSH
T1F7552365B4EB02EFC7580630C4C506D862CC7F5AFDA1458372FAB56DFEB1A488A0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 51273168161cea000f3924d8495f4c32aedc3e6b97f8629fbce281c6303c820b
MD5 e04fcb552fb874a5514f2c9796fccb45
SHA1 d3db61ebc09d3766f54080a9020c3eae43190c0e
SHA512 cb3099af8678bb6f49cdc587f4e0f96ddd1c5eb4a2b35d36bb560410b9f69ce73ea5e7b1d42883c09c619acdffc25bbf2863d3c0ad84c70009d024025ef2cfa9
SSDEEP 12288:3Y/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:3gH6LRgy7iBY5/ryIDxXv
TLSH
T1D6552365B4EB02EFC7590630C5C502D862CCBF5AFCA1458372FAB56DFEB1A448A0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7c92983ff4bffc492119a31392247b21c9179a19aa6d2d097d81234de45a6e6d
MD5 ee8b9adffd8bca5b94c98b98bf23ca7d
SHA1 c2f40668af2f0200f94187d4415c9894463426ff
SHA512 d328606feaa941cf07ba08b9e2c9cae12ff1cba2148fcda099bf25aab586b02c917c5fd1a01c5e5c90ada23b8c84ed546311a540e3c39df71fb3a1db69090581
SSDEEP 12288:syPz5L8r/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:1zyHH6LRgy7iBY5/ryIDxXv
TLSH
T1DF65021772A621FDC1764234C8920A81F3B5BC365B608A9F13B4567A6F737909E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b02b74297eee1439c4afbff8bb78aa520083e4bb53e972cf3cedaa158dcc355e
MD5 1a96ee5e7e0c2985b292d3a5af6fa93f
SHA1 68de4cd7b147fb14d9640597f0b284b59b6cf8c2
SHA512 c045ec3a8df29577de9e06bc4e822f0a491cb1b1931e24a944ee2dd65bb661ac07e6caaf02186ccb3d6d6ad4ef47afb8060ccbe3bf36a4f6c732974e34703a20
SSDEEP 12288:ls/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:l8H6LRgy7iBY5/ryIDxXv
TLSH
T1B4552365B4EB02EFC7580630C4C502D862CC7F5AEDA1458372FAB56DFEB1E488A0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f2ddad7c82bafe0f687f9c7f78a4998197b2e3738bcb22c20a22a0b43b6acdff
MD5 7913ed5ab9d145ac5ca79ae68d77df03
SHA1 757b4ee8463070df0d96956c6ce4fc57a0eaf905
SHA512 01c9b6ca2488a7ee7c76df9678b6a9dd6a534ef1a3215d934c883b6979d3f38f0f3f47f035a1ca2906d8705c6b55f0a827b5faed4509ec22a7b2d28b304a2ffc
SSDEEP 12288:+s/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:+8H6LRgy7iBY5/ryIDxXv
TLSH
T144552365B4EB02EFC7680630C5C506D862CC7F5AECA1458372FAB56DFDB1E488A0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 094ac48e300d74ea7722361b9377907dde211686ddad0fef55fb7eb50822ca3a
MD5 08c98facb3c3bf2139144dced84ff911
SHA1 223b33a864d65a1cc5d4e8a17d7a3320ba83011e
SHA512 f4d78954813b5fee88e039d66b6b04243e534ccba4caed36450e9580f09c69f251842c50b45c6f6288af8146ed8b1d6211461d575a333d6000483be0c7b33869
SSDEEP 12288:ryPz5L8r/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:GzyHH6LRgy7iBY5/ryIDxXv
TLSH
T17665021772A621FDC1764234C8920A81F3B5BC365B608A9F13B4567A6F737909E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d5596e6ea72c7d9b68e853698735b975814cc9f67945d6119471880128395d35
MD5 ab6bdfc6abb5b068fd1942af0fd540aa
SHA1 359c17e2f747c8ab33c525a083dd8c5caeade1ad
SHA512 e1ad1853a0f9b2046279603412449b0792db885c44260e1c948956bea0a48284656e31f71a8d31d90478b6ba4e9a8f45314a08ea200881a60bc7e22e44f11433
SSDEEP 12288:sCd91WYoaLHF3z0z04PDvhZ/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:1T8aLl3z0zDlH6LRgy7iBY5/ryIDxXv
TLSH
T1EC7501A4B3A008F9DD67823EC8554945D2F27C5A4B70C64F13F8366A6F333905D2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f2806db1d9612bc40e1e500a9cff23159300fb2420e845f3520c947262ea40db
MD5 ba7456a0a83711414fec28bcc021f025
SHA1 e854498b4c24d05392d6ffbe1529147c38281c2b
SHA512 5fabec3af857e15b7500bc25790d119b0cf4471f9a3f12926154ac51543ae229e47cdf38beeb6ef0fee6ade0f2f8e1663ef84a8ff6d65081f9acb6ac32dfc906
SSDEEP 24576:n3rd9CHKy7GZxH6LRgy7iBY5/ryIDxXv:3rd9CHKya/61tySHD
TLSH
T11B85CF90F3E410E9F1B78A35C9664511DAB67C5A5B31CE8F03A8661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e4df467de158850b0211a04e56ff56532f0567832f3effac1d3a8c88a2bc73b6
MD5 ef04604d6228b40dfe3cf79fb0a148e2
SHA1 4403fd99c962011b92de1a4c689b438f4c7cd9b4
SHA512 e54e42aac6fb2255eb408759804aaa9008b82bc195644033a8c007b26f88529d20c797ca4282b971729feaa7039e0fc39fc47b3ef5eccf19087ede657dd6b0d8
SSDEEP 12288:bJ/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:b1H6LRgy7iBY5/ryIDxXv
TLSH
T12E552365B4EB02EFC7590630C8C502D862CC7F5AEDA1458372FAB56DFEB1E488A0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0464c296a9b0d53720221ca84552c5e3411690c2034025aed95da82185992cec
MD5 48aa74a5168a2b506f222692bf8d97b9
SHA1 a1348cabee40c7b397fef7197c01d8c629203e13
SHA512 9bbbb63a2d27709794a6c773effe3bb80450c90251de2fc7786e72adae0d92459307286a7475332d428dc263b72286c777bd5072696becb174e112acb4061130
SSDEEP 12288:yL/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:ynH6LRgy7iBY5/ryIDxXv
TLSH
T173552365B5EB02EFC7690630C4C506D462CC7F5AECA1468372FAB52DFEB1A44CA0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 e48f86020000322bf31173ca76575c80785c8dc17f2fae75f0b14f1e9a60609a
MD5 49fe664f4539161f1ba2f1c898089822
SHA1 5b4aa805633a9e1046b93f00306c6fea66319772
SHA512 0159689d56636192c5b9a1b7015a47400c35582d425aad4666872093021aeb2a841d4d019ededfa18b0b6c7978fb115d683df0dadf5060f53aaa6d92d893756a
SSDEEP 12288:Ye/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:Y+H6LRgy7iBY5/ryIDxXv
TLSH
T18D552365B4EB02EFC7580630C5C506D862CC7F5AECA1458372FAB56DFEB1E488A0F952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5c0512c29a2fe6219fff94f4182e9cf40b6a8ad46476d29ebd1708ed421305b4
MD5 fa462942bb8a996e7bf023d3812fa51e
SHA1 b3027faf0dbac829b5f298b445d71e1753b6b043
SHA512 f94c92249a109fee95c4e37294f7c40b7630a8b853e377c64f778a26de2e19122de439c5350c55a573fc35257c27754a650560105c80dcaba05f992e1c1593b1
SSDEEP 12288:cs/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:c8H6LRgy7iBY5/ryIDxXv
TLSH
T1D5552365B4EB02EFC7680630C5C506D862CC7F5AECA1458372FAB56DFDB1A488A0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7def98009c527abc993a99a781bf335d7b595c5ca04c04ac7a0dd40169af0384
MD5 dd55841ced39088cc281a5a99e99976d
SHA1 807d33931d188422b6e5f362833b307eb45aacd4
SHA512 3a9cbfa3f8ed3c7d4bdcfe80e257a9a008bbefe7ade9dc7bcd51ebfc98e99e5a903a6076c7770ff894e00929b9d6ec741d3ac5710e0c0d4eb1eeb25258b187d9
SSDEEP 12288:5J/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:51H6LRgy7iBY5/ryIDxXv
TLSH
T1D0552365B4FB02EFC7580630C8C506D862CC7F5AEDA1458372FAB56DFEB1A488A0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 388b062666b3ad447c8fd1e85555ac62c77d78e9d68f809ce601ec03370570c9
MD5 34dcc1a82724071d2c101ef00f7db231
SHA1 92b000c82ced4c03d705707b6b884b026261e318
SHA512 9b2b27ba26b13422ce0a02ac23a91e51a4d0b1a5329c763cd6bc2ca5ec497acb7587d205b953406e018074e013b8c3f3c0a33a49fbbaefce3a4b393b66319105
SSDEEP 12288:F0/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:F0H6LRgy7iBY5/ryIDxXv
TLSH
T1E2552365B4EB02EFC7580630C9C506D462CC7F5AECA1468372FAB56DFEB1A48CA0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d2a5955cda4ee5f37d18e945d1507fe3d70e2a77922a1c5edd102c21486bf3e4
MD5 f0b6eaa57f0dc9ce30357006ac1a400f
SHA1 2af18b574786db7b64b0c1cd4c5806487ec08e68
SHA512 56bf4e4a7c9a6953bca6face2253f20de46e76264160eb1ac7043064bcc02b17bd01e56df834feb1d1cfa20a0a97e27d72317afc803aaee7ae282d166fb03f12
SSDEEP 12288:iK/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:iyH6LRgy7iBY5/ryIDxXv
TLSH
T162552365B4EB02EFC7580630C8C506D862CC7F5AEDA1458372FAB56DFEB1A48CA0F951
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 043c5cc1e3d1f320248ff0ac5b59953c4c018a3494b31402ec926da3d6d4e8cf
MD5 565226d277b122c7a471f3a4952e0b3f
SHA1 365ff7c62f19036ee06756abeb2c65273adcdf0b
SHA512 ed7aff10c5f251a620311035d1ffaed72ebe03ff602ea082ec6e03ffbed50b1e9768e0dd0b17841d98b173f125c787a06d9126e9c47836f3c7db013ab50b2d42
SSDEEP 24576:Bfwvzk9RX6wkyAInH6LRgy7iBY5/ryIDxXv:gMnYIH61tySHD
TLSH
T1C985D029EBDC04E5E177923C89B7464AF2B178591B31C6CF129A536D0E33ED49E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 009c7ca39e571af5141e4377c710df1598b6ff32ab316366741575bd5457cdb2
MD5 6c39ec95362b141219fbab6447917cae
SHA1 3934e4dc67267131caee43f91d2fb65a679d9cc4
SHA512 ff1859b4e5c8c660918ccc8f898abf85c9372483dc6608c23b8ff276bc285f0c5ee24e09f2ffe4ee87ba554e2c0ebab02bf09694d9f2d67079df0d700cf524ee
SSDEEP 49152:6YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Q61tySHD:lySzPo61tySHD
TLSH
T128066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3233143f43be32f16a40a7e784f2769aae6a561b0bdb139ae83a10439cdf716e
MD5 2cf20ca1be163cbd65fe645cbc8a569a
SHA1 4bb1f8c9f718f636bc76d27e4ca4dfaad77426ba
SHA512 7e92f96ee8a657813f68c824de18c98a04d8e2169b10b2748687e2baf87678869325264150a51800328543df5e04d8156b06394d22c961c5840a0e02f840ba8f
SSDEEP 24576:p47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY4H6LRgy7iBY5/ryIDxXv:p47JUQjqirIhCnDHUPfF/A61tySHD
TLSH
T19A65AE1DA3EC01E5D1BA823885554A5AEA71782E5F31CACF12B0937D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 95b595360a06b697784bd51d654bae972ff97f928c6526157787a95d19989a28
MD5 e347c4281c1722b68a13245b0a2ee8f4
SHA1 a8904a594ae3037e13c46d2a2eae1b0877826e8e
SHA512 36f9e2af75752f8de71d35cb6e30736b6d316bc97c1e24a0d68c474d3e1972166e7d5ed5c16a29fb7b420223fa3345e30cfdd8de87c00cc79e2d10bf423272a7
SSDEEP 12288:+psfX/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:XbH6LRgy7iBY5/ryIDxXv
TLSH
T147650119E2A802EDC16E5234C7854680B3677D6597E1D3CB63E0F53E1F766809EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9cca631a5576d2c8624ce193da52ff8e2f888e461a7f740889b2a48e048a349c
MD5 6a8f379c053e9ba0b52609d3857d63f0
SHA1 e2598e9389353c4a219ba7f8a09918e3f7634026
SHA512 0620fdb57a6e78569135824fb1216e9d5d4add42ebbe6ae2a1b35fec47685cf57181ec82e92d74ff30a4cfa7ce0077590c1c80fdc29ff59784bb5006df7656a0
SSDEEP 12288:Mjq8U3fSMm71CIrQJO33yzwnIe+hWKCXg6G6Y0YLuuJvv:MjnUPQ6O3izfRhW7g6GT0uuEv
TLSH
T11B351850766AC75FC6AD44321E32D1CCAB707D01EE05AB0372C9873FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 8c7e23e115ca24fddd2c4923b729b910c844ac9fd28804229c961d57724b8b8e
MD5 ac86ff1ec06acc205ce2179b3f24b6a3
SHA1 63082774176dea6c0c809fd532957c866c1ba5d8
SHA512 96a52c82a517e15188b8d8f27148c8b56a9b762898f4420ec81bea3646e8e1c74a90df18292ba6865fd03ebf27a5943381e9dcdebaca8e47555f03a42eec3a70
SSDEEP 6144:2GMfkD/P0Tv+LoX7T6tI0mRhVocbVtMx9cbVtMxh+j76RFaHhMWm/Yl:vLoX7T6SlhVKaHhMWmAl
TLSH
T15465C6819537A38FD1FB6032072A5B4CABA4EC03B7456F227384453AD867B65A0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f244e40ee25e9d9bd3d8484b2e6f978922039cc1e0ffb659f702c0381a41c03c
MD5 3eea141e0db19ef6ae2041b689552cc4
SHA1 5db6b684cfa20523626307c86188bb9efaa2d16a
SHA512 3e9c99ec411883e641d368b0824eb59168a00079009904434bf6b90e0295dfae437d2ff54e29cdd3f361969e87af6161745d0cc360ac21f28588a412ac8146c3
SSDEEP 12288:5F7//DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:HzH6LRgy7iBY5/ryIDxXv
TLSH
T102552321B6EE46DFDA79063084C942E4228CBF699F5045C3B1A9765DFD71EC4CE2FA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4efb6735138062288eed25b73c4aec0565604a84ebb57525b5d4a4c8fa13ae65
MD5 76b864b4fd5d9df887b509672095541c
SHA1 f344a27f5741eb2de2c0b9dda5c9ba72658c954e
SHA512 0590a9aa6b67095e0c2bf6a308032b2aebd484d0d8dae4842fff03cf7d1e84b1896672e32610d38d6891eeeeb488782865d49d48140ee540521b478412a4a2ec
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYtH6LRgy7iBY5/ryIDxXv:egb4mBIBhGFe61tySHD
TLSH
T17A65AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2CF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b3a23a55d4d49329b2b3709e1a45e30cc877b46f088b83edeb8bbaf9ce9d2f6a
MD5 2c5aa28edb4bd88c13ac614a36714bf1
SHA1 b43004eadeb0569c1c54b97a960a20636d668fe3
SHA512 b68d1499ef33e9a8fa978a945e855c5b4f6457f03c674205c0248f1b0c0d9ea3d5e60d6092c00f72bfc961051d4ac04c97d53440ed3648f414198451dc316d1d
SSDEEP 24576:hG88u8FpJqH1vzria7/mIH6LRgy7iBY5/ryIDxXv:k7ZFPqVya7/Z61tySHD
TLSH
T1DA85F165B6E102F5D47BD138898646A3F6B1B8250360EBDF07A88B551F33AD44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e7605bb21a0c0592b5e7ce8af9a9d13b28a3f75794adee0ea7eb54c100e21f65
MD5 1940eb33ede455d459750177bcecf9a6
SHA1 6c0abdebdc76b1af93ba11f0cddbf16f26d23b7d
SHA512 ca1a1c3f219f97f6db6b1f38981dd64fa71eadbd772857810c1b1579933ac50be16fff77c2cd0770e49b3cdbbc63367c2e734bc371d5a49fa53b44ea770e62e7
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjS61tySHD:VG05lO43bv61tySHD
TLSH
T131D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 922f26c491674aaa22462c4ae66ebd6fa9136dcc83cfe8fc2514ce4e65af45b8
MD5 222558f06851cf6283222bddd68d08b0
SHA1 7802881324f7a273bb15ed7713f5e06df13defad
SHA512 e16595bb20e9c87425fe8b63577b0b2955f5514859a66cddbedd70c2818dacc7ee6e3f5f4cb9dab89b7cd89fa6f998ad975ef87750ce6e2dbdbf0f55ef6ee5ef
SSDEEP 24576:/fa5POZ3dpyWVM50JicR2hG0lasx2+47eidn2H6LRgy7iBY5/ryIDxXv:Ha5POZ3lJt2pasx2+mK61tySHD
TLSH
T1EF65BF5EA6FC01D5D5B9D17CC583461AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4c889261149b02aa8c7644d84cac82cac39e687c2342c6f3de275eb1005b0bf
MD5 43f0c7a651eb7560ce9282d9ac718f79
SHA1 f79e07227809506a6670051f66850d216d8fc72e
SHA512 f7fa773bcd82e4475da9c0a72361b1fe4515a8e81e41cfc44bf0d72174ca661718d2b6974601627f002b98f6fceb7e8876f756a1eb201b25637e0c4be11f6074
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkwH6LRgy7iBY5/ryIDxXv:ENc/zEOVHF561tySHD
TLSH
T1F8858C2623E901E4E1BBE1BE89779546FAB17865573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e6b7043cbcea852062d3440b1ea07a6b6387cfb0bb0657cb882c5d383d899311
MD5 4e311e48854de9e0b67ff569329cc389
SHA1 2369c3e6ce438b95ab0baf14200e837a05f8bce3
SHA512 d518baf2869d1ca1b5681df5c8dadf255aaa8e07fee3276f91d4b5b8982613ee79c0b287253c3eaf40532f1782bd47a029ff59c4e6361928ad8f4f2c6a3c72c6
SSDEEP 24576:ezkNvNnaFeYhJNtmZBmCH6LRgy7iBY5/ryIDxXv:ezMwBtOm861tySHD
TLSH
T1AD55AF2EB6F806E4D1FEC674CD238512E6727861173293CB5290C13E5E679D89E3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 58325f49967535c4829d80be3b535660ac22f701a5fc1790b0557817d311fab6
MD5 e8269b0797dca6392ff2547691e3288d
SHA1 54fe2748062c3243dc5353819eeb05d8bd9267c1
SHA512 46b757ca0cf8852f3bc0dbfa51ca6ed218ec2db4fcf13ed852ccb277e1361d9a3eb62ebd7435bfce7e74034a64a8716b499557bb54669768b924054435cfd5fc
SSDEEP 12288:hHvUrBFrEjwaQs/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:hPUr+NQ8H6LRgy7iBY5/ryIDxXv
TLSH
T17F65E12F72ED18E9E67A913C85824759F371B862171192CF02E0917E5E73ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5bb26a4cb260948b4a7aa89432c076081b99214905373562bc536696e2c275bf
MD5 49ae00caf850232cb789cd8f72b2c147
SHA1 49597455b7a83591da9e7636cd84390872789fb2
SHA512 755d429e4c8be3c019dc8f854ae791efd127ab51d34617000d25b718f05237ee2b1be3484be1adf12f1d3c6617e370e79ce0db99c4da71f135bc92dcd4b35420
SSDEEP 24576:mD3FHshBIYQgAPH6LRgy7iBY5/ryIDxXv:mDVHeBIAAf61tySHD
TLSH
T18F75E13DE6AD00E5D57AC17CCA934606E3B138A9032256CB12D4D1BA5F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/688-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/688-344-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/688-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/688-101-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/688-342-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2640-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2640-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2640-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2640-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2640-132-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2756-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2756-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2756-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2756-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2852-49-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2852-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2852-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2852-39-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/2852-45-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/3244-13-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3244-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3244-22-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3244-87-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4252-0-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/4252-7-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/4252-182-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/4252-6-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/4252-1-0x0000000002460000-0x00000000024C6000-memory.dmp

Download

memory/4252-86-0x0000000000400000-0x0000000000673000-memory.dmp

Download

memory/4348-347-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4348-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4348-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4348-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4528-327-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4528-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4528-77-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/4528-82-0x00000000009F0000-0x0000000000A56000-memory.dmp

Download

memory/5184-343-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5184-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5184-112-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5184-114-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5484-53-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5484-187-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5484-59-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5484-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5524-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5524-89-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5524-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5524-358-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5524-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5524-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5764-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5764-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5764-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5764-311-0x0000000140000000-0x0000000140222000-memory.dmp

Download